Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Directory routes:
- -------------------
- %userprofile%\NoBV36V\LLzAN45\Wzo8rwhj3.exe
- %localappdata%\NlsLexicons0020\FWPUCLNT.exe
- IP:
- -----
- 23.225.152.164
- 185.24.232.74
- CnC:
- ------
- 12.163.208.58
- URL:
- ------
- *http://pagearrow.com/wordpress/xF/
- *http://yzlangfeng.com/wp-includes/2/
- *https://codepog.com/wp-includes/vK/
- *https://aravindhherbalstore.com/iyvdv/c/
- *https://alltopgame.com/wp-content/Qu/
- *https://st47.net/wp-content/languages/OH/
- *http://xiaoxiangkeji.top/wp-content/Rrb/
- Registry Key:
- --------------
- HKU\S-1-5-21-XXX-XXX-XXX\Software\Microsoft\Windows\CurrentVersion\Run\FWPUCLNT:""C:\%LOCALAPPDATA%\NlsLexicons0020\FWPUCLNT.exe""
- SHA256 Document:
- -----------------
- 7bb6dcb764ab45bd9e6513f873a8463d2d861597595b533cb236a8a5f35711d3 323355_2409_092020.doc
- SHA256 Executables:
- --------------------
- f2b5604df9251a26d5d77211589b7b34a672851b0aec97e792e1842562b8c11c 6KOxHga8.exe(codepog.com)
- d535e4789fc15e5e4ab8b58e0f5b3665aa7de91bc4aac21cc6d9e4d533a0bc96 D5Y4790u0nDJ.exe(pagearrow.com)
- 5a1d92741144a59a83eeb106bee1eee0006fffd3d94aae1d283ba0d3d95ed1a8 hEJAfa33GBQnXXjK.exe(st47.net)
- e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Wzo8rwhj3.exe
- f2b5604df9251a26d5d77211589b7b34a672851b0aec97e792e1842562b8c11c FWPUCLNT.exe
Add Comment
Please, Sign In to add comment
