API tools faq
paste
paladin316

Exes_fa9da31c57f745e23eb620914826d6d8_exe_2019-07-23_09_30.txt

paladin316
Jul 23rd, 2019
2,112
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 84.35 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_fa9da31c57f745e23eb620914826d6d8.exe"
  7. * File Size: 1196620
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "c53c63c463365f8f617d9ca026eb91274ef26015d993b58e1de3b463640a5aa7"
  10. * MD5: "fa9da31c57f745e23eb620914826d6d8"
  11. * SHA1: "6f41e53081e9e243be1888ee9a3f2bed0d20da0d"
  12. * SHA512: "ae51be01c485b7d4a37318ca09b4ec49d225c98b8f4380d0b0de13a26076eeebb0f57c65aa2b7e1dad11a57792b6e6e8988c40330d8514fd19ad1d91eedc486b"
  13. * CRC32: "724486FD"
  14. * SSDEEP: "24576:bNA3R5drXpdC1XvpGLADwNGwuavDvvFHGJYxGyiDbGAMGw0nf:G5XsOAUwwuaTvU+xebGB4nf"
  15.  
  16. * Process Execution:
  17. "Exes_fa9da31c57f745e23eb620914826d6d8.exe",
  18. "wscript.exe",
  19. "ext.exe",
  20. "ext.exe",
  21. "RegSvcs.exe",
  22. "wscript.exe",
  23. "ext.exe",
  24. "ext.exe",
  25. "wscript.exe",
  26. "ext.exe",
  27. "ext.exe",
  28. "RegSvcs.exe",
  29. "wscript.exe",
  30. "ext.exe",
  31. "ext.exe",
  32. "wscript.exe",
  33. "ext.exe",
  34. "ext.exe",
  35. "wscript.exe",
  36. "ext.exe",
  37. "ext.exe",
  38. "wscript.exe",
  39. "ext.exe",
  40. "ext.exe",
  41. "wscript.exe",
  42. "ext.exe",
  43. "ext.exe",
  44. "wscript.exe",
  45. "ext.exe",
  46. "ext.exe",
  47. "wscript.exe",
  48. "ext.exe",
  49. "ext.exe",
  50. "wscript.exe",
  51. "ext.exe",
  52. "ext.exe",
  53. "wscript.exe",
  54. "ext.exe",
  55. "ext.exe",
  56. "wscript.exe",
  57. "ext.exe",
  58. "ext.exe",
  59. "wscript.exe",
  60. "ext.exe",
  61. "ext.exe",
  62. "wscript.exe",
  63. "ext.exe",
  64. "ext.exe",
  65. "wscript.exe",
  66. "ext.exe",
  67. "ext.exe",
  68. "wscript.exe",
  69. "ext.exe",
  70. "ext.exe",
  71. "wscript.exe",
  72. "ext.exe",
  73. "ext.exe",
  74. "wscript.exe",
  75. "ext.exe",
  76. "ext.exe",
  77. "wscript.exe",
  78. "ext.exe",
  79. "ext.exe",
  80. "wscript.exe",
  81. "ext.exe",
  82. "ext.exe",
  83. "RegSvcs.exe",
  84. "wscript.exe",
  85. "ext.exe",
  86. "ext.exe",
  87. "wscript.exe",
  88. "ext.exe",
  89. "ext.exe",
  90. "wscript.exe",
  91. "ext.exe",
  92. "ext.exe",
  93. "RegSvcs.exe",
  94. "wscript.exe",
  95. "ext.exe",
  96. "ext.exe",
  97. "wscript.exe",
  98. "explorer.exe",
  99. "svchost.exe",
  100. "WMIADAP.exe",
  101. "taskeng.exe",
  102. "tbtfsgew.exe",
  103. "svchost.exe",
  104. "WmiPrvSE.exe",
  105. "svchost.exe"
  106.  
  107.  
  108. * Executed Commands:
  109. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\gkg.vbs\"",
  110. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\gkg.vbs ",
  111. "\"C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe\" lgv=nvc",
  112. "ext.exe lgv=nvc",
  113. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UZJHD",
  114. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\run.vbs\"",
  115. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\run.vbs ",
  116. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  117. "taskeng.exe 43744FB9-005F-4BA6-9834-C993C65A4E13 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  118. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JLQFJ",
  119. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\RJBXI",
  120. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\KMTOT",
  121. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JDJEN",
  122. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WBKUA",
  123. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BDEIZ",
  124. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WMSEC",
  125. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UBPMS",
  126. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\YXHCQ",
  127. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\USYUJ",
  128. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\LNNHV",
  129. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\NWDVK",
  130. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GQNYQ",
  131. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\AUMRU",
  132. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\CKHLS",
  133. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  134. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\EZFMH",
  135. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  136. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ZAVVS",
  137. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UKQFH",
  138. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BCTBS",
  139. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GMZRA",
  140. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\XQSVR",
  141. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\SYOQV",
  142. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WEGPW",
  143. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\TNIHC"
  144.  
  145.  
  146. * Signatures Detected:
  147.  
  148. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  149. "Details":
  150.  
  151. "IP": "23.59.190.137:80"
  152.  
  153.  
  154. "IP": "23.59.190.120:80"
  155.  
  156.  
  157.  
  158.  
  159. "Description": "Possible date expiration check, exits too soon after checking local time",
  160. "Details":
  161.  
  162. "process": "ext.exe, PID 2192"
  163.  
  164.  
  165.  
  166.  
  167. "Description": "Creates RWX memory",
  168. "Details":
  169.  
  170.  
  171. "Description": "Detected script timer window indicative of sleep style evasion",
  172. "Details":
  173.  
  174. "Window": "WSH-Timer"
  175.  
  176.  
  177.  
  178.  
  179. "Description": "A process attempted to delay the analysis task.",
  180. "Details":
  181.  
  182. "Process": "wscript.exe tried to sleep 1560 seconds, actually delayed analysis time by 0 seconds"
  183.  
  184.  
  185. "Process": "explorer.exe tried to sleep 812 seconds, actually delayed analysis time by 0 seconds"
  186.  
  187.  
  188. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  189.  
  190.  
  191.  
  192.  
  193. "Description": "Expresses interest in specific running processes",
  194. "Details":
  195.  
  196. "process": "WMIADAP.exe"
  197.  
  198.  
  199. "process": "lsass.exe"
  200.  
  201.  
  202. "process": "services.exe"
  203.  
  204.  
  205. "process": "wininit.exe"
  206.  
  207.  
  208. "process": "RegSvcs.exe"
  209.  
  210.  
  211. "process": "csrss.exe"
  212.  
  213.  
  214. "process": "System"
  215.  
  216.  
  217. "process": "lsm.exe"
  218.  
  219.  
  220. "process": "conhost.exe"
  221.  
  222.  
  223. "process": "smss.exe"
  224.  
  225.  
  226. "process": "svchost.exe"
  227.  
  228.  
  229. "process": "explorer.exe"
  230.  
  231.  
  232. "process": "armsvc.exe"
  233.  
  234.  
  235. "process": "winlogon.exe"
  236.  
  237.  
  238. "process": "WmiPrvSE.exe"
  239.  
  240.  
  241.  
  242.  
  243. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  244. "Details":
  245.  
  246.  
  247. "Description": "Reads data out of its own binary image",
  248. "Details":
  249.  
  250. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00000000, length: 0x00000007"
  251.  
  252.  
  253. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00000000, length: 0x00002000"
  254.  
  255.  
  256. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00000007, length: 0x00124245"
  257.  
  258.  
  259. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00001ff0, length: 0x00002000"
  260.  
  261.  
  262. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00003fe0, length: 0x00002000"
  263.  
  264.  
  265. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00005fd0, length: 0x00002000"
  266.  
  267.  
  268. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00007fc0, length: 0x00002000"
  269.  
  270.  
  271. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00009fb0, length: 0x00002000"
  272.  
  273.  
  274. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0000bfa0, length: 0x00002000"
  275.  
  276.  
  277. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0000df90, length: 0x00002000"
  278.  
  279.  
  280. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0000ff80, length: 0x00002000"
  281.  
  282.  
  283. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00011f70, length: 0x00002000"
  284.  
  285.  
  286. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00013f60, length: 0x00002000"
  287.  
  288.  
  289. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00015f50, length: 0x00002000"
  290.  
  291.  
  292. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00017f40, length: 0x00002000"
  293.  
  294.  
  295. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00019f30, length: 0x00002000"
  296.  
  297.  
  298. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0001bf20, length: 0x00002000"
  299.  
  300.  
  301. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0001df10, length: 0x00002000"
  302.  
  303.  
  304. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0001ff00, length: 0x00002000"
  305.  
  306.  
  307. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00021ef0, length: 0x00002000"
  308.  
  309.  
  310. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00023ee0, length: 0x00002000"
  311.  
  312.  
  313. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00025ed0, length: 0x00002000"
  314.  
  315.  
  316. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00027ec0, length: 0x00002000"
  317.  
  318.  
  319. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00029eb0, length: 0x00002000"
  320.  
  321.  
  322. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0002bea0, length: 0x00002000"
  323.  
  324.  
  325. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0002de90, length: 0x00002000"
  326.  
  327.  
  328. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0002fe80, length: 0x00002000"
  329.  
  330.  
  331. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00031e70, length: 0x00002000"
  332.  
  333.  
  334. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00033e60, length: 0x00002000"
  335.  
  336.  
  337. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00035e50, length: 0x00002000"
  338.  
  339.  
  340. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00037e40, length: 0x00002000"
  341.  
  342.  
  343. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00039e30, length: 0x00002000"
  344.  
  345.  
  346. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0003be20, length: 0x00002000"
  347.  
  348.  
  349. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0003de10, length: 0x00002000"
  350.  
  351.  
  352. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0003fe00, length: 0x00002000"
  353.  
  354.  
  355. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00041df0, length: 0x00002000"
  356.  
  357.  
  358. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00043de0, length: 0x00002000"
  359.  
  360.  
  361. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00045dd0, length: 0x00002000"
  362.  
  363.  
  364. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00047dc0, length: 0x00002000"
  365.  
  366.  
  367. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00049db0, length: 0x00002000"
  368.  
  369.  
  370. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0004bda0, length: 0x00002000"
  371.  
  372.  
  373. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0004dd90, length: 0x00002000"
  374.  
  375.  
  376. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0004fd80, length: 0x00002000"
  377.  
  378.  
  379. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00050a00, length: 0x00000031"
  380.  
  381.  
  382. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00050a19, length: 0x000d02b1"
  383.  
  384.  
  385. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00120eca, length: 0x00000028"
  386.  
  387.  
  388. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001210a7, length: 0x00000027"
  389.  
  390.  
  391. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00121288, length: 0x00000028"
  392.  
  393.  
  394. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001214c0, length: 0x00000029"
  395.  
  396.  
  397. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001216a4, length: 0x00000028"
  398.  
  399.  
  400. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0012186f, length: 0x00000028"
  401.  
  402.  
  403. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00121a3b, length: 0x00000028"
  404.  
  405.  
  406. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00121c04, length: 0x00000028"
  407.  
  408.  
  409. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00121e13, length: 0x00000028"
  410.  
  411.  
  412. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122027, length: 0x00000028"
  413.  
  414.  
  415. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122202, length: 0x00000028"
  416.  
  417.  
  418. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0012240a, length: 0x00000028"
  419.  
  420.  
  421. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122627, length: 0x00000028"
  422.  
  423.  
  424. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0012281b, length: 0x00000028"
  425.  
  426.  
  427. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122a2f, length: 0x00000028"
  428.  
  429.  
  430. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122c09, length: 0x00000028"
  431.  
  432.  
  433. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00122e2c, length: 0x00000027"
  434.  
  435.  
  436. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0012300f, length: 0x00000028"
  437.  
  438.  
  439. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x0012320d, length: 0x00000028"
  440.  
  441.  
  442. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001233df, length: 0x00000028"
  443.  
  444.  
  445. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001235d0, length: 0x00000028"
  446.  
  447.  
  448. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001237f0, length: 0x00000028"
  449.  
  450.  
  451. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x001239cc, length: 0x00000028"
  452.  
  453.  
  454. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00123bab, length: 0x00000028"
  455.  
  456.  
  457. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00123d8e, length: 0x00000028"
  458.  
  459.  
  460. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00123f94, length: 0x00000028"
  461.  
  462.  
  463. "self_read": "process: Exes_fa9da31c57f745e23eb620914826d6d8.exe, pid: 2100, offset: 0x00124191, length: 0x0000001b"
  464.  
  465.  
  466. "self_read": "process: wscript.exe, pid: 2644, offset: 0x00000000, length: 0x00000040"
  467.  
  468.  
  469. "self_read": "process: wscript.exe, pid: 2644, offset: 0x000000f0, length: 0x00000018"
  470.  
  471.  
  472. "self_read": "process: wscript.exe, pid: 2644, offset: 0x000001e8, length: 0x00000078"
  473.  
  474.  
  475. "self_read": "process: wscript.exe, pid: 2644, offset: 0x00018000, length: 0x00000020"
  476.  
  477.  
  478. "self_read": "process: wscript.exe, pid: 2644, offset: 0x00018058, length: 0x00000018"
  479.  
  480.  
  481. "self_read": "process: wscript.exe, pid: 2644, offset: 0x000181a8, length: 0x00000018"
  482.  
  483.  
  484. "self_read": "process: wscript.exe, pid: 2644, offset: 0x00018470, length: 0x00000010"
  485.  
  486.  
  487. "self_read": "process: wscript.exe, pid: 2644, offset: 0x00018640, length: 0x00000012"
  488.  
  489.  
  490. "self_read": "process: wscript.exe, pid: 2400, offset: 0x00000000, length: 0x00000040"
  491.  
  492.  
  493. "self_read": "process: wscript.exe, pid: 2400, offset: 0x000000f0, length: 0x00000018"
  494.  
  495.  
  496. "self_read": "process: wscript.exe, pid: 2400, offset: 0x000001e8, length: 0x00000078"
  497.  
  498.  
  499. "self_read": "process: wscript.exe, pid: 2400, offset: 0x00018000, length: 0x00000020"
  500.  
  501.  
  502. "self_read": "process: wscript.exe, pid: 2400, offset: 0x00018058, length: 0x00000018"
  503.  
  504.  
  505. "self_read": "process: wscript.exe, pid: 2400, offset: 0x000181a8, length: 0x00000018"
  506.  
  507.  
  508. "self_read": "process: wscript.exe, pid: 2400, offset: 0x00018470, length: 0x00000010"
  509.  
  510.  
  511. "self_read": "process: wscript.exe, pid: 2400, offset: 0x00018640, length: 0x00000012"
  512.  
  513.  
  514. "self_read": "process: wscript.exe, pid: 2020, offset: 0x00000000, length: 0x00000040"
  515.  
  516.  
  517. "self_read": "process: wscript.exe, pid: 2020, offset: 0x000000f0, length: 0x00000018"
  518.  
  519.  
  520. "self_read": "process: wscript.exe, pid: 2020, offset: 0x000001e8, length: 0x00000078"
  521.  
  522.  
  523. "self_read": "process: wscript.exe, pid: 2020, offset: 0x00018000, length: 0x00000020"
  524.  
  525.  
  526. "self_read": "process: wscript.exe, pid: 2020, offset: 0x00018058, length: 0x00000018"
  527.  
  528.  
  529. "self_read": "process: wscript.exe, pid: 2020, offset: 0x000181a8, length: 0x00000018"
  530.  
  531.  
  532. "self_read": "process: wscript.exe, pid: 2020, offset: 0x00018470, length: 0x00000010"
  533.  
  534.  
  535. "self_read": "process: wscript.exe, pid: 2020, offset: 0x00018640, length: 0x00000012"
  536.  
  537.  
  538. "self_read": "process: wscript.exe, pid: 1776, offset: 0x00000000, length: 0x00000040"
  539.  
  540.  
  541. "self_read": "process: wscript.exe, pid: 1776, offset: 0x000000f0, length: 0x00000018"
  542.  
  543.  
  544. "self_read": "process: wscript.exe, pid: 1776, offset: 0x000001e8, length: 0x00000078"
  545.  
  546.  
  547. "self_read": "process: wscript.exe, pid: 1776, offset: 0x00018000, length: 0x00000020"
  548.  
  549.  
  550. "self_read": "process: wscript.exe, pid: 1776, offset: 0x00018058, length: 0x00000018"
  551.  
  552.  
  553. "self_read": "process: wscript.exe, pid: 1776, offset: 0x000181a8, length: 0x00000018"
  554.  
  555.  
  556. "self_read": "process: wscript.exe, pid: 1776, offset: 0x00018470, length: 0x00000010"
  557.  
  558.  
  559. "self_read": "process: wscript.exe, pid: 1776, offset: 0x00018640, length: 0x00000012"
  560.  
  561.  
  562. "self_read": "process: wscript.exe, pid: 2552, offset: 0x00000000, length: 0x00000040"
  563.  
  564.  
  565. "self_read": "process: wscript.exe, pid: 2552, offset: 0x000000f0, length: 0x00000018"
  566.  
  567.  
  568. "self_read": "process: wscript.exe, pid: 2552, offset: 0x000001e8, length: 0x00000078"
  569.  
  570.  
  571. "self_read": "process: wscript.exe, pid: 2552, offset: 0x00018000, length: 0x00000020"
  572.  
  573.  
  574. "self_read": "process: wscript.exe, pid: 2552, offset: 0x00018058, length: 0x00000018"
  575.  
  576.  
  577. "self_read": "process: wscript.exe, pid: 2552, offset: 0x000181a8, length: 0x00000018"
  578.  
  579.  
  580. "self_read": "process: wscript.exe, pid: 2552, offset: 0x00018470, length: 0x00000010"
  581.  
  582.  
  583. "self_read": "process: wscript.exe, pid: 2552, offset: 0x00018640, length: 0x00000012"
  584.  
  585.  
  586. "self_read": "process: wscript.exe, pid: 320, offset: 0x00000000, length: 0x00000040"
  587.  
  588.  
  589. "self_read": "process: wscript.exe, pid: 320, offset: 0x000000f0, length: 0x00000018"
  590.  
  591.  
  592. "self_read": "process: wscript.exe, pid: 320, offset: 0x000001e8, length: 0x00000078"
  593.  
  594.  
  595. "self_read": "process: wscript.exe, pid: 320, offset: 0x00018000, length: 0x00000020"
  596.  
  597.  
  598. "self_read": "process: wscript.exe, pid: 320, offset: 0x00018058, length: 0x00000018"
  599.  
  600.  
  601. "self_read": "process: wscript.exe, pid: 320, offset: 0x000181a8, length: 0x00000018"
  602.  
  603.  
  604. "self_read": "process: wscript.exe, pid: 320, offset: 0x00018470, length: 0x00000010"
  605.  
  606.  
  607. "self_read": "process: wscript.exe, pid: 320, offset: 0x00018640, length: 0x00000012"
  608.  
  609.  
  610. "self_read": "process: wscript.exe, pid: 2208, offset: 0x00000000, length: 0x00000040"
  611.  
  612.  
  613. "self_read": "process: wscript.exe, pid: 2208, offset: 0x000000f0, length: 0x00000018"
  614.  
  615.  
  616. "self_read": "process: wscript.exe, pid: 2208, offset: 0x000001e8, length: 0x00000078"
  617.  
  618.  
  619. "self_read": "process: wscript.exe, pid: 2208, offset: 0x00018000, length: 0x00000020"
  620.  
  621.  
  622. "self_read": "process: wscript.exe, pid: 2208, offset: 0x00018058, length: 0x00000018"
  623.  
  624.  
  625. "self_read": "process: wscript.exe, pid: 2208, offset: 0x000181a8, length: 0x00000018"
  626.  
  627.  
  628. "self_read": "process: wscript.exe, pid: 2208, offset: 0x00018470, length: 0x00000010"
  629.  
  630.  
  631. "self_read": "process: wscript.exe, pid: 2208, offset: 0x00018640, length: 0x00000012"
  632.  
  633.  
  634. "self_read": "process: wscript.exe, pid: 2372, offset: 0x00000000, length: 0x00000040"
  635.  
  636.  
  637. "self_read": "process: wscript.exe, pid: 2372, offset: 0x000000f0, length: 0x00000018"
  638.  
  639.  
  640. "self_read": "process: wscript.exe, pid: 2372, offset: 0x000001e8, length: 0x00000078"
  641.  
  642.  
  643. "self_read": "process: wscript.exe, pid: 2372, offset: 0x00018000, length: 0x00000020"
  644.  
  645.  
  646. "self_read": "process: wscript.exe, pid: 2372, offset: 0x00018058, length: 0x00000018"
  647.  
  648.  
  649. "self_read": "process: wscript.exe, pid: 2372, offset: 0x000181a8, length: 0x00000018"
  650.  
  651.  
  652. "self_read": "process: wscript.exe, pid: 2372, offset: 0x00018470, length: 0x00000010"
  653.  
  654.  
  655. "self_read": "process: wscript.exe, pid: 2372, offset: 0x00018640, length: 0x00000012"
  656.  
  657.  
  658. "self_read": "process: wscript.exe, pid: 2456, offset: 0x00000000, length: 0x00000040"
  659.  
  660.  
  661. "self_read": "process: wscript.exe, pid: 2456, offset: 0x000000f0, length: 0x00000018"
  662.  
  663.  
  664. "self_read": "process: wscript.exe, pid: 2456, offset: 0x000001e8, length: 0x00000078"
  665.  
  666.  
  667. "self_read": "process: wscript.exe, pid: 2456, offset: 0x00018000, length: 0x00000020"
  668.  
  669.  
  670. "self_read": "process: wscript.exe, pid: 2456, offset: 0x00018058, length: 0x00000018"
  671.  
  672.  
  673. "self_read": "process: wscript.exe, pid: 2456, offset: 0x000181a8, length: 0x00000018"
  674.  
  675.  
  676. "self_read": "process: wscript.exe, pid: 2456, offset: 0x00018470, length: 0x00000010"
  677.  
  678.  
  679. "self_read": "process: wscript.exe, pid: 2456, offset: 0x00018640, length: 0x00000012"
  680.  
  681.  
  682. "self_read": "process: wscript.exe, pid: 1184, offset: 0x00000000, length: 0x00000040"
  683.  
  684.  
  685. "self_read": "process: wscript.exe, pid: 1184, offset: 0x000000f0, length: 0x00000018"
  686.  
  687.  
  688. "self_read": "process: wscript.exe, pid: 1184, offset: 0x000001e8, length: 0x00000078"
  689.  
  690.  
  691. "self_read": "process: wscript.exe, pid: 1184, offset: 0x00018000, length: 0x00000020"
  692.  
  693.  
  694. "self_read": "process: wscript.exe, pid: 1184, offset: 0x00018058, length: 0x00000018"
  695.  
  696.  
  697. "self_read": "process: wscript.exe, pid: 1184, offset: 0x000181a8, length: 0x00000018"
  698.  
  699.  
  700. "self_read": "process: wscript.exe, pid: 1184, offset: 0x00018470, length: 0x00000010"
  701.  
  702.  
  703. "self_read": "process: wscript.exe, pid: 1184, offset: 0x00018640, length: 0x00000012"
  704.  
  705.  
  706. "self_read": "process: wscript.exe, pid: 936, offset: 0x00000000, length: 0x00000040"
  707.  
  708.  
  709. "self_read": "process: wscript.exe, pid: 936, offset: 0x000000f0, length: 0x00000018"
  710.  
  711.  
  712. "self_read": "process: wscript.exe, pid: 936, offset: 0x000001e8, length: 0x00000078"
  713.  
  714.  
  715. "self_read": "process: wscript.exe, pid: 936, offset: 0x00018000, length: 0x00000020"
  716.  
  717.  
  718. "self_read": "process: wscript.exe, pid: 936, offset: 0x00018058, length: 0x00000018"
  719.  
  720.  
  721. "self_read": "process: wscript.exe, pid: 936, offset: 0x000181a8, length: 0x00000018"
  722.  
  723.  
  724. "self_read": "process: wscript.exe, pid: 936, offset: 0x00018470, length: 0x00000010"
  725.  
  726.  
  727. "self_read": "process: wscript.exe, pid: 936, offset: 0x00018640, length: 0x00000012"
  728.  
  729.  
  730. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00000000, length: 0x00000040"
  731.  
  732.  
  733. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000000f0, length: 0x00000018"
  734.  
  735.  
  736. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000001e8, length: 0x00000078"
  737.  
  738.  
  739. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018000, length: 0x00000020"
  740.  
  741.  
  742. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018058, length: 0x00000018"
  743.  
  744.  
  745. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000181a8, length: 0x00000018"
  746.  
  747.  
  748. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018470, length: 0x00000010"
  749.  
  750.  
  751. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018640, length: 0x00000012"
  752.  
  753.  
  754. "self_read": "process: wscript.exe, pid: 2668, offset: 0x00000000, length: 0x00000040"
  755.  
  756.  
  757. "self_read": "process: wscript.exe, pid: 2668, offset: 0x000000f0, length: 0x00000018"
  758.  
  759.  
  760. "self_read": "process: wscript.exe, pid: 2668, offset: 0x000001e8, length: 0x00000078"
  761.  
  762.  
  763. "self_read": "process: wscript.exe, pid: 2668, offset: 0x00018000, length: 0x00000020"
  764.  
  765.  
  766. "self_read": "process: wscript.exe, pid: 2668, offset: 0x00018058, length: 0x00000018"
  767.  
  768.  
  769. "self_read": "process: wscript.exe, pid: 2668, offset: 0x000181a8, length: 0x00000018"
  770.  
  771.  
  772. "self_read": "process: wscript.exe, pid: 2668, offset: 0x00018470, length: 0x00000010"
  773.  
  774.  
  775. "self_read": "process: wscript.exe, pid: 2668, offset: 0x00018640, length: 0x00000012"
  776.  
  777.  
  778. "self_read": "process: wscript.exe, pid: 1988, offset: 0x00000000, length: 0x00000040"
  779.  
  780.  
  781. "self_read": "process: wscript.exe, pid: 1988, offset: 0x000000f0, length: 0x00000018"
  782.  
  783.  
  784. "self_read": "process: wscript.exe, pid: 1988, offset: 0x000001e8, length: 0x00000078"
  785.  
  786.  
  787. "self_read": "process: wscript.exe, pid: 1988, offset: 0x00018000, length: 0x00000020"
  788.  
  789.  
  790. "self_read": "process: wscript.exe, pid: 1988, offset: 0x00018058, length: 0x00000018"
  791.  
  792.  
  793. "self_read": "process: wscript.exe, pid: 1988, offset: 0x000181a8, length: 0x00000018"
  794.  
  795.  
  796. "self_read": "process: wscript.exe, pid: 1988, offset: 0x00018470, length: 0x00000010"
  797.  
  798.  
  799. "self_read": "process: wscript.exe, pid: 1988, offset: 0x00018640, length: 0x00000012"
  800.  
  801.  
  802. "self_read": "process: wscript.exe, pid: 2580, offset: 0x00000000, length: 0x00000040"
  803.  
  804.  
  805. "self_read": "process: wscript.exe, pid: 2580, offset: 0x000000f0, length: 0x00000018"
  806.  
  807.  
  808. "self_read": "process: wscript.exe, pid: 2580, offset: 0x000001e8, length: 0x00000078"
  809.  
  810.  
  811. "self_read": "process: wscript.exe, pid: 2580, offset: 0x00018000, length: 0x00000020"
  812.  
  813.  
  814. "self_read": "process: wscript.exe, pid: 2580, offset: 0x00018058, length: 0x00000018"
  815.  
  816.  
  817. "self_read": "process: wscript.exe, pid: 2580, offset: 0x000181a8, length: 0x00000018"
  818.  
  819.  
  820. "self_read": "process: wscript.exe, pid: 2580, offset: 0x00018470, length: 0x00000010"
  821.  
  822.  
  823. "self_read": "process: wscript.exe, pid: 2580, offset: 0x00018640, length: 0x00000012"
  824.  
  825.  
  826. "self_read": "process: wscript.exe, pid: 180, offset: 0x00000000, length: 0x00000040"
  827.  
  828.  
  829. "self_read": "process: wscript.exe, pid: 180, offset: 0x000000f0, length: 0x00000018"
  830.  
  831.  
  832. "self_read": "process: wscript.exe, pid: 180, offset: 0x000001e8, length: 0x00000078"
  833.  
  834.  
  835. "self_read": "process: wscript.exe, pid: 180, offset: 0x00018000, length: 0x00000020"
  836.  
  837.  
  838. "self_read": "process: wscript.exe, pid: 180, offset: 0x00018058, length: 0x00000018"
  839.  
  840.  
  841. "self_read": "process: wscript.exe, pid: 180, offset: 0x000181a8, length: 0x00000018"
  842.  
  843.  
  844. "self_read": "process: wscript.exe, pid: 180, offset: 0x00018470, length: 0x00000010"
  845.  
  846.  
  847. "self_read": "process: wscript.exe, pid: 180, offset: 0x00018640, length: 0x00000012"
  848.  
  849.  
  850. "self_read": "process: wscript.exe, pid: 2016, offset: 0x00000000, length: 0x00000040"
  851.  
  852.  
  853. "self_read": "process: wscript.exe, pid: 2016, offset: 0x000000f0, length: 0x00000018"
  854.  
  855.  
  856. "self_read": "process: wscript.exe, pid: 2016, offset: 0x000001e8, length: 0x00000078"
  857.  
  858.  
  859. "self_read": "process: wscript.exe, pid: 2016, offset: 0x00018000, length: 0x00000020"
  860.  
  861.  
  862. "self_read": "process: wscript.exe, pid: 2016, offset: 0x00018058, length: 0x00000018"
  863.  
  864.  
  865. "self_read": "process: wscript.exe, pid: 2016, offset: 0x000181a8, length: 0x00000018"
  866.  
  867.  
  868. "self_read": "process: wscript.exe, pid: 2016, offset: 0x00018470, length: 0x00000010"
  869.  
  870.  
  871. "self_read": "process: wscript.exe, pid: 2016, offset: 0x00018640, length: 0x00000012"
  872.  
  873.  
  874. "self_read": "process: wscript.exe, pid: 3076, offset: 0x00000000, length: 0x00000040"
  875.  
  876.  
  877. "self_read": "process: wscript.exe, pid: 3076, offset: 0x000000f0, length: 0x00000018"
  878.  
  879.  
  880. "self_read": "process: wscript.exe, pid: 3076, offset: 0x000001e8, length: 0x00000078"
  881.  
  882.  
  883. "self_read": "process: wscript.exe, pid: 3076, offset: 0x00018000, length: 0x00000020"
  884.  
  885.  
  886. "self_read": "process: wscript.exe, pid: 3076, offset: 0x00018058, length: 0x00000018"
  887.  
  888.  
  889. "self_read": "process: wscript.exe, pid: 3076, offset: 0x000181a8, length: 0x00000018"
  890.  
  891.  
  892. "self_read": "process: wscript.exe, pid: 3076, offset: 0x00018470, length: 0x00000010"
  893.  
  894.  
  895. "self_read": "process: wscript.exe, pid: 3076, offset: 0x00018640, length: 0x00000012"
  896.  
  897.  
  898. "self_read": "process: wscript.exe, pid: 3740, offset: 0x00000000, length: 0x00000040"
  899.  
  900.  
  901. "self_read": "process: wscript.exe, pid: 3740, offset: 0x000000f0, length: 0x00000018"
  902.  
  903.  
  904. "self_read": "process: wscript.exe, pid: 3740, offset: 0x000001e8, length: 0x00000078"
  905.  
  906.  
  907. "self_read": "process: wscript.exe, pid: 3740, offset: 0x00018000, length: 0x00000020"
  908.  
  909.  
  910. "self_read": "process: wscript.exe, pid: 3740, offset: 0x00018058, length: 0x00000018"
  911.  
  912.  
  913. "self_read": "process: wscript.exe, pid: 3740, offset: 0x000181a8, length: 0x00000018"
  914.  
  915.  
  916. "self_read": "process: wscript.exe, pid: 3740, offset: 0x00018470, length: 0x00000010"
  917.  
  918.  
  919. "self_read": "process: wscript.exe, pid: 3740, offset: 0x00018640, length: 0x00000012"
  920.  
  921.  
  922. "self_read": "process: wscript.exe, pid: 4052, offset: 0x00000000, length: 0x00000040"
  923.  
  924.  
  925. "self_read": "process: wscript.exe, pid: 4052, offset: 0x000000f0, length: 0x00000018"
  926.  
  927.  
  928. "self_read": "process: wscript.exe, pid: 4052, offset: 0x000001e8, length: 0x00000078"
  929.  
  930.  
  931. "self_read": "process: wscript.exe, pid: 4052, offset: 0x00018000, length: 0x00000020"
  932.  
  933.  
  934. "self_read": "process: wscript.exe, pid: 4052, offset: 0x00018058, length: 0x00000018"
  935.  
  936.  
  937. "self_read": "process: wscript.exe, pid: 4052, offset: 0x000181a8, length: 0x00000018"
  938.  
  939.  
  940. "self_read": "process: wscript.exe, pid: 4052, offset: 0x00018470, length: 0x00000010"
  941.  
  942.  
  943. "self_read": "process: wscript.exe, pid: 4052, offset: 0x00018640, length: 0x00000012"
  944.  
  945.  
  946. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00000000, length: 0x00000040"
  947.  
  948.  
  949. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000000f0, length: 0x00000018"
  950.  
  951.  
  952. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000001e8, length: 0x00000078"
  953.  
  954.  
  955. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018000, length: 0x00000020"
  956.  
  957.  
  958. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018058, length: 0x00000018"
  959.  
  960.  
  961. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000181a8, length: 0x00000018"
  962.  
  963.  
  964. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018470, length: 0x00000010"
  965.  
  966.  
  967. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018640, length: 0x00000012"
  968.  
  969.  
  970. "self_read": "process: wscript.exe, pid: 1752, offset: 0x00000000, length: 0x00000040"
  971.  
  972.  
  973. "self_read": "process: wscript.exe, pid: 1752, offset: 0x000000f0, length: 0x00000018"
  974.  
  975.  
  976. "self_read": "process: wscript.exe, pid: 1752, offset: 0x000001e8, length: 0x00000078"
  977.  
  978.  
  979. "self_read": "process: wscript.exe, pid: 1752, offset: 0x00018000, length: 0x00000020"
  980.  
  981.  
  982. "self_read": "process: wscript.exe, pid: 1752, offset: 0x00018058, length: 0x00000018"
  983.  
  984.  
  985. "self_read": "process: wscript.exe, pid: 1752, offset: 0x000181a8, length: 0x00000018"
  986.  
  987.  
  988. "self_read": "process: wscript.exe, pid: 1752, offset: 0x00018470, length: 0x00000010"
  989.  
  990.  
  991. "self_read": "process: wscript.exe, pid: 1752, offset: 0x00018640, length: 0x00000012"
  992.  
  993.  
  994. "self_read": "process: wscript.exe, pid: 4092, offset: 0x00000000, length: 0x00000040"
  995.  
  996.  
  997. "self_read": "process: wscript.exe, pid: 4092, offset: 0x000000f0, length: 0x00000018"
  998.  
  999.  
  1000. "self_read": "process: wscript.exe, pid: 4092, offset: 0x000001e8, length: 0x00000078"
  1001.  
  1002.  
  1003. "self_read": "process: wscript.exe, pid: 4092, offset: 0x00018000, length: 0x00000020"
  1004.  
  1005.  
  1006. "self_read": "process: wscript.exe, pid: 4092, offset: 0x00018058, length: 0x00000018"
  1007.  
  1008.  
  1009. "self_read": "process: wscript.exe, pid: 4092, offset: 0x000181a8, length: 0x00000018"
  1010.  
  1011.  
  1012. "self_read": "process: wscript.exe, pid: 4092, offset: 0x00018470, length: 0x00000010"
  1013.  
  1014.  
  1015. "self_read": "process: wscript.exe, pid: 4092, offset: 0x00018640, length: 0x00000012"
  1016.  
  1017.  
  1018. "self_read": "process: wscript.exe, pid: 3488, offset: 0x00000000, length: 0x00000040"
  1019.  
  1020.  
  1021. "self_read": "process: wscript.exe, pid: 3488, offset: 0x000000f0, length: 0x00000018"
  1022.  
  1023.  
  1024. "self_read": "process: wscript.exe, pid: 3488, offset: 0x000001e8, length: 0x00000078"
  1025.  
  1026.  
  1027. "self_read": "process: wscript.exe, pid: 3488, offset: 0x00018000, length: 0x00000020"
  1028.  
  1029.  
  1030. "self_read": "process: wscript.exe, pid: 3488, offset: 0x00018058, length: 0x00000018"
  1031.  
  1032.  
  1033. "self_read": "process: wscript.exe, pid: 3488, offset: 0x000181a8, length: 0x00000018"
  1034.  
  1035.  
  1036. "self_read": "process: wscript.exe, pid: 3488, offset: 0x00018470, length: 0x00000010"
  1037.  
  1038.  
  1039. "self_read": "process: wscript.exe, pid: 3488, offset: 0x00018640, length: 0x00000012"
  1040.  
  1041.  
  1042. "self_read": "process: wscript.exe, pid: 1976, offset: 0x00000000, length: 0x00000040"
  1043.  
  1044.  
  1045. "self_read": "process: wscript.exe, pid: 1976, offset: 0x000000f0, length: 0x00000018"
  1046.  
  1047.  
  1048. "self_read": "process: wscript.exe, pid: 1976, offset: 0x000001e8, length: 0x00000078"
  1049.  
  1050.  
  1051. "self_read": "process: wscript.exe, pid: 1976, offset: 0x00018000, length: 0x00000020"
  1052.  
  1053.  
  1054. "self_read": "process: wscript.exe, pid: 1976, offset: 0x00018058, length: 0x00000018"
  1055.  
  1056.  
  1057. "self_read": "process: wscript.exe, pid: 1976, offset: 0x000181a8, length: 0x00000018"
  1058.  
  1059.  
  1060. "self_read": "process: wscript.exe, pid: 1976, offset: 0x00018470, length: 0x00000010"
  1061.  
  1062.  
  1063. "self_read": "process: wscript.exe, pid: 1976, offset: 0x00018640, length: 0x00000012"
  1064.  
  1065.  
  1066. "self_read": "process: wscript.exe, pid: 3208, offset: 0x00000000, length: 0x00000040"
  1067.  
  1068.  
  1069. "self_read": "process: wscript.exe, pid: 3208, offset: 0x000000f0, length: 0x00000018"
  1070.  
  1071.  
  1072. "self_read": "process: wscript.exe, pid: 3208, offset: 0x000001e8, length: 0x00000078"
  1073.  
  1074.  
  1075. "self_read": "process: wscript.exe, pid: 3208, offset: 0x00018000, length: 0x00000020"
  1076.  
  1077.  
  1078. "self_read": "process: wscript.exe, pid: 3208, offset: 0x00018058, length: 0x00000018"
  1079.  
  1080.  
  1081. "self_read": "process: wscript.exe, pid: 3208, offset: 0x000181a8, length: 0x00000018"
  1082.  
  1083.  
  1084. "self_read": "process: wscript.exe, pid: 3208, offset: 0x00018470, length: 0x00000010"
  1085.  
  1086.  
  1087. "self_read": "process: wscript.exe, pid: 3208, offset: 0x00018640, length: 0x00000012"
  1088.  
  1089.  
  1090.  
  1091.  
  1092. "Description": "A process created a hidden window",
  1093. "Details":
  1094.  
  1095. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  1096.  
  1097.  
  1098.  
  1099.  
  1100. "Description": "Drops a binary and executes it",
  1101. "Details":
  1102.  
  1103. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe"
  1104.  
  1105.  
  1106. "binary": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe"
  1107.  
  1108.  
  1109.  
  1110.  
  1111. "Description": "Performs some HTTP requests",
  1112. "Details":
  1113.  
  1114. "url": "http://www.msftncsi.com/ncsi.txt"
  1115.  
  1116.  
  1117.  
  1118.  
  1119. "Description": "Executed a process and injected code into it, probably while unpacking",
  1120. "Details":
  1121.  
  1122. "Injection": "ext.exe(1340) -> RegSvcs.exe(2532)"
  1123.  
  1124.  
  1125.  
  1126.  
  1127. "Description": "Detects Sandboxie through the presence of a library",
  1128. "Details":
  1129.  
  1130.  
  1131. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  1132. "Details":
  1133.  
  1134. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier"
  1135.  
  1136.  
  1137.  
  1138.  
  1139. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  1140. "Details":
  1141.  
  1142. "regkeyval": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache"
  1143.  
  1144.  
  1145.  
  1146.  
  1147. "Description": "Installs itself for autorun at Windows startup",
  1148. "Details":
  1149.  
  1150. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk"
  1151.  
  1152.  
  1153. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk"
  1154.  
  1155.  
  1156.  
  1157.  
  1158. "Description": "Creates a hidden or system file",
  1159. "Details":
  1160.  
  1161. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe"
  1162.  
  1163.  
  1164. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\aoh.pdf"
  1165.  
  1166.  
  1167. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\auh.jpg"
  1168.  
  1169.  
  1170. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bgc.txt"
  1171.  
  1172.  
  1173. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bhl.pdf"
  1174.  
  1175.  
  1176. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bmr.xl"
  1177.  
  1178.  
  1179. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bql.xl"
  1180.  
  1181.  
  1182. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\cge.jpg"
  1183.  
  1184.  
  1185. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\dus.mp3"
  1186.  
  1187.  
  1188. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\eoc.bmp"
  1189.  
  1190.  
  1191. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\gkg.vbs"
  1192.  
  1193.  
  1194. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\hlq.dat"
  1195.  
  1196.  
  1197. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\hlr.docx"
  1198.  
  1199.  
  1200. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\huq.pdf"
  1201.  
  1202.  
  1203. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ium.pdf"
  1204.  
  1205.  
  1206. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\jfh.mp4"
  1207.  
  1208.  
  1209. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\jln.ppt"
  1210.  
  1211.  
  1212. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\kah.jpg"
  1213.  
  1214.  
  1215. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\kbw.pdf"
  1216.  
  1217.  
  1218. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\lgv=nvc"
  1219.  
  1220.  
  1221. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\lrm.dat"
  1222.  
  1223.  
  1224. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\mqa.ico"
  1225.  
  1226.  
  1227. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\nfj.pdf"
  1228.  
  1229.  
  1230. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\npf.mp3"
  1231.  
  1232.  
  1233. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ntv.pdf"
  1234.  
  1235.  
  1236. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\okf.txt"
  1237.  
  1238.  
  1239. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\otn.xl"
  1240.  
  1241.  
  1242. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pbf.xl"
  1243.  
  1244.  
  1245. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pkl.xl"
  1246.  
  1247.  
  1248. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pkq.txt"
  1249.  
  1250.  
  1251. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pmd.icm"
  1252.  
  1253.  
  1254. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\puo.bmp"
  1255.  
  1256.  
  1257. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\shq.ppt"
  1258.  
  1259.  
  1260. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\spv.dat"
  1261.  
  1262.  
  1263. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\tlu.dat"
  1264.  
  1265.  
  1266. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\tsa.txt"
  1267.  
  1268.  
  1269. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\uap.dat"
  1270.  
  1271.  
  1272. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ubf.bmp"
  1273.  
  1274.  
  1275. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ulx.bmp"
  1276.  
  1277.  
  1278. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\use.txt"
  1279.  
  1280.  
  1281. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vdx.dat"
  1282.  
  1283.  
  1284. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vev.pdf"
  1285.  
  1286.  
  1287. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vvd.xl"
  1288.  
  1289.  
  1290. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\wee.ico"
  1291.  
  1292.  
  1293. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\woh.ico"
  1294.  
  1295.  
  1296. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\wxr.icm"
  1297.  
  1298.  
  1299. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\xqp.icm"
  1300.  
  1301.  
  1302. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\xst.txt"
  1303.  
  1304.  
  1305. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324"
  1306.  
  1307.  
  1308. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe"
  1309.  
  1310.  
  1311. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat"
  1312.  
  1313.  
  1314. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ini"
  1315.  
  1316.  
  1317. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\run.vbs"
  1318.  
  1319.  
  1320.  
  1321.  
  1322. "Description": "File has been identified by 27 Antiviruses on VirusTotal as malicious",
  1323. "Details":
  1324.  
  1325. "MicroWorld-eScan": "Trojan.GenericKD.32161338"
  1326.  
  1327.  
  1328. "FireEye": "Generic.mg.fa9da31c57f745e2"
  1329.  
  1330.  
  1331. "McAfee": "Artemis!FA9DA31C57F7"
  1332.  
  1333.  
  1334. "Cylance": "Unsafe"
  1335.  
  1336.  
  1337. "Alibaba": "Trojan:Win32/Autoit.7aa88443"
  1338.  
  1339.  
  1340. "K7GW": "Riskware ( 0040eff71 )"
  1341.  
  1342.  
  1343. "K7AntiVirus": "Riskware ( 0040eff71 )"
  1344.  
  1345.  
  1346. "Invincea": "heuristic"
  1347.  
  1348.  
  1349. "APEX": "Malicious"
  1350.  
  1351.  
  1352. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  1353.  
  1354.  
  1355. "Kaspersky": "Trojan.Win32.Propagate.mbu"
  1356.  
  1357.  
  1358. "BitDefender": "Trojan.GenericKD.32161338"
  1359.  
  1360.  
  1361. "AegisLab": "Trojan.Multi.Generic.4!c"
  1362.  
  1363.  
  1364. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  1365.  
  1366.  
  1367. "Paloalto": "generic.ml"
  1368.  
  1369.  
  1370. "MAX": "malware (ai score=81)"
  1371.  
  1372.  
  1373. "Microsoft": "Trojan:AutoIt/Wiausf.AC!MTB"
  1374.  
  1375.  
  1376. "Endgame": "malicious (high confidence)"
  1377.  
  1378.  
  1379. "ZoneAlarm": "Trojan.Win32.Propagate.mbu"
  1380.  
  1381.  
  1382. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  1383.  
  1384.  
  1385. "Zoner": "Probably RARAutorun"
  1386.  
  1387.  
  1388. "ESET-NOD32": "Win32/Injector.Autoit.EDE"
  1389.  
  1390.  
  1391. "Ikarus": "Trojan.Inject"
  1392.  
  1393.  
  1394. "Fortinet": "AutoIt/Injector.EDE!tr"
  1395.  
  1396.  
  1397. "AVG": "FileRepMalware"
  1398.  
  1399.  
  1400. "Cybereason": "malicious.081e9e"
  1401.  
  1402.  
  1403. "CrowdStrike": "win/malicious_confidence_80% (W)"
  1404.  
  1405.  
  1406.  
  1407.  
  1408. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  1409. "Details":
  1410.  
  1411.  
  1412. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  1413. "Details":
  1414.  
  1415. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:c53c63c463365f8f617d9ca026eb91274ef26015d993b58e1de3b463640a5aa7, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  1416.  
  1417.  
  1418.  
  1419.  
  1420. "Description": "Created network traffic indicative of malicious activity",
  1421. "Details":
  1422.  
  1423. "signature": "ET DNS Query to a *.pw domain - Likely Hostile"
  1424.  
  1425.  
  1426.  
  1427.  
  1428.  
  1429. * Started Service:
  1430.  
  1431. * Mutexes:
  1432. "DefaultTabtip-MainUI",
  1433. "CicLoadWinStaWinSta0",
  1434. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  1435. "Local\\ZoneAttributeCacheCounterMutex",
  1436. "Local\\ZonesCacheCounterMutex",
  1437. "Local\\ZonesLockedCacheCounterMutex",
  1438. "7E8C820C05FE53DA70B24D931AD9346CC1C5B64F",
  1439. "Global\\ADAP_WMI_ENTRY",
  1440. "Global\\RefreshRA_Mutex",
  1441. "Global\\RefreshRA_Mutex_Lib",
  1442. "Global\\RefreshRA_Mutex_Flag",
  1443. "Global\\CLR_CASOFF_MUTEX"
  1444.  
  1445.  
  1446. * Modified Files:
  1447. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\__tmp_rar_sfx_access_check_14623453",
  1448. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\cge.jpg",
  1449. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\lgv=nvc",
  1450. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\gkg.vbs",
  1451. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ext.exe",
  1452. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\okf.txt",
  1453. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\npf.mp3",
  1454. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\shq.ppt",
  1455. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\jfh.mp4",
  1456. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vdx.dat",
  1457. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\woh.ico",
  1458. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bhl.pdf",
  1459. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\jln.ppt",
  1460. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vev.pdf",
  1461. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\kah.jpg",
  1462. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\tlu.dat",
  1463. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\otn.xl",
  1464. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pmd.icm",
  1465. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ntv.pdf",
  1466. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bql.xl",
  1467. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pkq.txt",
  1468. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bmr.xl",
  1469. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pbf.xl",
  1470. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ubf.bmp",
  1471. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\vvd.xl",
  1472. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\xst.txt",
  1473. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\hlr.docx",
  1474. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\wee.ico",
  1475. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\bgc.txt",
  1476. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\puo.bmp",
  1477. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\tsa.txt",
  1478. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\huq.pdf",
  1479. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\uap.dat",
  1480. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\eoc.bmp",
  1481. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\use.txt",
  1482. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\mqa.ico",
  1483. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ulx.bmp",
  1484. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\dus.mp3",
  1485. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\wxr.icm",
  1486. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\pkl.xl",
  1487. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\nfj.pdf",
  1488. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\aoh.pdf",
  1489. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\xqp.icm",
  1490. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ium.pdf",
  1491. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\hlq.dat",
  1492. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\lrm.dat",
  1493. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\auh.jpg",
  1494. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\spv.dat",
  1495. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\kbw.pdf",
  1496. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UZJHD",
  1497. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ini",
  1498. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\run.vbs",
  1499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  1500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat",
  1501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk",
  1502. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 2980966669",
  1503. "\\Device\\LanmanDatagramReceiver",
  1504. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  1505. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  1506. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  1507. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  1508. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JLQFJ",
  1509. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\RJBXI",
  1510. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\KMTOT",
  1511. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JDJEN",
  1512. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WBKUA",
  1513. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BDEIZ",
  1514. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WMSEC",
  1515. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UBPMS",
  1516. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\YXHCQ",
  1517. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\USYUJ",
  1518. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\LNNHV",
  1519. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\NWDVK",
  1520. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GQNYQ",
  1521. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\AUMRU",
  1522. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\CKHLS",
  1523. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1524. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1525. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  1526. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\EZFMH",
  1527. "\\??\\PIPE\\samr",
  1528. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  1529. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  1530. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  1531. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  1532. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  1533. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  1534. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  1535. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  1536. "\\??\\WMIDataDevice",
  1537. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ZAVVS",
  1538. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UKQFH",
  1539. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BCTBS",
  1540. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GMZRA",
  1541. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\XQSVR",
  1542. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\SYOQV",
  1543. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WEGPW",
  1544. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\TNIHC"
  1545.  
  1546.  
  1547. * Deleted Files:
  1548. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\__tmp_rar_sfx_access_check_14623453",
  1549. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UZJHD",
  1550. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  1551. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe",
  1552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier",
  1553. "C:\\Windows\\Tasks\\Opera scheduled Autoupdate 2980966669.job",
  1554. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 2980966669",
  1555. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  1556. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  1557. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  1558. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JLQFJ",
  1559. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\RJBXI",
  1560. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\KMTOT",
  1561. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\JDJEN",
  1562. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WBKUA",
  1563. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BDEIZ",
  1564. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WMSEC",
  1565. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UBPMS",
  1566. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\YXHCQ",
  1567. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\USYUJ",
  1568. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\LNNHV",
  1569. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\NWDVK",
  1570. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GQNYQ",
  1571. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\AUMRU",
  1572. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  1573. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  1574. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\CKHLS",
  1575. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\EZFMH",
  1576. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2964.14790000",
  1577. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2964.14790000",
  1578. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2964.14790000",
  1579. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\ZAVVS",
  1580. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\UKQFH",
  1581. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\BCTBS",
  1582. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\GMZRA",
  1583. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\XQSVR",
  1584. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\SYOQV",
  1585. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\WEGPW",
  1586. "C:\\Users\\user\\AppData\\Local\\Temp\\62187324\\TNIHC"
  1587.  
  1588.  
  1589. * Modified Registry Keys:
  1590. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1591. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1592. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1593. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  1594. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  1595. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  1596. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  1597. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
  1598. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\\Paint.Picture",
  1599. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\\CABFolder",
  1600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\\contact_wab_auto_file",
  1601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\\CSSfile",
  1602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.csv\\OpenWithProgids\\Excel.CSV",
  1603. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\\Paint.Picture",
  1604. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\\dllfile",
  1605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\OpenWithProgids\\Word.Document.8",
  1606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docm\\OpenWithProgids\\Word.DocumentMacroEnabled.12",
  1607. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\\Word.Document.12",
  1608. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dot\\OpenWithProgids\\Word.Template.8",
  1609. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotm\\OpenWithProgids\\Word.TemplateMacroEnabled.12",
  1610. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotx\\OpenWithProgids\\Word.Template.12",
  1611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\\Windows.XPSReachViewer",
  1612. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\\Windows.XPSReachViewer",
  1613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\\Windows.XPSReachViewer",
  1614. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\\emffile",
  1615. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1616. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\\exefile",
  1617. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\\fonfile",
  1618. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\\giffile",
  1619. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\\ChromeHTML",
  1620. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\\ChromeHTML",
  1621. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\\icofile",
  1622. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\\inifile",
  1623. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\\pjpegfile",
  1624. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\\jpegfile",
  1625. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\\jpegfile",
  1626. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\\jpegfile",
  1627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1628. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\\lnkfile",
  1629. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\\mhtmlfile",
  1630. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\\mhtmlfile",
  1631. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.msg\\OpenWithProgids\\Outlook.File.msg.15",
  1632. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\\ocxfile",
  1633. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\\Word.OpenDocumentText.12",
  1634. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\\otffile",
  1635. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\\pngfile",
  1636. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pot\\OpenWithProgids\\PowerPoint.Template.8",
  1637. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potm\\OpenWithProgids\\PowerPoint.TemplateMacroEnabled.12",
  1638. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potx\\OpenWithProgids\\PowerPoint.Template.12",
  1639. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppam\\OpenWithProgids\\PowerPoint.Addin.12",
  1640. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsm\\OpenWithProgids\\PowerPoint.SlideShowMacroEnabled.12",
  1641. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsx\\OpenWithProgids\\PowerPoint.SlideShow.12",
  1642. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppt\\OpenWithProgids\\PowerPoint.Show.8",
  1643. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptm\\OpenWithProgids\\PowerPoint.ShowMacroEnabled.12",
  1644. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptx\\OpenWithProgids\\PowerPoint.Show.12",
  1645. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\\Microsoft.PowerShellXMLData.1",
  1646. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\\rlefile",
  1647. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\\Word.RTF.8",
  1648. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\\SHCmdFile",
  1649. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\\SearchFolder",
  1650. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\\ChromeHTML",
  1651. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldm\\OpenWithProgids\\PowerPoint.SlideMacroEnabled.12",
  1652. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldx\\OpenWithProgids\\PowerPoint.Slide.12",
  1653. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\\sysfile",
  1654. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\\TIFImage.Document",
  1655. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\\TIFImage.Document",
  1656. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\\ttcfile",
  1657. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\\ttffile",
  1658. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\\txtfile",
  1659. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vsto\\OpenWithProgids\\bootstrap.vsto.1",
  1660. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\\wdpfile",
  1661. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\\wmffile",
  1662. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlam\\OpenWithProgids\\Excel.AddInMacroEnabled",
  1663. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xls\\OpenWithProgids\\Excel.Sheet.8",
  1664. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsb\\OpenWithProgids\\Excel.SheetBinaryMacroEnabled.12",
  1665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsm\\OpenWithProgids\\Excel.SheetMacroEnabled.12",
  1666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsx\\OpenWithProgids\\Excel.Sheet.12",
  1667. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlt\\OpenWithProgids\\Excel.Template.8",
  1668. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltm\\OpenWithProgids\\Excel.TemplateMacroEnabled",
  1669. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltx\\OpenWithProgids\\Excel.Template",
  1670. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\\xmlfile",
  1671. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\\Windows.XPSReachViewer",
  1672. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\\xslfile",
  1673. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\\CompressedFolder",
  1674. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.106\\CheckSetting",
  1675. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.103\\CheckSetting",
  1676. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.101\\CheckSetting",
  1677. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.100\\CheckSetting",
  1678. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.102\\CheckSetting",
  1679. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Action Center\\Checks\\E8433B72-5842-4d43-8645-BC2C35960837.check.104\\CheckSetting",
  1680. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\957F6605-234F-4D35-A57B-7E4E7059548F\\Path",
  1681. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\957F6605-234F-4D35-A57B-7E4E7059548F\\Hash",
  1682. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 2980966669\\Id",
  1683. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 2980966669\\Index",
  1684. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\957F6605-234F-4D35-A57B-7E4E7059548F\\Triggers",
  1685. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\957F6605-234F-4D35-A57B-7E4E7059548F\\DynamicInfo",
  1686. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1687. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  1688. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  1689. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\43744FB9-005F-4BA6-9834-C993C65A4E13",
  1690. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B799FC75-138F-4BB9-B464-9B8EF1C1251D\\Path",
  1691. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B799FC75-138F-4BB9-B464-9B8EF1C1251D\\Hash",
  1692. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  1693. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  1694. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B799FC75-138F-4BB9-B464-9B8EF1C1251D\\Triggers",
  1695. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B799FC75-138F-4BB9-B464-9B8EF1C1251D\\DynamicInfo",
  1696. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vbs\\OpenWithProgids\\VBSFile",
  1697. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  1698. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  1699. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  1700. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  1701. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  1702. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  1703. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  1704. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\43744FB9-005F-4BA6-9834-C993C65A4E13\\data",
  1705. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  1706. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  1707. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  1708. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  1709. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  1710. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  1711. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  1712. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  1713. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  1714. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  1715. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  1716. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  1717. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  1718. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  1719. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  1720. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1721.  
  1722.  
  1723. * Deleted Registry Keys:
  1724. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1725. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1726. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1727. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1728. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 2980966669.job",
  1729. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 2980966669.job.fp",
  1730. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1731. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1732.  
  1733.  
  1734. * DNS Communications:
  1735.  
  1736. "type": "A",
  1737. "request": "j0011y.pw",
  1738. "answers":
  1739.  
  1740.  
  1741.  
  1742. * Domains:
  1743.  
  1744. "ip": "",
  1745. "domain": "j0011y.pw"
  1746.  
  1747.  
  1748.  
  1749. * Network Communication - ICMP:
  1750.  
  1751. * Network Communication - HTTP:
  1752.  
  1753. "count": 5,
  1754. "body": "",
  1755. "uri": "http://www.msftncsi.com/ncsi.txt",
  1756. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1757. "method": "GET",
  1758. "host": "www.msftncsi.com",
  1759. "version": "1.1",
  1760. "path": "/ncsi.txt",
  1761. "data": "GET /ncsi.txt HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.msftncsi.com\r\n\r\n",
  1762. "port": 80
  1763.  
  1764.  
  1765.  
  1766. * Network Communication - SMTP:
  1767.  
  1768. * Network Communication - Hosts:
  1769.  
  1770. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!