API tools faq
paste
paladin316

Exes_1fd677f10cb99903d2635cc22cf25c23_exe_2019-08-08_19_30.txt

paladin316
Aug 8th, 2019
2,099
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 20.43 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_1fd677f10cb99903d2635cc22cf25c23.exe"
  7. * File Size: 1497028
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "aa479cf6c530181ad6b21cd0b72c216aa5f70f1e7faf06101f35bcdcd38d6d3a"
  10. * MD5: "1fd677f10cb99903d2635cc22cf25c23"
  11. * SHA1: "001f786e85cc3a73ae19dbc2e7543d1ac5f5e06a"
  12. * SHA512: "6ced2221b693d16e0f55b0b7cb268e1c5bd43f2cf138be10b0a4ca8b14cc3a5365004453081da32ddda1f950695e64778d7835ee49f19f7e2f59d1cdc828af3b"
  13. * CRC32: "78C486B8"
  14. * SSDEEP: "24576:8NA3R5drXVuJz9duLTa6+Fa73qTUhbVWreDbeiRpoLDKHNiTIamw:95V6z9duvaPF4UU3WrURpoqtdamw"
  15.  
  16. * Process Execution:
  17. "Exes_1fd677f10cb99903d2635cc22cf25c23.exe",
  18. "wscript.exe",
  19. "xxb.exe"
  20.  
  21.  
  22. * Executed Commands:
  23. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\nxr.vbs\"",
  24. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\nxr.vbs ",
  25. "\"C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xxb.exe\" gcm=stc",
  26. "xxb.exe gcm=stc"
  27.  
  28.  
  29. * Signatures Detected:
  30.  
  31. "Description": "Detected script timer window indicative of sleep style evasion",
  32. "Details":
  33.  
  34. "Window": "WSH-Timer"
  35.  
  36.  
  37.  
  38.  
  39. "Description": "Reads data out of its own binary image",
  40. "Details":
  41.  
  42. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00000000, length: 0x00000007"
  43.  
  44.  
  45. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00000000, length: 0x00002000"
  46.  
  47.  
  48. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00000007, length: 0x0016d7bd"
  49.  
  50.  
  51. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00001ff0, length: 0x00002000"
  52.  
  53.  
  54. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00003fe0, length: 0x00002000"
  55.  
  56.  
  57. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00005fd0, length: 0x00002000"
  58.  
  59.  
  60. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00007fc0, length: 0x00002000"
  61.  
  62.  
  63. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00009fb0, length: 0x00002000"
  64.  
  65.  
  66. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0000bfa0, length: 0x00002000"
  67.  
  68.  
  69. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0000df90, length: 0x00002000"
  70.  
  71.  
  72. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0000ff80, length: 0x00002000"
  73.  
  74.  
  75. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00011f70, length: 0x00002000"
  76.  
  77.  
  78. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00013f60, length: 0x00002000"
  79.  
  80.  
  81. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00015f50, length: 0x00002000"
  82.  
  83.  
  84. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00017f40, length: 0x00002000"
  85.  
  86.  
  87. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00019f30, length: 0x00002000"
  88.  
  89.  
  90. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0001bf20, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0001df10, length: 0x00002000"
  94.  
  95.  
  96. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0001ff00, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00021ef0, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00023ee0, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00025ed0, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00027ec0, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00029eb0, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0002bea0, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0002de90, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0002fe80, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00031e70, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00033e60, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00035e50, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00037e40, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00039e30, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0003be20, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0003de10, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0003fe00, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00041df0, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00043de0, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00045600, length: 0x00000031"
  154.  
  155.  
  156. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x00045619, length: 0x00124aef"
  157.  
  158.  
  159. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016a2ad, length: 0x00000028"
  160.  
  161.  
  162. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016a4d0, length: 0x00000028"
  163.  
  164.  
  165. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016a6a2, length: 0x00000028"
  166.  
  167.  
  168. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016a895, length: 0x00000028"
  169.  
  170.  
  171. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016aa82, length: 0x00000028"
  172.  
  173.  
  174. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016ac54, length: 0x00000029"
  175.  
  176.  
  177. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016ae39, length: 0x00000028"
  178.  
  179.  
  180. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b038, length: 0x00000028"
  181.  
  182.  
  183. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b20c, length: 0x00000028"
  184.  
  185.  
  186. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b404, length: 0x00000028"
  187.  
  188.  
  189. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b5ef, length: 0x00000028"
  190.  
  191.  
  192. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b800, length: 0x00000028"
  193.  
  194.  
  195. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016b9f2, length: 0x00000029"
  196.  
  197.  
  198. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016bbcb, length: 0x00000028"
  199.  
  200.  
  201. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016bdd2, length: 0x00000028"
  202.  
  203.  
  204. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016bfa1, length: 0x00000028"
  205.  
  206.  
  207. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016c1bd, length: 0x00000027"
  208.  
  209.  
  210. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016c3bd, length: 0x00000028"
  211.  
  212.  
  213. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016c59b, length: 0x00000028"
  214.  
  215.  
  216. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016c79e, length: 0x00000028"
  217.  
  218.  
  219. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016c964, length: 0x00000027"
  220.  
  221.  
  222. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016cba2, length: 0x00000028"
  223.  
  224.  
  225. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016cd84, length: 0x00000028"
  226.  
  227.  
  228. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016cf5b, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016d145, length: 0x00000027"
  232.  
  233.  
  234. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016d33e, length: 0x00000028"
  235.  
  236.  
  237. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016d519, length: 0x00000028"
  238.  
  239.  
  240. "self_read": "process: Exes_1fd677f10cb99903d2635cc22cf25c23.exe, pid: 1592, offset: 0x0016d70b, length: 0x0000001b"
  241.  
  242.  
  243. "self_read": "process: wscript.exe, pid: 2160, offset: 0x00000000, length: 0x00000040"
  244.  
  245.  
  246. "self_read": "process: wscript.exe, pid: 2160, offset: 0x000000f0, length: 0x00000018"
  247.  
  248.  
  249. "self_read": "process: wscript.exe, pid: 2160, offset: 0x000001e8, length: 0x00000078"
  250.  
  251.  
  252. "self_read": "process: wscript.exe, pid: 2160, offset: 0x00018000, length: 0x00000020"
  253.  
  254.  
  255. "self_read": "process: wscript.exe, pid: 2160, offset: 0x00018058, length: 0x00000018"
  256.  
  257.  
  258. "self_read": "process: wscript.exe, pid: 2160, offset: 0x000181a8, length: 0x00000018"
  259.  
  260.  
  261. "self_read": "process: wscript.exe, pid: 2160, offset: 0x00018470, length: 0x00000010"
  262.  
  263.  
  264. "self_read": "process: wscript.exe, pid: 2160, offset: 0x00018640, length: 0x00000012"
  265.  
  266.  
  267.  
  268.  
  269. "Description": "Drops a binary and executes it",
  270. "Details":
  271.  
  272. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xxb.exe"
  273.  
  274.  
  275.  
  276.  
  277. "Description": "Installs itself for autorun at Windows startup",
  278. "Details":
  279.  
  280. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\wertyujkjhg.exe"
  281.  
  282.  
  283. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xxb.exe C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\GCM_ST~1"
  284.  
  285.  
  286.  
  287.  
  288. "Description": "Creates a hidden or system file",
  289. "Details":
  290.  
  291. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xxb.exe"
  292.  
  293.  
  294. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\56509256"
  295.  
  296.  
  297. "file": "C:\\Users\\user\\temp"
  298.  
  299.  
  300.  
  301.  
  302. "Description": "File has been identified by 20 Antiviruses on VirusTotal as malicious",
  303. "Details":
  304.  
  305. "Malwarebytes": "Trojan.MalPack.AISFX.Generic"
  306.  
  307.  
  308. "CrowdStrike": "win/malicious_confidence_90% (D)"
  309.  
  310.  
  311. "K7GW": "Riskware ( 0040eff71 )"
  312.  
  313.  
  314. "K7AntiVirus": "Riskware ( 0040eff71 )"
  315.  
  316.  
  317. "F-Prot": "W32/Autoit.ADO"
  318.  
  319.  
  320. "APEX": "Malicious"
  321.  
  322.  
  323. "Paloalto": "generic.ml"
  324.  
  325.  
  326. "ClamAV": "Win.Malware.0040eff-7088474-0"
  327.  
  328.  
  329. "Invincea": "heuristic"
  330.  
  331.  
  332. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  333.  
  334.  
  335. "Trapmine": "suspicious.low.ml.score"
  336.  
  337.  
  338. "FireEye": "Generic.mg.1fd677f10cb99903"
  339.  
  340.  
  341. "Cyren": "W32/Autoit.XBNK-0841"
  342.  
  343.  
  344. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  345.  
  346.  
  347. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  348.  
  349.  
  350. "AhnLab-V3": "Malware/Win32.Generic.R285222"
  351.  
  352.  
  353. "Zoner": "Probably RARAutorun"
  354.  
  355.  
  356. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  357.  
  358.  
  359. "Cybereason": "malicious.e85cc3"
  360.  
  361.  
  362. "Qihoo-360": "HEUR/QVM10.1.0B4D.Malware.Gen"
  363.  
  364.  
  365.  
  366.  
  367. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  368. "Details":
  369.  
  370. "target": "clamav:Win.Malware.0040eff-7088474-0, sha256:aa479cf6c530181ad6b21cd0b72c216aa5f70f1e7faf06101f35bcdcd38d6d3a, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  371.  
  372.  
  373.  
  374.  
  375.  
  376. * Started Service:
  377.  
  378. * Mutexes:
  379. "DefaultTabtip-MainUI",
  380. "CicLoadWinStaWinSta0",
  381. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  382. "Local\\ZoneAttributeCacheCounterMutex",
  383. "Local\\ZonesCacheCounterMutex",
  384. "Local\\ZonesLockedCacheCounterMutex"
  385.  
  386.  
  387. * Modified Files:
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\__tmp_rar_sfx_access_check_9455984",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\cwf.txt",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\gcm=stc",
  391. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\nxr.vbs",
  392. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xxb.exe",
  393. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\div.xl",
  394. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\abm.bmp",
  395. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ahl.ico",
  396. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\bxv.txt",
  397. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\gmp.xl",
  398. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ncp.pdf",
  399. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\tdj.bmp",
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\gfe.mp4",
  401. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\siu.docx",
  402. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\wvs.mp3",
  403. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\elu.xl",
  404. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ehx.icm",
  405. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\gnx.bmp",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\eqh.mp3",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\kth.icm",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\fgi.mp3",
  409. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\miv.dat",
  410. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\pnx.docx",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\xns.pdf",
  412. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\bsc.bmp",
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\erf.ico",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\jma.mp3",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\oav.ppt",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\jeu.docx",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\tvd.pdf",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ccx.ppt",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ejs.bmp",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\eni.ico",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\hut.ico",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\jnl.jpg",
  423. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\gkr.docx",
  424. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\puw.mp3",
  425. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\tmt.ico",
  426. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\qat.bmp",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\pex.xl",
  428. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\tuh.icm",
  429. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\vkl.ppt",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\ujw.ppt",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\fps.xl",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\bop.mp4",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\jwj.pdf",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\bal.ppt",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\uaq.xl",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\dvu.ppt",
  437. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\hxo.pdf",
  438. "C:\\Users\\user\\temp\\cwf.txt"
  439.  
  440.  
  441. * Deleted Files:
  442. "C:\\Users\\user\\AppData\\Local\\Temp\\56509256\\__tmp_rar_sfx_access_check_9455984"
  443.  
  444.  
  445. * Modified Registry Keys:
  446. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  447. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  448. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  449. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\wertyujkjhg.exe"
  450.  
  451.  
  452. * Deleted Registry Keys:
  453. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  454. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  455. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  456. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  457.  
  458.  
  459. * DNS Communications:
  460.  
  461. * Domains:
  462.  
  463. * Network Communication - ICMP:
  464.  
  465. * Network Communication - HTTP:
  466.  
  467. * Network Communication - SMTP:
  468.  
  469. * Network Communication - Hosts:
  470.  
  471. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!