API tools faq
paste
paladin316

Exes_9cb69a500761d083f82fd31f856b22d1_exe_2019-07-18_06_30.txt

paladin316
Jul 18th, 2019
2,136
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 58.97 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Alien"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_9cb69a500761d083f82fd31f856b22d1.exe"
  7. * File Size: 1596416
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "470b7b14d069820ea6a1e191456e4a2513ef4e394d44f52cf24bb55df8f44882"
  10. * MD5: "9cb69a500761d083f82fd31f856b22d1"
  11. * SHA1: "f66538a1a0ff8978e38c11ca5ea7b04786540de7"
  12. * SHA512: "b5cc01cc3502e30bbb709f98a4accb434c451bc8b19e4ada98d63ee98f81cdd3ff1c0dc986aac84a6f6fe8a61d25251ea359270ab58a149945dd79b5cc89af11"
  13. * CRC32: "1E0CEA97"
  14. * SSDEEP: "49152:FqwWzFEsLXXXXXXXXXXXYFbL0P4MI4IN1:FIlLXXXXXXXXXXXaAa"
  15.  
  16. * Process Execution:
  17. "Exes_9cb69a500761d083f82fd31f856b22d1.exe",
  18. "wscript.exe",
  19. "wscript.exe",
  20. "wscript.exe",
  21. "wscript.exe",
  22. "wscript.exe",
  23. "wscript.exe",
  24. "wscript.exe",
  25. "wscript.exe",
  26. "wscript.exe",
  27. "wscript.exe",
  28. "wscript.exe",
  29. "wscript.exe",
  30. "wscript.exe",
  31. "wscript.exe",
  32. "wscript.exe",
  33. "wscript.exe",
  34. "wscript.exe",
  35. "wscript.exe",
  36. "wscript.exe",
  37. "wscript.exe",
  38. "wscript.exe",
  39. "wscript.exe",
  40. "wscript.exe",
  41. "svchost.exe",
  42. "taskeng.exe",
  43. "taskeng.exe",
  44. "taskeng.exe",
  45. "taskeng.exe",
  46. "taskeng.exe",
  47. "taskeng.exe",
  48. "taskeng.exe",
  49. "taskeng.exe",
  50. "taskeng.exe",
  51. "taskeng.exe",
  52. "taskeng.exe",
  53. "taskeng.exe",
  54. "taskeng.exe",
  55. "taskeng.exe",
  56. "taskeng.exe",
  57. "taskeng.exe",
  58. "taskeng.exe",
  59. "taskeng.exe",
  60. "taskeng.exe",
  61. "taskeng.exe",
  62. "taskeng.exe",
  63. "taskeng.exe",
  64. "taskeng.exe",
  65. "taskeng.exe",
  66. "svchost.exe",
  67. "WmiPrvSE.exe",
  68. "WmiPrvSE.exe",
  69. "WMIADAP.exe"
  70.  
  71.  
  72. * Executed Commands:
  73. "wscript.exe C:\\Windows\\TEMP\\hostaa.vbs",
  74. "taskeng.exe DCC4EE1B-A390-410C-A831-FF4F173F76F1 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  75. "taskeng.exe 57864E07-3540-4B1C-A2DB-31C143C88ABB S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  76. "taskeng.exe 4432FC7B-C584-490F-992A-84550BB0EBFE S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  77. "taskeng.exe B2EA283F-D111-42BE-A3F4-FF513D99E1B1 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  78. "taskeng.exe 1328F1B0-B163-4365-81FA-B750D7DC7C68 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  79. "taskeng.exe 2B4A442F-1FE3-4684-83D6-BD4A27868C6B S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  80. "taskeng.exe ABF28FFB-C7A9-464F-9A29-353099F1383E S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  81. "taskeng.exe 9C6E2AA2-A117-41B4-A54A-389A43E96C80 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  82. "taskeng.exe EA3E81F7-6ADF-4975-9391-8A63B0ECA432 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  83. "taskeng.exe 8F836E47-A8AE-455C-86FF-9ECB391A5CDC S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  84. "taskeng.exe C6B35D1F-9363-4931-9AC9-A2FBF78437C6 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  85. "taskeng.exe 45D78EE1-A31E-4199-8B5C-25660DE7C179 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  86. "taskeng.exe 7CF54CDA-6166-45AF-8528-BC21E5E7D5C3 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  87. "taskeng.exe 457785E3-A695-4AD6-B933-D06FC3221AE9 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  88. "taskeng.exe B3B74843-2606-42B3-BDB8-D152C7076625 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  89. "taskeng.exe 15049BA8-0D8B-408B-BD2E-371C75C95387 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  90. "taskeng.exe ED6DA48A-BFD8-4C88-AB74-F1E806D6F0E7 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  91. "taskeng.exe 79858065-89B3-4081-80A1-EE5959547FB1 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  92. "taskeng.exe 35D1686D-2445-4A65-8C2A-650478D079D9 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  93. "taskeng.exe D1ADDF31-C122-4A9E-863A-E42B70346159 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  94. "taskeng.exe 58C5A766-616C-4DF2-B4AA-299ECD8D4664 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  95. "taskeng.exe B2397871-2DB2-41DC-B831-8BA61DEC3FCF S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  96. "taskeng.exe B8ED7782-D6D3-480A-91F2-FAC59B4FB8B9 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  97. "taskeng.exe 33860C29-A257-4206-94EB-D67FA828CC03 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  98. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  99. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
  100.  
  101.  
  102. * Signatures Detected:
  103.  
  104. "Description": "Detected script timer window indicative of sleep style evasion",
  105. "Details":
  106.  
  107. "Window": "WSH-Timer"
  108.  
  109.  
  110.  
  111.  
  112. "Description": "Reads data out of its own binary image",
  113. "Details":
  114.  
  115. "self_read": "process: wscript.exe, pid: 2716, offset: 0x00000000, length: 0x00000040"
  116.  
  117.  
  118. "self_read": "process: wscript.exe, pid: 2716, offset: 0x000000f0, length: 0x00000018"
  119.  
  120.  
  121. "self_read": "process: wscript.exe, pid: 2716, offset: 0x000001e8, length: 0x00000078"
  122.  
  123.  
  124. "self_read": "process: wscript.exe, pid: 2716, offset: 0x00018000, length: 0x00000020"
  125.  
  126.  
  127. "self_read": "process: wscript.exe, pid: 2716, offset: 0x00018058, length: 0x00000018"
  128.  
  129.  
  130. "self_read": "process: wscript.exe, pid: 2716, offset: 0x000181a8, length: 0x00000018"
  131.  
  132.  
  133. "self_read": "process: wscript.exe, pid: 2716, offset: 0x00018470, length: 0x00000010"
  134.  
  135.  
  136. "self_read": "process: wscript.exe, pid: 2716, offset: 0x00018640, length: 0x00000012"
  137.  
  138.  
  139. "self_read": "process: wscript.exe, pid: 2684, offset: 0x00000000, length: 0x00000040"
  140.  
  141.  
  142. "self_read": "process: wscript.exe, pid: 2684, offset: 0x000000f0, length: 0x00000018"
  143.  
  144.  
  145. "self_read": "process: wscript.exe, pid: 2684, offset: 0x000001e8, length: 0x00000078"
  146.  
  147.  
  148. "self_read": "process: wscript.exe, pid: 2684, offset: 0x00018000, length: 0x00000020"
  149.  
  150.  
  151. "self_read": "process: wscript.exe, pid: 2684, offset: 0x00018058, length: 0x00000018"
  152.  
  153.  
  154. "self_read": "process: wscript.exe, pid: 2684, offset: 0x000181a8, length: 0x00000018"
  155.  
  156.  
  157. "self_read": "process: wscript.exe, pid: 2684, offset: 0x00018470, length: 0x00000010"
  158.  
  159.  
  160. "self_read": "process: wscript.exe, pid: 2684, offset: 0x00018640, length: 0x00000012"
  161.  
  162.  
  163. "self_read": "process: wscript.exe, pid: 1824, offset: 0x00000000, length: 0x00000040"
  164.  
  165.  
  166. "self_read": "process: wscript.exe, pid: 1824, offset: 0x000000f0, length: 0x00000018"
  167.  
  168.  
  169. "self_read": "process: wscript.exe, pid: 1824, offset: 0x000001e8, length: 0x00000078"
  170.  
  171.  
  172. "self_read": "process: wscript.exe, pid: 1824, offset: 0x00018000, length: 0x00000020"
  173.  
  174.  
  175. "self_read": "process: wscript.exe, pid: 1824, offset: 0x00018058, length: 0x00000018"
  176.  
  177.  
  178. "self_read": "process: wscript.exe, pid: 1824, offset: 0x000181a8, length: 0x00000018"
  179.  
  180.  
  181. "self_read": "process: wscript.exe, pid: 1824, offset: 0x00018470, length: 0x00000010"
  182.  
  183.  
  184. "self_read": "process: wscript.exe, pid: 1824, offset: 0x00018640, length: 0x00000012"
  185.  
  186.  
  187. "self_read": "process: wscript.exe, pid: 1548, offset: 0x00000000, length: 0x00000040"
  188.  
  189.  
  190. "self_read": "process: wscript.exe, pid: 1548, offset: 0x000000f0, length: 0x00000018"
  191.  
  192.  
  193. "self_read": "process: wscript.exe, pid: 1548, offset: 0x000001e8, length: 0x00000078"
  194.  
  195.  
  196. "self_read": "process: wscript.exe, pid: 1548, offset: 0x00018000, length: 0x00000020"
  197.  
  198.  
  199. "self_read": "process: wscript.exe, pid: 1548, offset: 0x00018058, length: 0x00000018"
  200.  
  201.  
  202. "self_read": "process: wscript.exe, pid: 1548, offset: 0x000181a8, length: 0x00000018"
  203.  
  204.  
  205. "self_read": "process: wscript.exe, pid: 1548, offset: 0x00018470, length: 0x00000010"
  206.  
  207.  
  208. "self_read": "process: wscript.exe, pid: 1548, offset: 0x00018640, length: 0x00000012"
  209.  
  210.  
  211. "self_read": "process: wscript.exe, pid: 1636, offset: 0x00000000, length: 0x00000040"
  212.  
  213.  
  214. "self_read": "process: wscript.exe, pid: 1636, offset: 0x000000f0, length: 0x00000018"
  215.  
  216.  
  217. "self_read": "process: wscript.exe, pid: 1636, offset: 0x000001e8, length: 0x00000078"
  218.  
  219.  
  220. "self_read": "process: wscript.exe, pid: 1636, offset: 0x00018000, length: 0x00000020"
  221.  
  222.  
  223. "self_read": "process: wscript.exe, pid: 1636, offset: 0x00018058, length: 0x00000018"
  224.  
  225.  
  226. "self_read": "process: wscript.exe, pid: 1636, offset: 0x000181a8, length: 0x00000018"
  227.  
  228.  
  229. "self_read": "process: wscript.exe, pid: 1636, offset: 0x00018470, length: 0x00000010"
  230.  
  231.  
  232. "self_read": "process: wscript.exe, pid: 1636, offset: 0x00018640, length: 0x00000012"
  233.  
  234.  
  235. "self_read": "process: wscript.exe, pid: 2536, offset: 0x00000000, length: 0x00000040"
  236.  
  237.  
  238. "self_read": "process: wscript.exe, pid: 2536, offset: 0x000000f0, length: 0x00000018"
  239.  
  240.  
  241. "self_read": "process: wscript.exe, pid: 2536, offset: 0x000001e8, length: 0x00000078"
  242.  
  243.  
  244. "self_read": "process: wscript.exe, pid: 2536, offset: 0x00018000, length: 0x00000020"
  245.  
  246.  
  247. "self_read": "process: wscript.exe, pid: 2536, offset: 0x00018058, length: 0x00000018"
  248.  
  249.  
  250. "self_read": "process: wscript.exe, pid: 2536, offset: 0x000181a8, length: 0x00000018"
  251.  
  252.  
  253. "self_read": "process: wscript.exe, pid: 2536, offset: 0x00018470, length: 0x00000010"
  254.  
  255.  
  256. "self_read": "process: wscript.exe, pid: 2536, offset: 0x00018640, length: 0x00000012"
  257.  
  258.  
  259. "self_read": "process: wscript.exe, pid: 1060, offset: 0x00000000, length: 0x00000040"
  260.  
  261.  
  262. "self_read": "process: wscript.exe, pid: 1060, offset: 0x000000f0, length: 0x00000018"
  263.  
  264.  
  265. "self_read": "process: wscript.exe, pid: 1060, offset: 0x000001e8, length: 0x00000078"
  266.  
  267.  
  268. "self_read": "process: wscript.exe, pid: 1060, offset: 0x00018000, length: 0x00000020"
  269.  
  270.  
  271. "self_read": "process: wscript.exe, pid: 1060, offset: 0x00018058, length: 0x00000018"
  272.  
  273.  
  274. "self_read": "process: wscript.exe, pid: 1060, offset: 0x000181a8, length: 0x00000018"
  275.  
  276.  
  277. "self_read": "process: wscript.exe, pid: 1060, offset: 0x00018470, length: 0x00000010"
  278.  
  279.  
  280. "self_read": "process: wscript.exe, pid: 1060, offset: 0x00018640, length: 0x00000012"
  281.  
  282.  
  283. "self_read": "process: wscript.exe, pid: 2156, offset: 0x00000000, length: 0x00000040"
  284.  
  285.  
  286. "self_read": "process: wscript.exe, pid: 2156, offset: 0x000000f0, length: 0x00000018"
  287.  
  288.  
  289. "self_read": "process: wscript.exe, pid: 2156, offset: 0x000001e8, length: 0x00000078"
  290.  
  291.  
  292. "self_read": "process: wscript.exe, pid: 2156, offset: 0x00018000, length: 0x00000020"
  293.  
  294.  
  295. "self_read": "process: wscript.exe, pid: 2156, offset: 0x00018058, length: 0x00000018"
  296.  
  297.  
  298. "self_read": "process: wscript.exe, pid: 2156, offset: 0x000181a8, length: 0x00000018"
  299.  
  300.  
  301. "self_read": "process: wscript.exe, pid: 2156, offset: 0x00018470, length: 0x00000010"
  302.  
  303.  
  304. "self_read": "process: wscript.exe, pid: 2156, offset: 0x00018640, length: 0x00000012"
  305.  
  306.  
  307. "self_read": "process: wscript.exe, pid: 2340, offset: 0x00000000, length: 0x00000040"
  308.  
  309.  
  310. "self_read": "process: wscript.exe, pid: 2340, offset: 0x000000f0, length: 0x00000018"
  311.  
  312.  
  313. "self_read": "process: wscript.exe, pid: 2340, offset: 0x000001e8, length: 0x00000078"
  314.  
  315.  
  316. "self_read": "process: wscript.exe, pid: 2340, offset: 0x00018000, length: 0x00000020"
  317.  
  318.  
  319. "self_read": "process: wscript.exe, pid: 2340, offset: 0x00018058, length: 0x00000018"
  320.  
  321.  
  322. "self_read": "process: wscript.exe, pid: 2340, offset: 0x000181a8, length: 0x00000018"
  323.  
  324.  
  325. "self_read": "process: wscript.exe, pid: 2340, offset: 0x00018470, length: 0x00000010"
  326.  
  327.  
  328. "self_read": "process: wscript.exe, pid: 2340, offset: 0x00018640, length: 0x00000012"
  329.  
  330.  
  331. "self_read": "process: wscript.exe, pid: 2820, offset: 0x00000000, length: 0x00000040"
  332.  
  333.  
  334. "self_read": "process: wscript.exe, pid: 2820, offset: 0x000000f0, length: 0x00000018"
  335.  
  336.  
  337. "self_read": "process: wscript.exe, pid: 2820, offset: 0x000001e8, length: 0x00000078"
  338.  
  339.  
  340. "self_read": "process: wscript.exe, pid: 2820, offset: 0x00018000, length: 0x00000020"
  341.  
  342.  
  343. "self_read": "process: wscript.exe, pid: 2820, offset: 0x00018058, length: 0x00000018"
  344.  
  345.  
  346. "self_read": "process: wscript.exe, pid: 2820, offset: 0x000181a8, length: 0x00000018"
  347.  
  348.  
  349. "self_read": "process: wscript.exe, pid: 2820, offset: 0x00018470, length: 0x00000010"
  350.  
  351.  
  352. "self_read": "process: wscript.exe, pid: 2820, offset: 0x00018640, length: 0x00000012"
  353.  
  354.  
  355. "self_read": "process: wscript.exe, pid: 2124, offset: 0x00000000, length: 0x00000040"
  356.  
  357.  
  358. "self_read": "process: wscript.exe, pid: 2124, offset: 0x000000f0, length: 0x00000018"
  359.  
  360.  
  361. "self_read": "process: wscript.exe, pid: 2124, offset: 0x000001e8, length: 0x00000078"
  362.  
  363.  
  364. "self_read": "process: wscript.exe, pid: 2124, offset: 0x00018000, length: 0x00000020"
  365.  
  366.  
  367. "self_read": "process: wscript.exe, pid: 2124, offset: 0x00018058, length: 0x00000018"
  368.  
  369.  
  370. "self_read": "process: wscript.exe, pid: 2124, offset: 0x000181a8, length: 0x00000018"
  371.  
  372.  
  373. "self_read": "process: wscript.exe, pid: 2124, offset: 0x00018470, length: 0x00000010"
  374.  
  375.  
  376. "self_read": "process: wscript.exe, pid: 2124, offset: 0x00018640, length: 0x00000012"
  377.  
  378.  
  379. "self_read": "process: wscript.exe, pid: 2924, offset: 0x00000000, length: 0x00000040"
  380.  
  381.  
  382. "self_read": "process: wscript.exe, pid: 2924, offset: 0x000000f0, length: 0x00000018"
  383.  
  384.  
  385. "self_read": "process: wscript.exe, pid: 2924, offset: 0x000001e8, length: 0x00000078"
  386.  
  387.  
  388. "self_read": "process: wscript.exe, pid: 2924, offset: 0x00018000, length: 0x00000020"
  389.  
  390.  
  391. "self_read": "process: wscript.exe, pid: 2924, offset: 0x00018058, length: 0x00000018"
  392.  
  393.  
  394. "self_read": "process: wscript.exe, pid: 2924, offset: 0x000181a8, length: 0x00000018"
  395.  
  396.  
  397. "self_read": "process: wscript.exe, pid: 2924, offset: 0x00018470, length: 0x00000010"
  398.  
  399.  
  400. "self_read": "process: wscript.exe, pid: 2924, offset: 0x00018640, length: 0x00000012"
  401.  
  402.  
  403. "self_read": "process: wscript.exe, pid: 2292, offset: 0x00000000, length: 0x00000040"
  404.  
  405.  
  406. "self_read": "process: wscript.exe, pid: 2292, offset: 0x000000f0, length: 0x00000018"
  407.  
  408.  
  409. "self_read": "process: wscript.exe, pid: 2292, offset: 0x000001e8, length: 0x00000078"
  410.  
  411.  
  412. "self_read": "process: wscript.exe, pid: 2292, offset: 0x00018000, length: 0x00000020"
  413.  
  414.  
  415. "self_read": "process: wscript.exe, pid: 2292, offset: 0x00018058, length: 0x00000018"
  416.  
  417.  
  418. "self_read": "process: wscript.exe, pid: 2292, offset: 0x000181a8, length: 0x00000018"
  419.  
  420.  
  421. "self_read": "process: wscript.exe, pid: 2292, offset: 0x00018470, length: 0x00000010"
  422.  
  423.  
  424. "self_read": "process: wscript.exe, pid: 2292, offset: 0x00018640, length: 0x00000012"
  425.  
  426.  
  427. "self_read": "process: wscript.exe, pid: 1844, offset: 0x00000000, length: 0x00000040"
  428.  
  429.  
  430. "self_read": "process: wscript.exe, pid: 1844, offset: 0x000000f0, length: 0x00000018"
  431.  
  432.  
  433. "self_read": "process: wscript.exe, pid: 1844, offset: 0x000001e8, length: 0x00000078"
  434.  
  435.  
  436. "self_read": "process: wscript.exe, pid: 1844, offset: 0x00018000, length: 0x00000020"
  437.  
  438.  
  439. "self_read": "process: wscript.exe, pid: 1844, offset: 0x00018058, length: 0x00000018"
  440.  
  441.  
  442. "self_read": "process: wscript.exe, pid: 1844, offset: 0x000181a8, length: 0x00000018"
  443.  
  444.  
  445. "self_read": "process: wscript.exe, pid: 1844, offset: 0x00018470, length: 0x00000010"
  446.  
  447.  
  448. "self_read": "process: wscript.exe, pid: 1844, offset: 0x00018640, length: 0x00000012"
  449.  
  450.  
  451. "self_read": "process: wscript.exe, pid: 2548, offset: 0x00000000, length: 0x00000040"
  452.  
  453.  
  454. "self_read": "process: wscript.exe, pid: 2548, offset: 0x000000f0, length: 0x00000018"
  455.  
  456.  
  457. "self_read": "process: wscript.exe, pid: 2548, offset: 0x000001e8, length: 0x00000078"
  458.  
  459.  
  460. "self_read": "process: wscript.exe, pid: 2548, offset: 0x00018000, length: 0x00000020"
  461.  
  462.  
  463. "self_read": "process: wscript.exe, pid: 2548, offset: 0x00018058, length: 0x00000018"
  464.  
  465.  
  466. "self_read": "process: wscript.exe, pid: 2548, offset: 0x000181a8, length: 0x00000018"
  467.  
  468.  
  469. "self_read": "process: wscript.exe, pid: 2548, offset: 0x00018470, length: 0x00000010"
  470.  
  471.  
  472. "self_read": "process: wscript.exe, pid: 2548, offset: 0x00018640, length: 0x00000012"
  473.  
  474.  
  475. "self_read": "process: wscript.exe, pid: 2132, offset: 0x00000000, length: 0x00000040"
  476.  
  477.  
  478. "self_read": "process: wscript.exe, pid: 2132, offset: 0x000000f0, length: 0x00000018"
  479.  
  480.  
  481. "self_read": "process: wscript.exe, pid: 2132, offset: 0x000001e8, length: 0x00000078"
  482.  
  483.  
  484. "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018000, length: 0x00000020"
  485.  
  486.  
  487. "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018058, length: 0x00000018"
  488.  
  489.  
  490. "self_read": "process: wscript.exe, pid: 2132, offset: 0x000181a8, length: 0x00000018"
  491.  
  492.  
  493. "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018470, length: 0x00000010"
  494.  
  495.  
  496. "self_read": "process: wscript.exe, pid: 2132, offset: 0x00018640, length: 0x00000012"
  497.  
  498.  
  499. "self_read": "process: wscript.exe, pid: 1488, offset: 0x00000000, length: 0x00000040"
  500.  
  501.  
  502. "self_read": "process: wscript.exe, pid: 1488, offset: 0x000000f0, length: 0x00000018"
  503.  
  504.  
  505. "self_read": "process: wscript.exe, pid: 1488, offset: 0x000001e8, length: 0x00000078"
  506.  
  507.  
  508. "self_read": "process: wscript.exe, pid: 1488, offset: 0x00018000, length: 0x00000020"
  509.  
  510.  
  511. "self_read": "process: wscript.exe, pid: 1488, offset: 0x00018058, length: 0x00000018"
  512.  
  513.  
  514. "self_read": "process: wscript.exe, pid: 1488, offset: 0x000181a8, length: 0x00000018"
  515.  
  516.  
  517. "self_read": "process: wscript.exe, pid: 1488, offset: 0x00018470, length: 0x00000010"
  518.  
  519.  
  520. "self_read": "process: wscript.exe, pid: 1488, offset: 0x00018640, length: 0x00000012"
  521.  
  522.  
  523. "self_read": "process: wscript.exe, pid: 3028, offset: 0x00000000, length: 0x00000040"
  524.  
  525.  
  526. "self_read": "process: wscript.exe, pid: 3028, offset: 0x000000f0, length: 0x00000018"
  527.  
  528.  
  529. "self_read": "process: wscript.exe, pid: 3028, offset: 0x000001e8, length: 0x00000078"
  530.  
  531.  
  532. "self_read": "process: wscript.exe, pid: 3028, offset: 0x00018000, length: 0x00000020"
  533.  
  534.  
  535. "self_read": "process: wscript.exe, pid: 3028, offset: 0x00018058, length: 0x00000018"
  536.  
  537.  
  538. "self_read": "process: wscript.exe, pid: 3028, offset: 0x000181a8, length: 0x00000018"
  539.  
  540.  
  541. "self_read": "process: wscript.exe, pid: 3028, offset: 0x00018470, length: 0x00000010"
  542.  
  543.  
  544. "self_read": "process: wscript.exe, pid: 3028, offset: 0x00018640, length: 0x00000012"
  545.  
  546.  
  547. "self_read": "process: wscript.exe, pid: 1812, offset: 0x00000000, length: 0x00000040"
  548.  
  549.  
  550. "self_read": "process: wscript.exe, pid: 1812, offset: 0x000000f0, length: 0x00000018"
  551.  
  552.  
  553. "self_read": "process: wscript.exe, pid: 1812, offset: 0x000001e8, length: 0x00000078"
  554.  
  555.  
  556. "self_read": "process: wscript.exe, pid: 1812, offset: 0x00018000, length: 0x00000020"
  557.  
  558.  
  559. "self_read": "process: wscript.exe, pid: 1812, offset: 0x00018058, length: 0x00000018"
  560.  
  561.  
  562. "self_read": "process: wscript.exe, pid: 1812, offset: 0x000181a8, length: 0x00000018"
  563.  
  564.  
  565. "self_read": "process: wscript.exe, pid: 1812, offset: 0x00018470, length: 0x00000010"
  566.  
  567.  
  568. "self_read": "process: wscript.exe, pid: 1812, offset: 0x00018640, length: 0x00000012"
  569.  
  570.  
  571. "self_read": "process: wscript.exe, pid: 1164, offset: 0x00000000, length: 0x00000040"
  572.  
  573.  
  574. "self_read": "process: wscript.exe, pid: 1164, offset: 0x000000f0, length: 0x00000018"
  575.  
  576.  
  577. "self_read": "process: wscript.exe, pid: 1164, offset: 0x000001e8, length: 0x00000078"
  578.  
  579.  
  580. "self_read": "process: wscript.exe, pid: 1164, offset: 0x00018000, length: 0x00000020"
  581.  
  582.  
  583. "self_read": "process: wscript.exe, pid: 1164, offset: 0x00018058, length: 0x00000018"
  584.  
  585.  
  586. "self_read": "process: wscript.exe, pid: 1164, offset: 0x000181a8, length: 0x00000018"
  587.  
  588.  
  589. "self_read": "process: wscript.exe, pid: 1164, offset: 0x00018470, length: 0x00000010"
  590.  
  591.  
  592. "self_read": "process: wscript.exe, pid: 1164, offset: 0x00018640, length: 0x00000012"
  593.  
  594.  
  595. "self_read": "process: wscript.exe, pid: 1476, offset: 0x00000000, length: 0x00000040"
  596.  
  597.  
  598. "self_read": "process: wscript.exe, pid: 1476, offset: 0x000000f0, length: 0x00000018"
  599.  
  600.  
  601. "self_read": "process: wscript.exe, pid: 1476, offset: 0x000001e8, length: 0x00000078"
  602.  
  603.  
  604. "self_read": "process: wscript.exe, pid: 1476, offset: 0x00018000, length: 0x00000020"
  605.  
  606.  
  607. "self_read": "process: wscript.exe, pid: 1476, offset: 0x00018058, length: 0x00000018"
  608.  
  609.  
  610. "self_read": "process: wscript.exe, pid: 1476, offset: 0x000181a8, length: 0x00000018"
  611.  
  612.  
  613. "self_read": "process: wscript.exe, pid: 1476, offset: 0x00018470, length: 0x00000010"
  614.  
  615.  
  616. "self_read": "process: wscript.exe, pid: 1476, offset: 0x00018640, length: 0x00000012"
  617.  
  618.  
  619. "self_read": "process: wscript.exe, pid: 2092, offset: 0x00000000, length: 0x00000040"
  620.  
  621.  
  622. "self_read": "process: wscript.exe, pid: 2092, offset: 0x000000f0, length: 0x00000018"
  623.  
  624.  
  625. "self_read": "process: wscript.exe, pid: 2092, offset: 0x000001e8, length: 0x00000078"
  626.  
  627.  
  628. "self_read": "process: wscript.exe, pid: 2092, offset: 0x00018000, length: 0x00000020"
  629.  
  630.  
  631. "self_read": "process: wscript.exe, pid: 2092, offset: 0x00018058, length: 0x00000018"
  632.  
  633.  
  634. "self_read": "process: wscript.exe, pid: 2092, offset: 0x000181a8, length: 0x00000018"
  635.  
  636.  
  637. "self_read": "process: wscript.exe, pid: 2092, offset: 0x00018470, length: 0x00000010"
  638.  
  639.  
  640. "self_read": "process: wscript.exe, pid: 2092, offset: 0x00018640, length: 0x00000012"
  641.  
  642.  
  643. "self_read": "process: wscript.exe, pid: 3016, offset: 0x00000000, length: 0x00000040"
  644.  
  645.  
  646. "self_read": "process: wscript.exe, pid: 3016, offset: 0x000000f0, length: 0x00000018"
  647.  
  648.  
  649. "self_read": "process: wscript.exe, pid: 3016, offset: 0x000001e8, length: 0x00000078"
  650.  
  651.  
  652. "self_read": "process: wscript.exe, pid: 3016, offset: 0x00018000, length: 0x00000020"
  653.  
  654.  
  655. "self_read": "process: wscript.exe, pid: 3016, offset: 0x00018058, length: 0x00000018"
  656.  
  657.  
  658. "self_read": "process: wscript.exe, pid: 3016, offset: 0x000181a8, length: 0x00000018"
  659.  
  660.  
  661. "self_read": "process: wscript.exe, pid: 3016, offset: 0x00018470, length: 0x00000010"
  662.  
  663.  
  664. "self_read": "process: wscript.exe, pid: 3016, offset: 0x00018640, length: 0x00000012"
  665.  
  666.  
  667.  
  668.  
  669. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  670. "Details":
  671.  
  672. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  673.  
  674.  
  675. "suspicious_request": "http://119.29.29.29/d?dn=fbz.zhujb.cn"
  676.  
  677.  
  678. "suspicious_request": "http://119.29.29.29/d?dn=pac.zhujb.cn"
  679.  
  680.  
  681.  
  682.  
  683. "Description": "Performs some HTTP requests",
  684. "Details":
  685.  
  686. "url": "http://119.29.29.29/d?dn=fbz.zhujb.cn"
  687.  
  688.  
  689. "url": "http://119.29.29.29/d?dn=pac.zhujb.cn"
  690.  
  691.  
  692.  
  693.  
  694. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  695. "Details":
  696.  
  697. "Process": "wscript.exe tried to sleep 1680 seconds, actually delayed analysis time by 0 seconds"
  698.  
  699.  
  700. "Process": "Exes_9cb69a500761d083f82fd31f856b22d1.exe tried to sleep 2928 seconds, actually delayed analysis time by 0 seconds"
  701.  
  702.  
  703. "Process": "WmiPrvSE.exe tried to sleep 960 seconds, actually delayed analysis time by 0 seconds"
  704.  
  705.  
  706. "Process": "taskeng.exe tried to sleep 2763 seconds, actually delayed analysis time by 0 seconds"
  707.  
  708.  
  709. "Process": "svchost.exe tried to sleep 306 seconds, actually delayed analysis time by 0 seconds"
  710.  
  711.  
  712.  
  713.  
  714. "Description": "Sets an Autoconfig URL, likely to hijack browser settings.",
  715. "Details":
  716.  
  717. "InternetSettings": "http://47.96.167.244:1991/520.pac"
  718.  
  719.  
  720.  
  721.  
  722. "Description": "File has been identified by 40 Antiviruses on VirusTotal as malicious",
  723. "Details":
  724.  
  725. "MicroWorld-eScan": "Gen:Trojan.Heur.JP.HPW@aOZbeObi"
  726.  
  727.  
  728. "FireEye": "Gen:Trojan.Heur.JP.HPW@aOZbeObi"
  729.  
  730.  
  731. "CAT-QuickHeal": "Trojan.Alien"
  732.  
  733.  
  734. "McAfee": "Artemis!9CB69A500761"
  735.  
  736.  
  737. "Cylance": "Unsafe"
  738.  
  739.  
  740. "Alibaba": "Trojan:Win32/Alien.cd2cd710"
  741.  
  742.  
  743. "Arcabit": "Trojan.Heur.JP.EC7FE9"
  744.  
  745.  
  746. "TrendMicro": "TROJ_GEN.R004C0WFM19"
  747.  
  748.  
  749. "Symantec": "Trojan.Gen.MBT"
  750.  
  751.  
  752. "APEX": "Malicious"
  753.  
  754.  
  755. "Avast": "Win32:Malware-gen"
  756.  
  757.  
  758. "Kaspersky": "Trojan.Win32.Alien.fzf"
  759.  
  760.  
  761. "BitDefender": "Gen:Trojan.Heur.JP.HPW@aOZbeObi"
  762.  
  763.  
  764. "NANO-Antivirus": "Trojan.Win32.Alien.frtacy"
  765.  
  766.  
  767. "Paloalto": "generic.ml"
  768.  
  769.  
  770. "Tencent": "Win32.Trojan.Alien.Hxgg"
  771.  
  772.  
  773. "Sophos": "Mal/Generic-S"
  774.  
  775.  
  776. "F-Secure": "Trojan.TR/Barys.nxntk"
  777.  
  778.  
  779. "DrWeb": "Trojan.DownLoader28.65302"
  780.  
  781.  
  782. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.tm"
  783.  
  784.  
  785. "Emsisoft": "Gen:Trojan.Heur.JP.HPW@aOZbeObi (B)"
  786.  
  787.  
  788. "SentinelOne": "DFI - Malicious PE"
  789.  
  790.  
  791. "Cyren": "W32/Trojan.CMKJ-5111"
  792.  
  793.  
  794. "Avira": "TR/Barys.nxntk"
  795.  
  796.  
  797. "Antiy-AVL": "Trojan/Win32.Alien"
  798.  
  799.  
  800. "Microsoft": "Trojan:Win32/Skeeyah.A!bit"
  801.  
  802.  
  803. "AegisLab": "Trojan.Win32.Aozbeobi.4!c"
  804.  
  805.  
  806. "ZoneAlarm": "Trojan.Win32.Alien.fzf"
  807.  
  808.  
  809. "GData": "Gen:Trojan.Heur.JP.HPW@aOZbeObi"
  810.  
  811.  
  812. "AhnLab-V3": "Malware/Win32.Generic.C3297609"
  813.  
  814.  
  815. "Acronis": "suspicious"
  816.  
  817.  
  818. "VBA32": "suspected of Trojan.Downloader.gen.h"
  819.  
  820.  
  821. "Ad-Aware": "Gen:Trojan.Heur.JP.HPW@aOZbeObi"
  822.  
  823.  
  824. "TrendMicro-HouseCall": "TROJ_GEN.R004C0WFM19"
  825.  
  826.  
  827. "Rising": "Malware.Heuristic.MLite(100%) (AI-LITE:oYW6Sh+/ec74YcWez6dHTA)"
  828.  
  829.  
  830. "Fortinet": "W32/Alien.FZF!tr"
  831.  
  832.  
  833. "AVG": "Win32:Malware-gen"
  834.  
  835.  
  836. "Cybereason": "malicious.00761d"
  837.  
  838.  
  839. "Panda": "Trj/GdSda.A"
  840.  
  841.  
  842. "CrowdStrike": "win/malicious_confidence_60% (W)"
  843.  
  844.  
  845.  
  846.  
  847.  
  848. * Started Service:
  849.  
  850. * Mutexes:
  851. "Global\\ADAP_WMI_ENTRY",
  852. "Global\\RefreshRA_Mutex",
  853. "Global\\RefreshRA_Mutex_Lib",
  854. "Global\\RefreshRA_Mutex_Flag"
  855.  
  856.  
  857. * Modified Files:
  858. "C:\\Windows\\Temp\\hosta.dat",
  859. "C:\\Windows\\Temp\\hostaa.vbs",
  860. "C:\\Windows\\sysnative\\Tasks\\5201",
  861. "\\Device\\LanmanDatagramReceiver",
  862. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  863. "\\??\\PIPE\\srvsvc",
  864. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  865. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  866. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  867. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  868. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  869. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  870. "\\??\\WMIDataDevice"
  871.  
  872.  
  873. * Deleted Files:
  874. "C:\\Windows\\Tasks\\5201.job",
  875. "C:\\Windows\\sysnative\\Tasks\\5201",
  876. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  877. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  878. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  879.  
  880.  
  881. * Modified Registry Keys:
  882. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnableLegacyAutoProxyFeatures",
  883. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL",
  884. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\85A1CF93-F81F-43E0-8203-F7FC9CE48C9A\\Path",
  885. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\85A1CF93-F81F-43E0-8203-F7FC9CE48C9A\\Hash",
  886. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\5201\\Id",
  887. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\5201\\Index",
  888. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\85A1CF93-F81F-43E0-8203-F7FC9CE48C9A\\Triggers",
  889. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\85A1CF93-F81F-43E0-8203-F7FC9CE48C9A\\DynamicInfo",
  890. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DCC4EE1B-A390-410C-A831-FF4F173F76F1",
  891. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  892. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  893. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  894. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A410229B-06BD-4B7E-B8A3-5B7F9D1F61C9\\Path",
  895. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A410229B-06BD-4B7E-B8A3-5B7F9D1F61C9\\Hash",
  896. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A410229B-06BD-4B7E-B8A3-5B7F9D1F61C9\\Triggers",
  897. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A410229B-06BD-4B7E-B8A3-5B7F9D1F61C9\\DynamicInfo",
  898. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\57864E07-3540-4B1C-A2DB-31C143C88ABB",
  899. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\9E3DABEA-0728-484B-9E44-D198D78E9179\\Path",
  900. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\9E3DABEA-0728-484B-9E44-D198D78E9179\\Hash",
  901. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\9E3DABEA-0728-484B-9E44-D198D78E9179\\Triggers",
  902. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\9E3DABEA-0728-484B-9E44-D198D78E9179\\DynamicInfo",
  903. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\4432FC7B-C584-490F-992A-84550BB0EBFE",
  904. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\33D00055-C423-4E81-8639-C75C64F34A8E\\Path",
  905. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\33D00055-C423-4E81-8639-C75C64F34A8E\\Hash",
  906. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\33D00055-C423-4E81-8639-C75C64F34A8E\\Triggers",
  907. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\33D00055-C423-4E81-8639-C75C64F34A8E\\DynamicInfo",
  908. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B2EA283F-D111-42BE-A3F4-FF513D99E1B1",
  909. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3135E97-9CCB-4BDD-955F-9FA838832C2B\\Path",
  910. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3135E97-9CCB-4BDD-955F-9FA838832C2B\\Hash",
  911. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3135E97-9CCB-4BDD-955F-9FA838832C2B\\Triggers",
  912. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A3135E97-9CCB-4BDD-955F-9FA838832C2B\\DynamicInfo",
  913. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1328F1B0-B163-4365-81FA-B750D7DC7C68",
  914. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\008C1731-BDF4-4AFF-B484-92881075AFB0\\Path",
  915. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\008C1731-BDF4-4AFF-B484-92881075AFB0\\Hash",
  916. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\008C1731-BDF4-4AFF-B484-92881075AFB0\\Triggers",
  917. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\008C1731-BDF4-4AFF-B484-92881075AFB0\\DynamicInfo",
  918. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\2B4A442F-1FE3-4684-83D6-BD4A27868C6B",
  919. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B84E3F6A-1942-4682-9BB0-618CEF1854E2\\Path",
  920. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B84E3F6A-1942-4682-9BB0-618CEF1854E2\\Hash",
  921. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B84E3F6A-1942-4682-9BB0-618CEF1854E2\\Triggers",
  922. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B84E3F6A-1942-4682-9BB0-618CEF1854E2\\DynamicInfo",
  923. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ABF28FFB-C7A9-464F-9A29-353099F1383E",
  924. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\CF0E6DE5-55E4-42E2-9037-B3AB50885206\\Path",
  925. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\CF0E6DE5-55E4-42E2-9037-B3AB50885206\\Hash",
  926. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\CF0E6DE5-55E4-42E2-9037-B3AB50885206\\Triggers",
  927. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\CF0E6DE5-55E4-42E2-9037-B3AB50885206\\DynamicInfo",
  928. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9C6E2AA2-A117-41B4-A54A-389A43E96C80",
  929. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\92DFA606-8623-4BC1-B834-36CF94B8DD9F\\Path",
  930. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\92DFA606-8623-4BC1-B834-36CF94B8DD9F\\Hash",
  931. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\92DFA606-8623-4BC1-B834-36CF94B8DD9F\\Triggers",
  932. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\92DFA606-8623-4BC1-B834-36CF94B8DD9F\\DynamicInfo",
  933. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\EA3E81F7-6ADF-4975-9391-8A63B0ECA432",
  934. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DE9E0CD0-1F4D-4E74-8809-BC1F15FB8F97\\Path",
  935. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DE9E0CD0-1F4D-4E74-8809-BC1F15FB8F97\\Hash",
  936. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DE9E0CD0-1F4D-4E74-8809-BC1F15FB8F97\\Triggers",
  937. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DE9E0CD0-1F4D-4E74-8809-BC1F15FB8F97\\DynamicInfo",
  938. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\8F836E47-A8AE-455C-86FF-9ECB391A5CDC",
  939. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AA8AB833-4023-4F32-AF56-DA96B42336A3\\Path",
  940. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AA8AB833-4023-4F32-AF56-DA96B42336A3\\Hash",
  941. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AA8AB833-4023-4F32-AF56-DA96B42336A3\\Triggers",
  942. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AA8AB833-4023-4F32-AF56-DA96B42336A3\\DynamicInfo",
  943. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C6B35D1F-9363-4931-9AC9-A2FBF78437C6",
  944. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F0ED8E95-5125-4A48-90C3-7D1C7EE916AA\\Path",
  945. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F0ED8E95-5125-4A48-90C3-7D1C7EE916AA\\Hash",
  946. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F0ED8E95-5125-4A48-90C3-7D1C7EE916AA\\Triggers",
  947. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F0ED8E95-5125-4A48-90C3-7D1C7EE916AA\\DynamicInfo",
  948. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\45D78EE1-A31E-4199-8B5C-25660DE7C179",
  949. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6BE1CAB6-DF1C-4294-934A-C515EAFFD6B9\\Path",
  950. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6BE1CAB6-DF1C-4294-934A-C515EAFFD6B9\\Hash",
  951. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6BE1CAB6-DF1C-4294-934A-C515EAFFD6B9\\Triggers",
  952. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6BE1CAB6-DF1C-4294-934A-C515EAFFD6B9\\DynamicInfo",
  953. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\7CF54CDA-6166-45AF-8528-BC21E5E7D5C3",
  954. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AFA1658A-D1EE-4845-8A52-75B9B319A652\\Path",
  955. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AFA1658A-D1EE-4845-8A52-75B9B319A652\\Hash",
  956. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AFA1658A-D1EE-4845-8A52-75B9B319A652\\Triggers",
  957. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AFA1658A-D1EE-4845-8A52-75B9B319A652\\DynamicInfo",
  958. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\457785E3-A695-4AD6-B933-D06FC3221AE9",
  959. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD3841AF-8094-4D80-A468-81BDF4D71257\\Path",
  960. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD3841AF-8094-4D80-A468-81BDF4D71257\\Hash",
  961. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD3841AF-8094-4D80-A468-81BDF4D71257\\Triggers",
  962. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD3841AF-8094-4D80-A468-81BDF4D71257\\DynamicInfo",
  963. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B3B74843-2606-42B3-BDB8-D152C7076625",
  964. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FBE6C243-6DB1-4C70-8C39-FB5DFCBB433A\\Path",
  965. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FBE6C243-6DB1-4C70-8C39-FB5DFCBB433A\\Hash",
  966. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FBE6C243-6DB1-4C70-8C39-FB5DFCBB433A\\Triggers",
  967. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FBE6C243-6DB1-4C70-8C39-FB5DFCBB433A\\DynamicInfo",
  968. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\15049BA8-0D8B-408B-BD2E-371C75C95387",
  969. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F9713D40-C87E-458E-A3D1-69A6D56E41F5\\Path",
  970. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F9713D40-C87E-458E-A3D1-69A6D56E41F5\\Hash",
  971. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F9713D40-C87E-458E-A3D1-69A6D56E41F5\\Triggers",
  972. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F9713D40-C87E-458E-A3D1-69A6D56E41F5\\DynamicInfo",
  973. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ED6DA48A-BFD8-4C88-AB74-F1E806D6F0E7",
  974. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4B1B37C2-462C-4D71-A5DA-40FD0ACB2C85\\Path",
  975. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4B1B37C2-462C-4D71-A5DA-40FD0ACB2C85\\Hash",
  976. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4B1B37C2-462C-4D71-A5DA-40FD0ACB2C85\\Triggers",
  977. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\4B1B37C2-462C-4D71-A5DA-40FD0ACB2C85\\DynamicInfo",
  978. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\79858065-89B3-4081-80A1-EE5959547FB1",
  979. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\352A4575-ADE5-440D-95F5-2A8B5CA1F16B\\Path",
  980. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\352A4575-ADE5-440D-95F5-2A8B5CA1F16B\\Hash",
  981. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\352A4575-ADE5-440D-95F5-2A8B5CA1F16B\\Triggers",
  982. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\352A4575-ADE5-440D-95F5-2A8B5CA1F16B\\DynamicInfo",
  983. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\35D1686D-2445-4A65-8C2A-650478D079D9",
  984. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DCA081A0-B51B-454B-ACF8-015E71911C7E\\Path",
  985. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DCA081A0-B51B-454B-ACF8-015E71911C7E\\Hash",
  986. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DCA081A0-B51B-454B-ACF8-015E71911C7E\\Triggers",
  987. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DCA081A0-B51B-454B-ACF8-015E71911C7E\\DynamicInfo",
  988. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\D1ADDF31-C122-4A9E-863A-E42B70346159",
  989. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\567996B8-837C-4051-A312-E9E7E698A316\\Path",
  990. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\567996B8-837C-4051-A312-E9E7E698A316\\Hash",
  991. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\567996B8-837C-4051-A312-E9E7E698A316\\Triggers",
  992. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\567996B8-837C-4051-A312-E9E7E698A316\\DynamicInfo",
  993. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\58C5A766-616C-4DF2-B4AA-299ECD8D4664",
  994. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\7303D344-AE05-4FFD-ABB3-165995B8E2F8\\Path",
  995. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\7303D344-AE05-4FFD-ABB3-165995B8E2F8\\Hash",
  996. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\7303D344-AE05-4FFD-ABB3-165995B8E2F8\\Triggers",
  997. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\7303D344-AE05-4FFD-ABB3-165995B8E2F8\\DynamicInfo",
  998. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B2397871-2DB2-41DC-B831-8BA61DEC3FCF",
  999. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\C5218FF8-64C3-45C2-8212-57D31BC42098\\Path",
  1000. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\C5218FF8-64C3-45C2-8212-57D31BC42098\\Hash",
  1001. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\C5218FF8-64C3-45C2-8212-57D31BC42098\\Triggers",
  1002. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\C5218FF8-64C3-45C2-8212-57D31BC42098\\DynamicInfo",
  1003. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B8ED7782-D6D3-480A-91F2-FAC59B4FB8B9",
  1004. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\408E128C-7426-4748-AD32-A224AC493B0F\\Path",
  1005. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\408E128C-7426-4748-AD32-A224AC493B0F\\Hash",
  1006. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\408E128C-7426-4748-AD32-A224AC493B0F\\Triggers",
  1007. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\408E128C-7426-4748-AD32-A224AC493B0F\\DynamicInfo",
  1008. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\33860C29-A257-4206-94EB-D67FA828CC03",
  1009. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DCC4EE1B-A390-410C-A831-FF4F173F76F1\\data",
  1010. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Tcpip\\Parameters\\Interfaces\\8C8DAC1D-0390-4B59-BF93-EC6C9E68D36A\\NameServer",
  1011. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\57864E07-3540-4B1C-A2DB-31C143C88ABB\\data",
  1012. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\4432FC7B-C584-490F-992A-84550BB0EBFE\\data",
  1013. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B2EA283F-D111-42BE-A3F4-FF513D99E1B1\\data",
  1014. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1328F1B0-B163-4365-81FA-B750D7DC7C68\\data",
  1015. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\2B4A442F-1FE3-4684-83D6-BD4A27868C6B\\data",
  1016. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ABF28FFB-C7A9-464F-9A29-353099F1383E\\data",
  1017. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9C6E2AA2-A117-41B4-A54A-389A43E96C80\\data",
  1018. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\EA3E81F7-6ADF-4975-9391-8A63B0ECA432\\data",
  1019. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\8F836E47-A8AE-455C-86FF-9ECB391A5CDC\\data",
  1020. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C6B35D1F-9363-4931-9AC9-A2FBF78437C6\\data",
  1021. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\45D78EE1-A31E-4199-8B5C-25660DE7C179\\data",
  1022. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\7CF54CDA-6166-45AF-8528-BC21E5E7D5C3\\data",
  1023. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\457785E3-A695-4AD6-B933-D06FC3221AE9\\data",
  1024. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B3B74843-2606-42B3-BDB8-D152C7076625\\data",
  1025. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\15049BA8-0D8B-408B-BD2E-371C75C95387\\data",
  1026. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ED6DA48A-BFD8-4C88-AB74-F1E806D6F0E7\\data",
  1027. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\79858065-89B3-4081-80A1-EE5959547FB1\\data",
  1028. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\35D1686D-2445-4A65-8C2A-650478D079D9\\data",
  1029. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\D1ADDF31-C122-4A9E-863A-E42B70346159\\data",
  1030. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  1031. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  1032. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  1033. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  1034. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  1035. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  1036. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  1037. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  1038. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  1039. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  1040. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  1041. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  1042. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  1043. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  1044. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  1045. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI",
  1046. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\58C5A766-616C-4DF2-B4AA-299ECD8D4664\\data",
  1047. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B2397871-2DB2-41DC-B831-8BA61DEC3FCF\\data",
  1048. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\B8ED7782-D6D3-480A-91F2-FAC59B4FB8B9\\data"
  1049.  
  1050.  
  1051. * Deleted Registry Keys:
  1052. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\5201.job",
  1053. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\5201.job.fp",
  1054. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  1055. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  1056.  
  1057.  
  1058. * DNS Communications:
  1059.  
  1060. * Domains:
  1061.  
  1062. * Network Communication - ICMP:
  1063.  
  1064. * Network Communication - HTTP:
  1065.  
  1066. "count": 1,
  1067. "body": "",
  1068. "uri": "http://119.29.29.29/d?dn=fbz.zhujb.cn",
  1069. "user-agent": "From_AF",
  1070. "method": "GET",
  1071. "host": "119.29.29.29",
  1072. "version": "1.1",
  1073. "path": "/d?dn=fbz.zhujb.cn",
  1074. "data": "GET /d?dn=fbz.zhujb.cn HTTP/1.1\r\nUser-Agent: From_AF\r\nHost: 119.29.29.29\r\n\r\n",
  1075. "port": 80
  1076.  
  1077.  
  1078. "count": 1,
  1079. "body": "",
  1080. "uri": "http://119.29.29.29/d?dn=pac.zhujb.cn",
  1081. "user-agent": "From_AF",
  1082. "method": "GET",
  1083. "host": "119.29.29.29",
  1084. "version": "1.1",
  1085. "path": "/d?dn=pac.zhujb.cn",
  1086. "data": "GET /d?dn=pac.zhujb.cn HTTP/1.1\r\nUser-Agent: From_AF\r\nHost: 119.29.29.29\r\n\r\n",
  1087. "port": 80
  1088.  
  1089.  
  1090.  
  1091. * Network Communication - SMTP:
  1092.  
  1093. * Network Communication - Hosts:
  1094.  
  1095. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!