API tools faq
paste
paladin316

HawkEye_34a88b738ed04dd53830096b5b38a852_exe_2019-07-05_23_30.txt

paladin316
Jul 7th, 2019
2,073
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 49.84 KB | None | 0 0
raw download clone embed print report
  1. * MalFamily: "Malicious"
  2.  
  3. * MalScore: 10.0
  4.  
  5. * File Name: "HawkEye_34a88b738ed04dd53830096b5b38a852.exe"
  6. * File Size: 794624
  7. * File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
  8. * SHA256: "9f097afbe277191e0da0b9dfd7c93112c59dcd54bdd3988f224f1c6e5ab4bde3"
  9. * MD5: "34a88b738ed04dd53830096b5b38a852"
  10. * SHA1: "f8bcfdb7367c252501aed723162bb9c0b46874b8"
  11. * SHA512: "3a63c550677fe9278d1da509888b2f1a42c8045bc5d1c4e6e98827fff2431aee6cd57b07102350ab80939b8524ffef34e21f9cfb5b1b4341b5da6c0fbbc17b78"
  12. * CRC32: "3F9ED66B"
  13. * SSDEEP: "12288:7sL9X/tbUF/QJwjIeODLBuKOYPu8Y91fGUIyC0h1fPFuzohRUNUSUo/X11iPOvBe:wBXGF/wvEYPsPUw1fPFuBBfKPOvB"
  14.  
  15. * Process Execution:
  16. "HawkEye_34a88b738ed04dd53830096b5b38a852.exe",
  17. "msconfig.exe",
  18. "Windows Update.exe",
  19. "msconfig.exe",
  20. "Windows Update.exe",
  21. "msconfig.exe",
  22. "Windows Update.exe",
  23. "msconfig.exe",
  24. "Windows Update.exe",
  25. "msconfig.exe",
  26. "Windows Update.exe",
  27. "msconfig.exe",
  28. "Windows Update.exe",
  29. "msconfig.exe",
  30. "Windows Update.exe",
  31. "msconfig.exe",
  32. "Windows Update.exe",
  33. "msconfig.exe",
  34. "Windows Update.exe",
  35. "msconfig.exe",
  36. "Windows Update.exe",
  37. "msconfig.exe",
  38. "Windows Update.exe",
  39. "msconfig.exe",
  40. "Windows Update.exe",
  41. "msconfig.exe",
  42. "Windows Update.exe",
  43. "msconfig.exe",
  44. "Windows Update.exe",
  45. "msconfig.exe",
  46. "Windows Update.exe",
  47. "msconfig.exe",
  48. "Windows Update.exe",
  49. "msconfig.exe",
  50. "Windows Update.exe",
  51. "msconfig.exe",
  52. "Windows Update.exe",
  53. "msconfig.exe",
  54. "Windows Update.exe",
  55. "msconfig.exe",
  56. "Windows Update.exe",
  57. "msconfig.exe",
  58. "Windows Update.exe",
  59. "msconfig.exe",
  60. "Windows Update.exe",
  61. "msconfig.exe",
  62. "Windows Update.exe",
  63. "msconfig.exe",
  64. "Windows Update.exe",
  65. "msconfig.exe",
  66. "Windows Update.exe",
  67. "msconfig.exe",
  68. "Windows Update.exe",
  69. "msconfig.exe",
  70. "Windows Update.exe",
  71. "msconfig.exe",
  72. "Windows Update.exe",
  73. "msconfig.exe",
  74. "Windows Update.exe",
  75. "msconfig.exe",
  76. "Windows Update.exe",
  77. "msconfig.exe",
  78. "Windows Update.exe",
  79. "msconfig.exe",
  80. "Windows Update.exe",
  81. "msconfig.exe",
  82. "Windows Update.exe",
  83. "msconfig.exe",
  84. "Windows Update.exe",
  85. "msconfig.exe",
  86. "Windows Update.exe",
  87. "msconfig.exe",
  88. "Windows Update.exe",
  89. "msconfig.exe",
  90. "Windows Update.exe",
  91. "msconfig.exe",
  92. "Windows Update.exe",
  93. "msconfig.exe",
  94. "Windows Update.exe",
  95. "msconfig.exe",
  96. "Windows Update.exe",
  97. "msconfig.exe",
  98. "Windows Update.exe",
  99. "msconfig.exe",
  100. "Windows Update.exe",
  101. "msconfig.exe",
  102. "Windows Update.exe",
  103. "msconfig.exe",
  104. "Windows Update.exe",
  105. "msconfig.exe",
  106. "Windows Update.exe",
  107. "msconfig.exe",
  108. "Windows Update.exe",
  109. "msconfig.exe",
  110. "Windows Update.exe",
  111. "msconfig.exe",
  112. "Windows Update.exe",
  113. "msconfig.exe",
  114. "Windows Update.exe",
  115. "msconfig.exe",
  116. "Windows Update.exe",
  117. "msconfig.exe",
  118. "Windows Update.exe",
  119. "msconfig.exe",
  120. "Windows Update.exe",
  121. "msconfig.exe",
  122. "Windows Update.exe",
  123. "msconfig.exe",
  124. "Windows Update.exe",
  125. "msconfig.exe",
  126. "Windows Update.exe",
  127. "msconfig.exe",
  128. "Windows Update.exe",
  129. "msconfig.exe",
  130. "Windows Update.exe",
  131. "msconfig.exe",
  132. "Windows Update.exe",
  133. "msconfig.exe",
  134. "Windows Update.exe",
  135. "msconfig.exe",
  136. "Windows Update.exe",
  137. "msconfig.exe"
  138.  
  139.  
  140. * Executed Commands:
  141. "C:\\Users\\user\\AppData\\Roaming\\msconfig.exe ",
  142. "C:\\Users\\user\\AppData\\Roaming\\Windows Update.exe "
  143.  
  144.  
  145. * Signatures Detected:
  146.  
  147. "Description": "Creates RWX memory",
  148. "Details":
  149.  
  150.  
  151. "Description": "Possible date expiration check, exits too soon after checking local time",
  152. "Details":
  153.  
  154. "process": "Windows Update.exe, PID 4044"
  155.  
  156.  
  157.  
  158.  
  159. "Description": "Starts servers listening on 127.0.0.1:0",
  160. "Details":
  161.  
  162.  
  163. "Description": "Drops a binary and executes it",
  164. "Details":
  165.  
  166. "binary": "C:\\Users\\user\\AppData\\Roaming\\Windows Update.exe"
  167.  
  168.  
  169. "binary": "C:\\Users\\user\\AppData\\Roaming\\msconfig.exe"
  170.  
  171.  
  172.  
  173.  
  174. "Description": "The binary likely contains encrypted or compressed data.",
  175. "Details":
  176.  
  177. "section": "name: .text, entropy: 7.66, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x000a4000, virtual_size: 0x000a33a4"
  178.  
  179.  
  180. "section": "name: .rsrc, entropy: 7.57, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0001b000, virtual_size: 0x0001a2e8"
  181.  
  182.  
  183.  
  184.  
  185. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  186. "Details":
  187.  
  188. "Process": "msconfig.exe tried to sleep 3662 seconds, actually delayed analysis time by 0 seconds"
  189.  
  190.  
  191. "Process": "Windows Update.exe tried to sleep 3601 seconds, actually delayed analysis time by 0 seconds"
  192.  
  193.  
  194.  
  195.  
  196. "Description": "Installs itself for autorun at Windows startup",
  197. "Details":
  198.  
  199. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\18.exe"
  200.  
  201.  
  202. "data": "C:\\Users\\user\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe"
  203.  
  204.  
  205. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\18.exe"
  206.  
  207.  
  208. "data": "C:\\Users\\user\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe"
  209.  
  210.  
  211.  
  212.  
  213. "Description": "Creates a hidden or system file",
  214. "Details":
  215.  
  216. "file": "C:\\Users\\user\\AppData\\Roaming\\msconfig.exe"
  217.  
  218.  
  219.  
  220.  
  221. "Description": "Likely virus infection of existing system binary",
  222. "Details":
  223.  
  224. "file": "c:\\users\\user\\appdata\\roaming\\msconfig.exe"
  225.  
  226.  
  227.  
  228.  
  229. "Description": "File has been identified by 35 Antiviruses on VirusTotal as malicious",
  230. "Details":
  231.  
  232. "MicroWorld-eScan": "Gen:Variant.Kazy.51389"
  233.  
  234.  
  235. "FireEye": "Generic.mg.34a88b738ed04dd5"
  236.  
  237.  
  238. "Cylance": "Unsafe"
  239.  
  240.  
  241. "K7GW": "Trojan ( 0052c0671 )"
  242.  
  243.  
  244. "K7AntiVirus": "Trojan ( 0052c0671 )"
  245.  
  246.  
  247. "Arcabit": "Trojan.Kazy.DC8BD"
  248.  
  249.  
  250. "Invincea": "heuristic"
  251.  
  252.  
  253. "Baidu": "MSIL.Trojan.Injector.u"
  254.  
  255.  
  256. "F-Prot": "W32/MSIL_Troj.DO.gen!Eldorado"
  257.  
  258.  
  259. "Avast": "MSIL:GenMalicious-AHQ Trj"
  260.  
  261.  
  262. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  263.  
  264.  
  265. "BitDefender": "Gen:Variant.Kazy.51389"
  266.  
  267.  
  268. "AegisLab": "Trojan.Win32.Generic.m289"
  269.  
  270.  
  271. "Ad-Aware": "Gen:Variant.Kazy.51389"
  272.  
  273.  
  274. "Emsisoft": "Gen:Variant.Kazy.51389 (B)"
  275.  
  276.  
  277. "Comodo": "TrojWare.MSIL.Injector.DKR@7ixht8"
  278.  
  279.  
  280. "F-Secure": "Trojan.TR/Dropper.Gen"
  281.  
  282.  
  283. "Trapmine": "malicious.high.ml.score"
  284.  
  285.  
  286. "Sophos": "Troj/MSIL-ECK"
  287.  
  288.  
  289. "SentinelOne": "DFI - Malicious PE"
  290.  
  291.  
  292. "Cyren": "W32/MSIL_Troj.DO.gen!Eldorado"
  293.  
  294.  
  295. "Avira": "TR/Dropper.Gen"
  296.  
  297.  
  298. "Microsoft": "VirTool:MSIL/Obfuscator.AS!rebhip"
  299.  
  300.  
  301. "Endgame": "malicious (moderate confidence)"
  302.  
  303.  
  304. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  305.  
  306.  
  307. "GData": "Gen:Variant.Kazy.51389"
  308.  
  309.  
  310. "ALYac": "Gen:Variant.Kazy.51389"
  311.  
  312.  
  313. "MAX": "malware (ai score=89)"
  314.  
  315.  
  316. "ESET-NOD32": "a variant of MSIL/Injector.YN"
  317.  
  318.  
  319. "Ikarus": "Trojan.Injector"
  320.  
  321.  
  322. "Fortinet": "MSIL/Injector.PE!tr"
  323.  
  324.  
  325. "AVG": "MSIL:GenMalicious-AHQ Trj"
  326.  
  327.  
  328. "Cybereason": "malicious.38ed04"
  329.  
  330.  
  331. "CrowdStrike": "win/malicious_confidence_90% (D)"
  332.  
  333.  
  334. "Qihoo-360": "HEUR/QVM03.0.540F.Malware.Gen"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Creates a copy of itself",
  340. "Details":
  341.  
  342. "copy": "C:\\Users\\user\\AppData\\Roaming\\Windows Update.exe"
  343.  
  344.  
  345. "copy": "C:\\Users\\user\\AppData\\Roaming\\msconfig.exe"
  346.  
  347.  
  348. "copy": "C:\\Users\\user\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe"
  349.  
  350.  
  351.  
  352.  
  353.  
  354. * Started Service:
  355.  
  356. * Mutexes:
  357. "Global\\CLR_CASOFF_MUTEX",
  358. "CicLoadWinStaWinSta0",
  359. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  360. "Global\\.net clr networking"
  361.  
  362.  
  363. * Modified Files:
  364. "C:\\Users\\user\\AppData\\Roaming\\msconfig.exe",
  365. "C:\\Users\\user\\AppData\\RoamingMicrosoft\\System\\Services\\18.exe",
  366. "C:\\Users\\user\\AppData\\Local\\GDIPFONTCACHEV1.DAT",
  367. "C:\\Users\\user\\AppData\\Local\\Temp\\SysInfo.txt",
  368. "C:\\Users\\user\\AppData\\Roaming\\Windows Update.exe"
  369.  
  370.  
  371. * Deleted Files:
  372. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1948.9821671",
  373. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1948.9821671",
  374. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1948.9821687",
  375. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2960.9822265",
  376. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2960.9822265",
  377. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2960.9822265",
  378. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1728.9823125",
  379. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1728.9823125",
  380. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1728.9823125",
  381. "C:\\Users\\user\\AppData\\Local\\Temp\\SysInfo.txt",
  382. "C:\\Users\\user\\AppData\\Roaming\\Windows Update.exe",
  383. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1180.9823406",
  384. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1180.9823406",
  385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1180.9823406",
  386. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1420.9824234",
  387. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1420.9824234",
  388. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1420.9824234",
  389. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3044.9824500",
  390. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3044.9824500",
  391. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3044.9824500",
  392. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3056.9825421",
  393. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3056.9825421",
  394. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3056.9825421",
  395. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2404.9825718",
  396. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2404.9825718",
  397. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2404.9825718",
  398. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2644.9826562",
  399. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2644.9826562",
  400. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2644.9826562",
  401. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1584.9826953",
  402. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1584.9826953",
  403. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1584.9826953",
  404. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3040.9827890",
  405. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3040.9827890",
  406. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3040.9827906",
  407. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3036.9828328",
  408. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3036.9828328",
  409. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3036.9828343",
  410. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.780.9829421",
  411. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.780.9829421",
  412. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.780.9829421",
  413. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2924.9829828",
  414. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2924.9829828",
  415. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2924.9829828",
  416. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2016.9830937",
  417. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2016.9830937",
  418. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2016.9830937",
  419. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1316.9831328",
  420. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1316.9831328",
  421. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1316.9831328",
  422. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2336.9832812",
  423. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2336.9832812",
  424. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2336.9832812",
  425. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2800.9833578",
  426. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2800.9833578",
  427. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2800.9833593",
  428. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1308.9835171",
  429. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1308.9835171",
  430. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1308.9835171",
  431. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2216.9835796",
  432. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2216.9835796",
  433. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2216.9835796",
  434. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1656.9837203",
  435. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1656.9837203",
  436. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1656.9837203",
  437. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2428.9837890",
  438. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2428.9837890",
  439. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2428.9837906",
  440. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3028.9839437",
  441. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3028.9839437",
  442. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3028.9839453",
  443. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2996.9840140",
  444. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2996.9840140",
  445. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2996.9840140",
  446. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1428.9842250",
  447. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1428.9842265",
  448. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1428.9842265",
  449. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1712.9843250",
  450. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1712.9843250",
  451. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1712.9843250",
  452. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2780.9845328",
  453. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2780.9845328",
  454. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2780.9845328",
  455. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1444.9846281",
  456. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1444.9846281",
  457. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1444.9846281",
  458. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.800.9847859",
  459. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.800.9847859",
  460. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.800.9847875",
  461. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2468.9848515",
  462. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2468.9848515",
  463. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2468.9848531",
  464. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3032.9850265",
  465. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3032.9850265",
  466. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3032.9850265",
  467. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2796.9850937",
  468. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2796.9850937",
  469. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2796.9850937",
  470. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2636.9853500",
  471. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2636.9853500",
  472. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2636.9853500",
  473. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2776.9854234",
  474. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2776.9854234",
  475. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2776.9854234",
  476. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2172.9856125",
  477. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2172.9856125",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2172.9856140",
  479. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1376.9856953",
  480. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1376.9856953",
  481. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1376.9856953",
  482. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2600.9859062",
  483. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2600.9859062",
  484. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2600.9859062",
  485. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2616.9859859",
  486. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2616.9859859",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2616.9859859",
  488. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1880.9862109",
  489. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1880.9862109",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1880.9862109",
  491. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2556.9862906",
  492. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2556.9862906",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2556.9862906",
  494. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2124.9864765",
  495. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2124.9864765",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2124.9864765",
  497. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1172.9865671",
  498. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1172.9865671",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1172.9865671",
  500. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2760.9867750",
  501. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2760.9867750",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2760.9867750",
  503. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2992.9868656",
  504. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2992.9868656",
  505. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2992.9868656",
  506. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1664.9870984",
  507. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1664.9870984",
  508. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1664.9870984",
  509. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2260.9872421",
  510. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2260.9872421",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2260.9872421",
  512. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1276.9875828",
  513. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1276.9875828",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1276.9875828",
  515. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2564.9876781",
  516. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2564.9876781",
  517. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2564.9876781",
  518. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.160.9880312",
  519. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.160.9880312",
  520. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.160.9880312",
  521. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3020.9881843",
  522. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3020.9881843",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3020.9881843",
  524. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2592.9884312",
  525. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2592.9884328",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2592.9884328",
  527. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.580.9885109",
  528. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.580.9885109",
  529. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.580.9885109",
  530. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1184.9887687",
  531. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1184.9887687",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1184.9887687",
  533. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1972.9888703",
  534. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1972.9888703",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1972.9888718",
  536. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2612.9892578",
  537. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2612.9892578",
  538. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2612.9892578",
  539. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1240.9894312",
  540. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1240.9894312",
  541. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1240.9894312",
  542. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2668.9896906",
  543. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2668.9896906",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2668.9896906",
  545. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.332.9898328",
  546. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.332.9898328",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.332.9898328",
  548. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2300.9902375",
  549. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2300.9902375",
  550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2300.9902375",
  551. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.672.9904437",
  552. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.672.9904437",
  553. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.672.9904437",
  554. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1696.9908703",
  555. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1696.9908703",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1696.9908718",
  557. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2652.9910765",
  558. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2652.9910765",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2652.9910765",
  560. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2684.9914890",
  561. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2684.9914890",
  562. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2684.9914890",
  563. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2500.9916671",
  564. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2500.9916671",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2500.9916671",
  566. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2832.9921250",
  567. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2832.9921250",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2832.9921250",
  569. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1432.9923453",
  570. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1432.9923453",
  571. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1432.9923453",
  572. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2440.9928000",
  573. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2440.9928000",
  574. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2440.9928000",
  575. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.984.9930406",
  576. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.984.9930406",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.984.9930406",
  578. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1416.9935453",
  579. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1416.9935453",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1416.9935453",
  581. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.976.9937937",
  582. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.976.9937937",
  583. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.976.9937937",
  584. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2072.9941375",
  585. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2072.9941375",
  586. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2072.9941375",
  587. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2368.9942640",
  588. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2368.9942640",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2368.9942640",
  590. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2840.9947640",
  591. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2840.9947640",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2840.9947640",
  593. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2860.9950015",
  594. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2860.9950015",
  595. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2860.9950015",
  596. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1988.9955187",
  597. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1988.9955187",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1988.9955187",
  599. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.964.9957984",
  600. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.964.9957984",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.964.9957984",
  602. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1824.9963406",
  603. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1824.9963406",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1824.9963406",
  605. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1868.9966187",
  606. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1868.9966187",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1868.9966187",
  608. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2200.9971921",
  609. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2200.9971921",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2200.9971921",
  611. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1212.9973625",
  612. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1212.9973640",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1212.9973640",
  614. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2516.9979468",
  615. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2516.9979468",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2516.9979468",
  617. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2456.9982156",
  618. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2456.9982156",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2456.9982156",
  620. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1744.9987843",
  621. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1744.9987843",
  622. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1744.9987843",
  623. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3120.9990421",
  624. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3120.9990421",
  625. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3120.9990421",
  626. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3296.9996312",
  627. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3296.9996312",
  628. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3296.9996328",
  629. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3408.9999234",
  630. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3408.9999234",
  631. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3408.9999234",
  632. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3584.10004171",
  633. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3584.10004171",
  634. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3584.10004171",
  635. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3692.10006843",
  636. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3692.10006843",
  637. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3692.10006843",
  638. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3876.10013125",
  639. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3876.10013125",
  640. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3876.10013125",
  641. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3988.10016328",
  642. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3988.10016328",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3988.10016328",
  644. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.920.10021640",
  645. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.920.10021640",
  646. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.920.10021640",
  647. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3148.10023343",
  648. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3148.10023343",
  649. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3148.10023343",
  650. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3064.10027093",
  651. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3064.10027093",
  652. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3064.10027093",
  653. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3404.10028968",
  654. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3404.10028968",
  655. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3404.10028968",
  656. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3716.10032703",
  657. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3716.10032703",
  658. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3716.10032703",
  659. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3836.10034234",
  660. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3836.10034234",
  661. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3836.10034234",
  662. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.4044.10039468",
  663. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4044.10039468",
  664. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.4044.10039468",
  665. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.988.10041078",
  666. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.988.10041093",
  667. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.988.10041093",
  668. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3172.10044875",
  669. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3172.10044875",
  670. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3172.10044875",
  671. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3460.10046750",
  672. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3460.10046750",
  673. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3460.10046765",
  674. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3548.10050359",
  675. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3548.10050359",
  676. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3548.10050375",
  677. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3736.10051734",
  678. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3736.10051734",
  679. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3736.10051734",
  680. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3828.10055906",
  681. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3828.10055906",
  682. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3828.10055906",
  683. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3696.10057812",
  684. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3696.10057812",
  685. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3696.10057812",
  686. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3224.10064265",
  687. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3224.10064265",
  688. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3224.10064281",
  689. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.4088.10067312",
  690. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4088.10067312",
  691. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.4088.10067328",
  692. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3380.10071937",
  693. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3380.10071937",
  694. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3380.10071937",
  695. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3440.10073453",
  696. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3440.10073453",
  697. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3440.10073453",
  698. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2208.10077984",
  699. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2208.10077984",
  700. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2208.10077984",
  701. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3796.10079953",
  702. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3796.10079953",
  703. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3796.10079968",
  704. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.4020.10084421",
  705. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4020.10084421",
  706. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.4020.10084437",
  707. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.808.10086531",
  708. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.808.10086531",
  709. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.808.10086531",
  710. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3252.10090828",
  711. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3252.10090828",
  712. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3252.10090828",
  713. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3772.10093015",
  714. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3772.10093015",
  715. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3772.10093015",
  716. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3800.10098515",
  717. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3800.10098515",
  718. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3800.10098515",
  719. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3652.10101437",
  720. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3652.10101437",
  721. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3652.10101437",
  722. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.928.10106484",
  723. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.928.10106484",
  724. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.928.10106484",
  725. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3364.10108875",
  726. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3364.10108875",
  727. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3364.10108875",
  728. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3684.10113875",
  729. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3684.10113875",
  730. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3684.10113875",
  731. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3748.10117062",
  732. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3748.10117062",
  733. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3748.10117062",
  734. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.3856.10124890",
  735. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3856.10124890",
  736. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3856.10124906"
  737.  
  738.  
  739. * Modified Registry Keys:
  740. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\18.exe",
  741. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\18.exe"
  742.  
  743.  
  744. * Deleted Registry Keys:
  745.  
  746. * DNS Communications:
  747.  
  748. * Domains:
  749.  
  750. * Network Communication - ICMP:
  751.  
  752. * Network Communication - HTTP:
  753.  
  754. * Network Communication - SMTP:
  755.  
  756. * Network Communication - Hosts:
  757.  
  758. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!