API tools faq
paste
paladin316

Exes_33773450ecb91a9dfd5ce5322c5b9856_png_2019-08-08_21_30.txt

paladin316
Aug 8th, 2019
2,087
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.96 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_33773450ecb91a9dfd5ce5322c5b9856.png"
  7. * File Size: 524288
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "ee1ab7e8f5bc71fd8058523861d11d446b5d5e7a9054c026b744a00c193b8b98"
  10. * MD5: "33773450ecb91a9dfd5ce5322c5b9856"
  11. * SHA1: "5f6af3479a8c949aa86ee0d03569b9ea0fb0889a"
  12. * SHA512: "aa265130e0ce5765616f9acdf3e3e5d92cee59189130d25937143aa7be9f8581676409162f6a64d421e4465b7559fce2204f4464352d09bc0291cc215d3da4b6"
  13. * CRC32: "787A5EE8"
  14. * SSDEEP: "6144:x5YtCc0H/hGAKjeBBtX0j1SLW5fN0kvxKbLChjXr4Qx1lxsmGYFkj6Y9kKUasgZI:zm7jeBbLWxr4QkBkKU/gZLkqZlKlBH"
  15.  
  16. * Process Execution:
  17. "Exes_33773450ecb91a9dfd5ce5322c5b9856.png",
  18. "cmd.exe",
  19. "sc.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "powershell.exe",
  24. "cmd.exe",
  25. "powershell.exe",
  26. "cmd.exe",
  27. "powershell.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "cmd.exe",
  31. "powershell.exe",
  32. "cmd.exe",
  33. "powershell.exe",
  34. "cmd.exe",
  35. "powershell.exe",
  36. "cmd.exe",
  37. "powershell.exe",
  38. "cmd.exe",
  39. "powershell.exe",
  40. "cmd.exe",
  41. "powershell.exe",
  42. "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe",
  43. "cmd.exe",
  44. "sc.exe",
  45. "cmd.exe",
  46. "sc.exe",
  47. "cmd.exe",
  48. "powershell.exe",
  49. "cmd.exe",
  50. "powershell.exe",
  51. "cmd.exe",
  52. "powershell.exe",
  53. "cmd.exe",
  54. "powershell.exe",
  55. "cmd.exe",
  56. "powershell.exe",
  57. "cmd.exe",
  58. "powershell.exe",
  59. "cmd.exe",
  60. "powershell.exe",
  61. "cmd.exe",
  62. "powershell.exe",
  63. "cmd.exe",
  64. "powershell.exe",
  65. "cmd.exe",
  66. "powershell.exe",
  67. "svchost.exe",
  68. "svchost.exe"
  69.  
  70.  
  71. * Executed Commands:
  72. "cmd.exe /c sc stop WinDefend",
  73. "cmd.exe /c sc delete WinDefend",
  74. "cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  75. "cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  76. "cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  77. "cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true",
  78. "cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true",
  79. "cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  80. "cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6",
  81. "cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6",
  82. "cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  83. "cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true",
  84. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe",
  85. "sc stop WinDefend",
  86. "sc delete WinDefend",
  87. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  88. "powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  89. "powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  90. "powershell Set-MpPreference -DisableIOAVProtection $true",
  91. "powershell Set-MpPreference -DisablePrivacyMode $true",
  92. "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  93. "powershell Set-MpPreference -SevereThreatDefaultAction 6",
  94. "powershell Set-MpPreference -LowThreatDefaultAction 6",
  95. "powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  96. "powershell Set-MpPreference -DisableScriptScanning $true",
  97. "C:\\Windows\\system32\\svchost.exe"
  98.  
  99.  
  100. * Signatures Detected:
  101.  
  102. "Description": "Creates RWX memory",
  103. "Details":
  104.  
  105.  
  106. "Description": "Possible date expiration check, exits too soon after checking local time",
  107. "Details":
  108.  
  109. "process": "cmd.exe, PID 2536"
  110.  
  111.  
  112.  
  113.  
  114. "Description": "A process created a hidden window",
  115. "Details":
  116.  
  117. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  118.  
  119.  
  120. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  121.  
  122.  
  123. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  124.  
  125.  
  126. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  127.  
  128.  
  129. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  130.  
  131.  
  132. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  133.  
  134.  
  135. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  136.  
  137.  
  138. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  139.  
  140.  
  141. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  142.  
  143.  
  144. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  145.  
  146.  
  147. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  148.  
  149.  
  150. "Process": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png -> cmd.exe"
  151.  
  152.  
  153. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  154.  
  155.  
  156. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  157.  
  158.  
  159. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  160.  
  161.  
  162. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  163.  
  164.  
  165. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  166.  
  167.  
  168. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  169.  
  170.  
  171. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  172.  
  173.  
  174. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  175.  
  176.  
  177. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  178.  
  179.  
  180. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  181.  
  182.  
  183. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  184.  
  185.  
  186. "Process": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe -> cmd.exe"
  187.  
  188.  
  189.  
  190.  
  191. "Description": "Drops a binary and executes it",
  192. "Details":
  193.  
  194. "binary": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe"
  195.  
  196.  
  197.  
  198.  
  199. "Description": "The binary likely contains encrypted or compressed data.",
  200. "Details":
  201.  
  202. "section": "name: .rsrc, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0002c000, virtual_size: 0x0002bb3c"
  203.  
  204.  
  205.  
  206.  
  207. "Description": "Attempts to stop active services",
  208. "Details":
  209.  
  210. "servicename": "WinDefend"
  211.  
  212.  
  213.  
  214.  
  215. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  216. "Details":
  217.  
  218. "Spam": "Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe (1868) called API GetSystemTimeAsFileTime 257979 times"
  219.  
  220.  
  221. "Spam": "Exes_33773450ecb91a9dfd5ce5322c5b9856.png (2500) called API GetSystemTimeAsFileTime 257979 times"
  222.  
  223.  
  224.  
  225.  
  226. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  227. "Details":
  228.  
  229. "modified_name": "svchost.exe",
  230. "modified_path": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe",
  231. "original_name": "svchost.exe",
  232. "original_path": "C:\\Windows\\system32\\svchost.exe"
  233.  
  234.  
  235.  
  236.  
  237. "Description": "Creates a hidden or system file",
  238. "Details":
  239.  
  240. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc74667.TMP"
  241.  
  242.  
  243. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc79f55.TMP"
  244.  
  245.  
  246. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7aca3.TMP"
  247.  
  248.  
  249. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc749d2.TMP"
  250.  
  251.  
  252. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7bd2d.TMP"
  253.  
  254.  
  255. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7cb47.TMP"
  256.  
  257.  
  258. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7ce64.TMP"
  259.  
  260.  
  261. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75098.TMP"
  262.  
  263.  
  264. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75089.TMP"
  265.  
  266.  
  267. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7527d.TMP"
  268.  
  269.  
  270. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc767e9.TMP"
  271.  
  272.  
  273. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc81a13.TMP"
  274.  
  275.  
  276. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76c8d.TMP"
  277.  
  278.  
  279. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76dd5.TMP"
  280.  
  281.  
  282. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc827bf.TMP"
  283.  
  284.  
  285. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc82751.TMP"
  286.  
  287.  
  288. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc776be.TMP"
  289.  
  290.  
  291. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc778e1.TMP"
  292.  
  293.  
  294. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7795e.TMP"
  295.  
  296.  
  297.  
  298.  
  299. "Description": "File has been identified by 11 Antiviruses on VirusTotal as malicious",
  300. "Details":
  301.  
  302. "Cybereason": "malicious.79a8c9"
  303.  
  304.  
  305. "APEX": "Malicious"
  306.  
  307.  
  308. "Paloalto": "generic.ml"
  309.  
  310.  
  311. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  312.  
  313.  
  314. "Webroot": "W32.Malware.Gen"
  315.  
  316.  
  317. "Endgame": "malicious (high confidence)"
  318.  
  319.  
  320. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  321.  
  322.  
  323. "Acronis": "suspicious"
  324.  
  325.  
  326. "SentinelOne": "DFI - Suspicious PE"
  327.  
  328.  
  329. "CrowdStrike": "win/malicious_confidence_100% (D)"
  330.  
  331.  
  332. "Qihoo-360": "HEUR/QVM03.0.12FF.Malware.Gen"
  333.  
  334.  
  335.  
  336.  
  337. "Description": "Creates a copy of itself",
  338. "Details":
  339.  
  340. "copy": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe"
  341.  
  342.  
  343.  
  344.  
  345. "Description": "Attempts to disable Windows Defender",
  346. "Details":
  347.  
  348.  
  349. "Description": "Anomalous binary characteristics",
  350. "Details":
  351.  
  352. "anomaly": "Actual checksum does not match that reported in PE header"
  353.  
  354.  
  355.  
  356.  
  357.  
  358. * Started Service:
  359.  
  360. * Mutexes:
  361. "Global\\CLR_CASOFF_MUTEX",
  362. "Global\\838B6C9EB27932960"
  363.  
  364.  
  365. * Modified Files:
  366. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA6B26AAD50A58CCE.TMP",
  367. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_33993470ecb91a9dfd7ce7322c7b9878.exe",
  368. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  369. "\\??\\PIPE\\srvsvc",
  370. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AYYOFORTN6EWEC1F30QY.temp",
  371. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc74667.TMP",
  372. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\FUUSLWVL695G0S0HBQ2W.temp",
  373. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc79f55.TMP",
  374. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TDZX6M68B7AFB1H3OWJT.temp",
  375. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7aca3.TMP",
  376. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\R516F4T2UKA4OS2GZ1MS.temp",
  377. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc749d2.TMP",
  378. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\U2T6FJSAI1GE1NR3LEH4.temp",
  379. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7bd2d.TMP",
  380. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\T5V9W7EV65GH2A2C2LRE.temp",
  381. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7cb47.TMP",
  382. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PTUTT8I81W57P5271QXA.temp",
  383. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7ce64.TMP",
  384. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VFFUTQIFNZ58D1G4DV98.temp",
  385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75098.TMP",
  386. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZK1GQK45ASBLTR8OVJAZ.temp",
  387. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75089.TMP",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC0AA5960E725BB63.TMP",
  389. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AQ6L4O58YAIM0ZM37UFT.temp",
  390. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7527d.TMP",
  391. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  392. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Y9XO38IRNZWGY8MZ7L4K.temp",
  393. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc767e9.TMP",
  394. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\WS13CAA5V0WIMRRSXK1D.temp",
  395. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc81a13.TMP",
  396. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L375N44N53LMHJE5TLRG.temp",
  397. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76c8d.TMP",
  398. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\IN31FCA2D8F9RZAK352Y.temp",
  399. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76dd5.TMP",
  400. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\E7OEV84NCOMUO8QWRHSZ.temp",
  401. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc827bf.TMP",
  402. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5US1COSZ2Q2UIHA5RC7V.temp",
  403. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc82751.TMP",
  404. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\B0V48ESVCHNGU1U79M3X.temp",
  405. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc776be.TMP",
  406. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\S02T6DQIHAMHDTWPAQPO.temp",
  407. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc778e1.TMP",
  408. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\2CD947XW7F7CHO56748P.temp",
  409. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7795e.TMP",
  410. "C:\\Windows\\sysnative\\Tasks\\Ms Dll libraries",
  411. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  412. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk"
  413.  
  414.  
  415. * Deleted Files:
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA6B26AAD50A58CCE.TMP",
  417. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc74667.TMP",
  418. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2228.13063828",
  419. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2228.13063828",
  420. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2228.13063828",
  421. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc79f55.TMP",
  422. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2820.13083015",
  423. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2820.13083015",
  424. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2820.13083031",
  425. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7aca3.TMP",
  426. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2472.13086296",
  427. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2472.13086312",
  428. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2472.13086312",
  429. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc749d2.TMP",
  430. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2304.13070546",
  431. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2304.13070546",
  432. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2304.13070562",
  433. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7bd2d.TMP",
  434. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2396.13090812",
  435. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2396.13090812",
  436. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2396.13090812",
  437. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7cb47.TMP",
  438. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3048.13095140",
  439. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3048.13095140",
  440. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3048.13095140",
  441. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7ce64.TMP",
  442. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2632.13095390",
  443. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2632.13095390",
  444. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2632.13095390",
  445. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75098.TMP",
  446. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.492.13076937",
  447. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.492.13076937",
  448. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.492.13076937",
  449. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc75089.TMP",
  450. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2280.13077781",
  451. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2280.13077796",
  452. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2280.13077796",
  453. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC0AA5960E725BB63.TMP",
  454. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7527d.TMP",
  455. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3168.13079125",
  456. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3168.13079125",
  457. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3168.13079125",
  458. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc767e9.TMP",
  459. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3804.13094125",
  460. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3804.13094125",
  461. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3804.13094125",
  462. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc81a13.TMP",
  463. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3152.13116031",
  464. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3152.13116046",
  465. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3152.13116046",
  466. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76c8d.TMP",
  467. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3384.13098250",
  468. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3384.13098265",
  469. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3384.13098265",
  470. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc76dd5.TMP",
  471. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3612.13097468",
  472. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3612.13097468",
  473. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3612.13097484",
  474. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc827bf.TMP",
  475. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4004.13118281",
  476. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4004.13118281",
  477. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4004.13118281",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc82751.TMP",
  479. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4008.13118093",
  480. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4008.13118093",
  481. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4008.13118109",
  482. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc776be.TMP",
  483. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3556.13099671",
  484. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3556.13099671",
  485. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3556.13099687",
  486. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc778e1.TMP",
  487. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3960.13100187",
  488. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3960.13100187",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3960.13100203",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFc7795e.TMP",
  491. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4252.13100703",
  492. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4252.13100703",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4252.13100703",
  494. "C:\\Windows\\Tasks\\Ms Dll libraries.job",
  495. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
  496.  
  497.  
  498. * Modified Registry Keys:
  499. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  500. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  501. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  502. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  503. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  504. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable",
  505. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  506. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  507. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Path",
  508. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Hash",
  509. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Id",
  510. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Index",
  511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\Triggers",
  512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\AC2897E8-418F-4C77-9CA3-B2BDC3DECAB4\\DynamicInfo"
  513.  
  514.  
  515. * Deleted Registry Keys:
  516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job",
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job.fp"
  518.  
  519.  
  520. * DNS Communications:
  521.  
  522. * Domains:
  523.  
  524. * Network Communication - ICMP:
  525.  
  526. * Network Communication - HTTP:
  527.  
  528. * Network Communication - SMTP:
  529.  
  530. * Network Communication - Hosts:
  531.  
  532. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!