API tools faq
paste
paladin316

Exes_641b931183cb0ddccd1d4362feb7c86a_exe_2019-07-12_22_30.txt

paladin316
Jul 12th, 2019
2,249
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.09 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nymeria"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_641b931183cb0ddccd1d4362feb7c86a.exe"
  7. * File Size: 14766080
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "e0b29711e5dc428368ee650360da67753d1c2695e51a7dbc765cadea6d9667ab"
  10. * MD5: "641b931183cb0ddccd1d4362feb7c86a"
  11. * SHA1: "3b1506c1ad78e602c61f2d6b221a985c29668ea7"
  12. * SHA512: "34ad9096c6d0d9d7f8181fb28abbb2574cc1f524bdf2b70257b77a0b67a0c0c0082d3a446872182339d5ac91fe55af0c95dc0e78beaaa87d89b5efba46e8c234"
  13. * CRC32: "6D453550"
  14. * SSDEEP: "393216:ytuTxBjFBfXAh3sg2Rv72x9yFidBrzsl65cY:3Tx/BfXasg2l8fslb"
  15.  
  16. * Process Execution:
  17. "Exes_641b931183cb0ddccd1d4362feb7c86a.exe",
  18. "CL_Debug_Log.txt",
  19. "cmd.exe",
  20. "schtasks.exe",
  21. "svchost.exe",
  22. "taskeng.exe",
  23. "Helper.exe",
  24. "Helper.exe",
  25. "Helper.exe",
  26. "Helper.exe",
  27. "Helper.exe",
  28. "Helper.exe",
  29. "Helper.exe",
  30. "Helper.exe",
  31. "Helper.exe",
  32. "Helper.exe",
  33. "Helper.exe",
  34. "Helper.exe",
  35. "Helper.exe",
  36. "Helper.exe",
  37. "Helper.exe",
  38. "Helper.exe",
  39. "Helper.exe",
  40. "Helper.exe",
  41. "Helper.exe",
  42. "Helper.exe",
  43. "Helper.exe",
  44. "Helper.exe",
  45. "Helper.exe",
  46. "Helper.exe",
  47. "Helper.exe",
  48. "Helper.exe",
  49. "Helper.exe",
  50. "Helper.exe",
  51. "Helper.exe",
  52. "Helper.exe",
  53. "Helper.exe",
  54. "Helper.exe",
  55. "Helper.exe",
  56. "Helper.exe",
  57. "Helper.exe",
  58. "Helper.exe",
  59. "Helper.exe",
  60. "Helper.exe",
  61. "Helper.exe",
  62. "Helper.exe",
  63. "Helper.exe",
  64. "Helper.exe",
  65. "Helper.exe",
  66. "Helper.exe",
  67. "Helper.exe",
  68. "Helper.exe",
  69. "Helper.exe",
  70. "Helper.exe",
  71. "Helper.exe",
  72. "Helper.exe",
  73. "Helper.exe",
  74. "Helper.exe",
  75. "Helper.exe",
  76. "Helper.exe",
  77. "Helper.exe",
  78. "Helper.exe",
  79. "Helper.exe",
  80. "Helper.exe",
  81. "Helper.exe",
  82. "Helper.exe",
  83. "Helper.exe",
  84. "Helper.exe",
  85. "Helper.exe",
  86. "Helper.exe",
  87. "Helper.exe",
  88. "Helper.exe",
  89. "Helper.exe",
  90. "Helper.exe",
  91. "Helper.exe",
  92. "Helper.exe",
  93. "Helper.exe",
  94. "Helper.exe",
  95. "Helper.exe",
  96. "Helper.exe",
  97. "Helper.exe",
  98. "Helper.exe",
  99. "Helper.exe",
  100. "Helper.exe",
  101. "tor.exe",
  102. "Helper.exe",
  103. "Helper.exe",
  104. "Helper.exe",
  105. "Helper.exe",
  106. "Helper.exe",
  107. "Helper.exe",
  108. "Helper.exe",
  109. "Helper.exe",
  110. "Helper.exe",
  111. "Helper.exe",
  112. "Helper.exe",
  113. "Helper.exe",
  114. "Helper.exe",
  115. "Helper.exe",
  116. "Helper.exe",
  117. "Helper.exe",
  118. "Helper.exe",
  119. "Helper.exe",
  120. "Helper.exe",
  121. "Helper.exe",
  122. "Helper.exe",
  123. "Helper.exe",
  124. "Helper.exe",
  125. "Helper.exe",
  126. "Helper.exe",
  127. "Helper.exe",
  128. "Helper.exe",
  129. "Helper.exe",
  130. "Helper.exe",
  131. "Helper.exe",
  132. "Helper.exe",
  133. "Helper.exe",
  134. "taskeng.exe",
  135. "Helper.exe",
  136. "Helper.exe",
  137. "Helper.exe",
  138. "taskeng.exe",
  139. "Helper.exe",
  140. "Helper.exe",
  141. "Helper.exe",
  142. "taskeng.exe",
  143. "Helper.exe",
  144. "Helper.exe",
  145. "Helper.exe",
  146. "taskeng.exe",
  147. "svchost.exe",
  148. "WmiPrvSE.exe",
  149. "svchost.exe"
  150.  
  151.  
  152. * Executed Commands:
  153. "C:\\Users\\user\\AppData\\Local\\Temp\\CL_Debug_Log.txt e -p\"JDQJndnqwdnqw2139dn21n3b312idDQDB\" \"C:\\Users\\user\\AppData\\Local\\Temp\\CR_Debug_Log.txt\" -o\"C:\\Users\\user\\AppData\\Local\\Temp\\\"",
  154. "C:\\Users\\user\\AppData\\Local\\Temp\\start.bat",
  155. "schtasks.exe /Create /XML \"SystemCheck.xml\" /TN \"System\\SystemCheck\"",
  156. "taskeng.exe 505E9A75-D1EE-4845-92AD-A3B8B319A652 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  157. "taskeng.exe 9A493565-1130-497E-8864-F963787FBA7A S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  158. "taskeng.exe 1C9AAAC3-64D3-4B33-A53B-3A9091802467 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  159. "taskeng.exe DB9099CE-C368-49F7-A477-F19642008180 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  160. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe -SystemCheck",
  161. "\"C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe\" -RunSc",
  162. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe -RunSc",
  163. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe 7z e -p\"DxSqsNKKOxqPrM4Y3xeK\" \"C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor.tmp\" -o\"C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\\"",
  164. "\"C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\tor.exe\" -f TorConfig",
  165. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\tor.exe -f TorConfig",
  166. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  167.  
  168.  
  169. * Signatures Detected:
  170.  
  171. "Description": "Creates RWX memory",
  172. "Details":
  173.  
  174.  
  175. "Description": "A process attempted to delay the analysis task.",
  176. "Details":
  177.  
  178. "Process": "taskeng.exe tried to sleep 660 seconds, actually delayed analysis time by 0 seconds"
  179.  
  180.  
  181. "Process": "Helper.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  182.  
  183.  
  184. "Process": "svchost.exe tried to sleep 306 seconds, actually delayed analysis time by 0 seconds"
  185.  
  186.  
  187.  
  188.  
  189. "Description": "Attempts to connect to a dead IP:Port (37 unique times)",
  190. "Details":
  191.  
  192. "IP": "136.243.214.137:443"
  193.  
  194.  
  195. "IP": "46.28.110.244:443"
  196.  
  197.  
  198. "IP": "193.70.43.76:9001"
  199.  
  200.  
  201. "IP": "163.172.139.104:443"
  202.  
  203.  
  204. "IP": "185.100.86.182:8080"
  205.  
  206.  
  207. "IP": "51.254.96.208:9001"
  208.  
  209.  
  210. "IP": "185.100.85.101:9001"
  211.  
  212.  
  213. "IP": "188.138.112.60:1521"
  214.  
  215.  
  216. "IP": "5.196.88.122:9001"
  217.  
  218.  
  219. "IP": "46.38.237.221:9001"
  220.  
  221.  
  222. "IP": "193.234.15.56:443"
  223.  
  224.  
  225. "IP": "85.10.201.47:9001"
  226.  
  227.  
  228. "IP": "5.9.147.226:9001"
  229.  
  230.  
  231. "IP": "51.255.41.65:9001"
  232.  
  233.  
  234. "IP": "185.100.86.128:9001"
  235.  
  236.  
  237. "IP": "185.220.101.28:20028"
  238.  
  239.  
  240. "IP": "212.47.229.2:9001"
  241.  
  242.  
  243. "IP": "171.25.193.20:443"
  244.  
  245.  
  246. "IP": "212.129.62.232:443"
  247.  
  248.  
  249. "IP": "193.234.15.57:443"
  250.  
  251.  
  252. "IP": "185.100.84.82:443"
  253.  
  254.  
  255. "IP": "96.253.78.108:443"
  256.  
  257.  
  258. "IP": "86.59.119.83:443"
  259.  
  260.  
  261. "IP": "37.187.20.59:443"
  262.  
  263.  
  264. "IP": "80.127.137.19:443"
  265.  
  266.  
  267. "IP": "127.0.0.1:9303"
  268.  
  269.  
  270. "IP": "95.130.12.119:443"
  271.  
  272.  
  273. "IP": "54.36.237.163:443"
  274.  
  275.  
  276. "IP": "172.98.193.43:443"
  277.  
  278.  
  279. "IP": "193.11.114.45:9002"
  280.  
  281.  
  282. "IP": "192.160.102.166:9001"
  283.  
  284.  
  285. "IP": "83.212.99.68:443"
  286.  
  287.  
  288. "IP": "37.139.8.104:9001"
  289.  
  290.  
  291. "IP": "85.25.213.211:80"
  292.  
  293.  
  294. "IP": "31.185.104.19:443"
  295.  
  296.  
  297. "IP": "212.47.233.250:9001"
  298.  
  299.  
  300. "IP": "31.185.104.20:443"
  301.  
  302.  
  303.  
  304.  
  305. "Description": "Starts servers listening on 127.0.0.1:9303",
  306. "Details":
  307.  
  308.  
  309. "Description": "Expresses interest in specific running processes",
  310. "Details":
  311.  
  312. "process": "Helper.exe"
  313.  
  314.  
  315. "process": "tor.exe"
  316.  
  317.  
  318.  
  319.  
  320. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  321. "Details":
  322.  
  323.  
  324. "Description": "Drops a binary and executes it",
  325. "Details":
  326.  
  327. "binary": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\tor.exe"
  328.  
  329.  
  330. "binary": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe"
  331.  
  332.  
  333. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\CL_Debug_Log.txt"
  334.  
  335.  
  336.  
  337.  
  338. "Description": "The binary likely contains encrypted or compressed data.",
  339. "Details":
  340.  
  341. "section": "name: .rsrc, entropy: 8.00, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00d4aa00, virtual_size: 0x00d4a83c"
  342.  
  343.  
  344.  
  345.  
  346. "Description": "Executed a process and injected code into it, probably while unpacking",
  347. "Details":
  348.  
  349. "Injection": "Helper.exe(2844) -> Helper.exe(2588)"
  350.  
  351.  
  352.  
  353.  
  354. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  355. "Details":
  356.  
  357. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  358.  
  359.  
  360.  
  361.  
  362. "Description": "Installs Tor on the infected machine",
  363. "Details":
  364.  
  365.  
  366. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  367. "Details":
  368.  
  369. "MicroWorld-eScan": "AIT:Trojan.Nymeria.1546"
  370.  
  371.  
  372. "Cylance": "Unsafe"
  373.  
  374.  
  375. "Arcabit": "AIT:Trojan.Nymeria.D60A"
  376.  
  377.  
  378. "Symantec": "ML.Attribute.HighConfidence"
  379.  
  380.  
  381. "ESET-NOD32": "a variant of Win32/TrojanDropper.Autoit.TL"
  382.  
  383.  
  384. "BitDefender": "AIT:Trojan.Nymeria.1546"
  385.  
  386.  
  387. "Endgame": "malicious (high confidence)"
  388.  
  389.  
  390. "Emsisoft": "AIT:Trojan.Nymeria.1546 (B)"
  391.  
  392.  
  393. "DrWeb": "Trojan.AutoIt.463"
  394.  
  395.  
  396. "Invincea": "heuristic"
  397.  
  398.  
  399. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.vc"
  400.  
  401.  
  402. "Trapmine": "malicious.high.ml.score"
  403.  
  404.  
  405. "FireEye": "Generic.mg.641b931183cb0ddc"
  406.  
  407.  
  408. "SentinelOne": "DFI - Malicious PE"
  409.  
  410.  
  411. "Antiy-AVL": "Trojan/Generic.ASVCS3S.1E5"
  412.  
  413.  
  414. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  415.  
  416.  
  417. "GData": "AIT:Trojan.Nymeria.1546 (2x)"
  418.  
  419.  
  420. "Acronis": "suspicious"
  421.  
  422.  
  423. "ALYac": "AIT:Trojan.Nymeria.1546"
  424.  
  425.  
  426. "MAX": "malware (ai score=86)"
  427.  
  428.  
  429. "Ad-Aware": "AIT:Trojan.Nymeria.1546"
  430.  
  431.  
  432. "Rising": "Trojan.Win32.Agent_.sa (CLASSIC)"
  433.  
  434.  
  435. "Ikarus": "Trojan-Dropper.Win32.Autoit"
  436.  
  437.  
  438. "MaxSecure": "Trojan.Malware.300983.susgen"
  439.  
  440.  
  441. "Fortinet": "AutoIt/TrojanDropper.TL!tr"
  442.  
  443.  
  444. "AVG": "FileRepMalware"
  445.  
  446.  
  447. "Cybereason": "malicious.183cb0"
  448.  
  449.  
  450. "CrowdStrike": "win/malicious_confidence_80% (D)"
  451.  
  452.  
  453. "Qihoo-360": "HEUR/QVM10.1.7A69.Malware.Gen"
  454.  
  455.  
  456.  
  457.  
  458. "Description": "Created network traffic indicative of malicious activity",
  459. "Details":
  460.  
  461. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 25"
  462.  
  463.  
  464. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 29"
  465.  
  466.  
  467. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 26"
  468.  
  469.  
  470. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20"
  471.  
  472.  
  473. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 63"
  474.  
  475.  
  476. "signature": "ET TOR Known Tor Exit Node Traffic group 31"
  477.  
  478.  
  479. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 64"
  480.  
  481.  
  482. "signature": "ET TOR Known Tor Exit Node Traffic group 25"
  483.  
  484.  
  485. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 175"
  486.  
  487.  
  488. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 484"
  489.  
  490.  
  491. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 485"
  492.  
  493.  
  494. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 648"
  495.  
  496.  
  497. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17"
  498.  
  499.  
  500. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 643"
  501.  
  502.  
  503. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 253"
  504.  
  505.  
  506. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 509"
  507.  
  508.  
  509. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 276"
  510.  
  511.  
  512. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13"
  513.  
  514.  
  515. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 32"
  516.  
  517.  
  518. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 15"
  519.  
  520.  
  521. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 16"
  522.  
  523.  
  524. "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16"
  525.  
  526.  
  527. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 725"
  528.  
  529.  
  530. "signature": "ET TOR Known Tor Exit Node Traffic group 63"
  531.  
  532.  
  533. "signature": "ET TOR Known Tor Exit Node Traffic group 64"
  534.  
  535.  
  536. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 281"
  537.  
  538.  
  539. "signature": "ET TOR Known Tor Exit Node Traffic group 15"
  540.  
  541.  
  542. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 635"
  543.  
  544.  
  545. "signature": "ET TOR Known Tor Exit Node Traffic group 16"
  546.  
  547.  
  548. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 598"
  549.  
  550.  
  551. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 537"
  552.  
  553.  
  554. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 532"
  555.  
  556.  
  557. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 343"
  558.  
  559.  
  560. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 346"
  561.  
  562.  
  563. "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 345"
  564.  
  565.  
  566.  
  567.  
  568.  
  569. * Started Service:
  570.  
  571. * Mutexes:
  572. "QPRZ3bWvXh",
  573. "QPRZ1bWvXh",
  574. "Local\\ZoneAttributeCacheCounterMutex",
  575. "Local\\ZonesCacheCounterMutex",
  576. "Local\\ZonesLockedCacheCounterMutex",
  577. "QPRZ1bWvXh2"
  578.  
  579.  
  580. * Modified Files:
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\aut26D3.tmp",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\asacpiex.dll",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\CR_Debug_Log.txt",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\aut2F8F.tmp",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\CL_Debug_Log.txt",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\start.bat",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\start2.bat",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\SystemCheck.xml",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\32.exe",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\64.exe",
  591. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Helper.exe",
  592. "C:\\Windows\\sysnative\\Tasks\\System\\SystemCheck",
  593. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  594. "\\Device\\LanmanDatagramReceiver",
  595. "\\??\\PIPE\\srvsvc",
  596. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  597. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  598. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor.tmp",
  599. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\tor.exe",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorData\\TorConfig",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\upd.version",
  602. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libeay32.dll",
  603. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libevent-2-1-6.dll",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libevent_core-2-1-6.dll",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libevent_extra-2-1-6.dll",
  606. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libgcc_s_sjlj-1.dll",
  607. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libgmp-10.dll",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libssp-0.dll",
  609. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\libwinpthread-1.dll",
  610. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\ssleay32.dll",
  611. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\zlib1.dll",
  612. "\\??\\PIPE\\wkssvc",
  613. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\lock",
  614. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\state.tmp",
  615. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorData\\Tor.pid",
  616. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\unverified-microdesc-consensus.tmp",
  617. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\cached-certs.tmp",
  618. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\cached-microdesc-consensus.tmp",
  619. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\cached-microdescs.new",
  620. "\\??\\PIPE\\samr",
  621. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  622. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  623. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  624. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  625. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  626. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  627. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  628. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
  629.  
  630.  
  631. * Deleted Files:
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\aut26D3.tmp",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\aut2F8F.tmp",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\32.exe",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\64.exe",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\SystemCheck.xml",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\CR_Debug_Log.txt",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\CL_Debug_Log.txt",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\start2.bat",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\asacpiex.dll",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\start.bat",
  642. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  643. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\tor.exe",
  644. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor.tmp",
  645. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\key-pinning-entries",
  646. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Tor\\TorDataSocksListenAddress 127.0.0.1\\unverified-microdesc-consensus"
  647.  
  648.  
  649. * Modified Registry Keys:
  650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Path",
  651. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Hash",
  652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\System\\SystemCheck\\Id",
  653. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\System\\SystemCheck\\Index",
  654. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Triggers",
  655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\DynamicInfo",
  656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\505E9A75-D1EE-4845-92AD-A3B8B319A652",
  657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9A493565-1130-497E-8864-F963787FBA7A",
  658. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1C9AAAC3-64D3-4B33-A53B-3A9091802467",
  659. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  660. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  661. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  662. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DB9099CE-C368-49F7-A477-F19642008180",
  663. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\8430C6E1-17EF-4B0E-84C3-2BC5659686E5",
  664. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\505E9A75-D1EE-4845-92AD-A3B8B319A652\\data",
  665. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  666. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9A493565-1130-497E-8864-F963787FBA7A\\data",
  668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\1C9AAAC3-64D3-4B33-A53B-3A9091802467\\data",
  669. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  670. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  672. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  673. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  674. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  675. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  676. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\DB9099CE-C368-49F7-A477-F19642008180\\data",
  677. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\8430C6E1-17EF-4B0E-84C3-2BC5659686E5\\data"
  678.  
  679.  
  680. * Deleted Registry Keys:
  681. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  682. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  683. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  684. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  685. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  686.  
  687.  
  688. * DNS Communications:
  689.  
  690. * Domains:
  691.  
  692. * Network Communication - ICMP:
  693.  
  694. "src": "95.130.8.125",
  695. "dst": "169.254.255.254
  696. "type": 3,
  697. "data": ""
  698.  
  699.  
  700. "src": "95.130.8.125",
  701. "dst": "169.254.255.254
  702. "type": 3,
  703. "data": ""
  704.  
  705.  
  706.  
  707. * Network Communication - HTTP:
  708.  
  709. * Network Communication - SMTP:
  710.  
  711. * Network Communication - Hosts:
  712.  
  713. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!