API tools faq
paste
paladin316

Exes_982725c0997a31eceb6194deeddb41f1_png_2019-08-08_21_30.txt

paladin316
Aug 8th, 2019
2,113
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.55 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_982725c0997a31eceb6194deeddb41f1.png"
  7. * File Size: 524288
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "a4072e5e75f669fde8c4d6dd37fcbec867b7e1c709b55a4d5dc63467ec9e8733"
  10. * MD5: "982725c0997a31eceb6194deeddb41f1"
  11. * SHA1: "9efc21d2c6248c54345d8caedf3866a45e378b2b"
  12. * SHA512: "b674f10658bca49d7e5f5c4840838fa66dd5f9ba40851c106db91d4d4b1ab9ed1ab91a6800ed4b5549565ce39a36bda4cee1a434e4de8ec6fa7eb1e2c6cb8d43"
  13. * CRC32: "EC357A15"
  14. * SSDEEP: "6144:F5YtCc0H/hGAKjeBBtX0j1SLW5fN0kvxKbLChjXr4Qx1lxiBORoZVfIO+Red86PX:Pm7jeBbLWxr4QNCfj+Rwz596Wp3n"
  15.  
  16. * Process Execution:
  17. "Exes_982725c0997a31eceb6194deeddb41f1.png",
  18. "cmd.exe",
  19. "sc.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "powershell.exe",
  24. "cmd.exe",
  25. "powershell.exe",
  26. "cmd.exe",
  27. "powershell.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "cmd.exe",
  31. "powershell.exe",
  32. "cmd.exe",
  33. "powershell.exe",
  34. "cmd.exe",
  35. "powershell.exe",
  36. "cmd.exe",
  37. "powershell.exe",
  38. "cmd.exe",
  39. "powershell.exe",
  40. "cmd.exe",
  41. "powershell.exe",
  42. "Exeu_982927c0999a31eceb8194deeddb41f1.exe",
  43. "cmd.exe",
  44. "sc.exe",
  45. "cmd.exe",
  46. "sc.exe",
  47. "cmd.exe",
  48. "powershell.exe",
  49. "cmd.exe",
  50. "powershell.exe",
  51. "cmd.exe",
  52. "powershell.exe",
  53. "cmd.exe",
  54. "powershell.exe",
  55. "cmd.exe",
  56. "powershell.exe",
  57. "cmd.exe",
  58. "powershell.exe",
  59. "cmd.exe",
  60. "powershell.exe",
  61. "cmd.exe",
  62. "powershell.exe",
  63. "cmd.exe",
  64. "powershell.exe",
  65. "cmd.exe",
  66. "powershell.exe",
  67. "svchost.exe",
  68. "services.exe",
  69. "svchost.exe",
  70. "WMIADAP.exe",
  71. "taskeng.exe",
  72. "Exeu_982927c0999a31eceb8194deeddb41f1.exe",
  73. "cmd.exe",
  74. "sc.exe",
  75. "cmd.exe",
  76. "sc.exe",
  77. "cmd.exe",
  78. "powershell.exe",
  79. "cmd.exe",
  80. "powershell.exe",
  81. "cmd.exe",
  82. "powershell.exe",
  83. "cmd.exe",
  84. "powershell.exe",
  85. "cmd.exe",
  86. "powershell.exe",
  87. "cmd.exe",
  88. "powershell.exe",
  89. "cmd.exe",
  90. "powershell.exe",
  91. "cmd.exe",
  92. "powershell.exe",
  93. "cmd.exe",
  94. "powershell.exe",
  95. "cmd.exe",
  96. "powershell.exe",
  97. "svchost.exe",
  98. "svchost.exe",
  99. "WmiPrvSE.exe",
  100. "svchost.exe",
  101. "lsass.exe"
  102.  
  103.  
  104. * Executed Commands:
  105. "cmd.exe /c sc stop WinDefend",
  106. "cmd.exe /c sc delete WinDefend",
  107. "cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  108. "cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  109. "cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  110. "cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true",
  111. "cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true",
  112. "cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  113. "cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6",
  114. "cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6",
  115. "cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  116. "cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true",
  117. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_982927c0999a31eceb8194deeddb41f1.exe",
  118. "sc stop WinDefend",
  119. "sc delete WinDefend",
  120. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  121. "powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  122. "powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  123. "powershell Set-MpPreference -DisableIOAVProtection $true",
  124. "powershell Set-MpPreference -DisablePrivacyMode $true",
  125. "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  126. "powershell Set-MpPreference -SevereThreatDefaultAction 6",
  127. "powershell Set-MpPreference -LowThreatDefaultAction 6",
  128. "powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  129. "powershell Set-MpPreference -DisableScriptScanning $true",
  130. "C:\\Windows\\system32\\svchost.exe",
  131. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  132. "taskeng.exe 4022A7A4-AFF7-46BC-AE30-7CFBE46E6DF8 S-1-5-18:NT AUTHORITY\\System:Service:",
  133. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  134. "C:\\Windows\\system32\\lsass.exe"
  135.  
  136.  
  137. * Signatures Detected:
  138.  
  139. "Description": "Creates RWX memory",
  140. "Details":
  141.  
  142.  
  143. "Description": "Possible date expiration check, exits too soon after checking local time",
  144. "Details":
  145.  
  146. "process": "cmd.exe, PID 3032"
  147.  
  148.  
  149.  
  150.  
  151. "Description": "A process attempted to delay the analysis task.",
  152. "Details":
  153.  
  154. "Process": "svchost.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  155.  
  156.  
  157.  
  158.  
  159. "Description": "A process created a hidden window",
  160. "Details":
  161.  
  162. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  163.  
  164.  
  165. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  166.  
  167.  
  168. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  169.  
  170.  
  171. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  172.  
  173.  
  174. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  175.  
  176.  
  177. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  178.  
  179.  
  180. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  181.  
  182.  
  183. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  184.  
  185.  
  186. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  187.  
  188.  
  189. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  190.  
  191.  
  192. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  193.  
  194.  
  195. "Process": "Exes_982725c0997a31eceb6194deeddb41f1.png -> cmd.exe"
  196.  
  197.  
  198. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  199.  
  200.  
  201. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  202.  
  203.  
  204. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  205.  
  206.  
  207. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  208.  
  209.  
  210. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  211.  
  212.  
  213. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  214.  
  215.  
  216. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  217.  
  218.  
  219. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  220.  
  221.  
  222. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  223.  
  224.  
  225. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  226.  
  227.  
  228. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  229.  
  230.  
  231. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  232.  
  233.  
  234. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  235.  
  236.  
  237. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  238.  
  239.  
  240. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  241.  
  242.  
  243. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  244.  
  245.  
  246. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  247.  
  248.  
  249. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  250.  
  251.  
  252. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  253.  
  254.  
  255. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  256.  
  257.  
  258. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  259.  
  260.  
  261. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  262.  
  263.  
  264. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  265.  
  266.  
  267. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  268.  
  269.  
  270. "Process": "Exeu_982927c0999a31eceb8194deeddb41f1.exe -> cmd.exe"
  271.  
  272.  
  273.  
  274.  
  275. "Description": "File has been identified by 8 Antiviruses on VirusTotal as malicious",
  276. "Details":
  277.  
  278. "APEX": "Malicious"
  279.  
  280.  
  281. "Trapmine": "suspicious.low.ml.score"
  282.  
  283.  
  284. "SentinelOne": "DFI - Suspicious PE"
  285.  
  286.  
  287. "Endgame": "malicious (high confidence)"
  288.  
  289.  
  290. "Acronis": "suspicious"
  291.  
  292.  
  293. "Cybereason": "malicious.2c6248"
  294.  
  295.  
  296. "CrowdStrike": "win/malicious_confidence_90% (D)"
  297.  
  298.  
  299. "Qihoo-360": "HEUR/QVM03.0.12BD.Malware.Gen"
  300.  
  301.  
  302.  
  303.  
  304. "Description": "Drops a binary and executes it",
  305. "Details":
  306.  
  307. "binary": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_982927c0999a31eceb8194deeddb41f1.exe"
  308.  
  309.  
  310.  
  311.  
  312. "Description": "The binary likely contains encrypted or compressed data.",
  313. "Details":
  314.  
  315. "section": "name: .rsrc, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0002c000, virtual_size: 0x0002bd3c"
  316.  
  317.  
  318.  
  319.  
  320. "Description": "Attempts to restart the guest VM",
  321. "Details":
  322.  
  323.  
  324. "Description": "Attempts to stop active services",
  325. "Details":
  326.  
  327. "servicename": "WinDefend"
  328.  
  329.  
  330.  
  331.  
  332. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  333. "Details":
  334.  
  335. "Spam": "Exes_982725c0997a31eceb6194deeddb41f1.png (2272) called API GetSystemTimeAsFileTime 257979 times"
  336.  
  337.  
  338. "Spam": "Exeu_982927c0999a31eceb8194deeddb41f1.exe (4772) called API GetSystemTimeAsFileTime 258051 times"
  339.  
  340.  
  341. "Spam": "Exeu_982927c0999a31eceb8194deeddb41f1.exe (3180) called API GetSystemTimeAsFileTime 257979 times"
  342.  
  343.  
  344. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 6489727 times"
  345.  
  346.  
  347. "Spam": "svchost.exe (2932) called API GetSystemTimeAsFileTime 100785 times"
  348.  
  349.  
  350.  
  351.  
  352. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  353. "Details":
  354.  
  355. "modified_name": "svchost.exe",
  356. "modified_path": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_982927c0999a31eceb8194deeddb41f1.exe",
  357. "original_name": "svchost.exe",
  358. "original_path": "C:\\Windows\\system32\\svchost.exe"
  359.  
  360.  
  361.  
  362.  
  363. "Description": "Creates a hidden or system file",
  364. "Details":
  365.  
  366. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1f43f.TMP"
  367.  
  368.  
  369. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18132.TMP"
  370.  
  371.  
  372. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf180e3.TMP"
  373.  
  374.  
  375. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18299.TMP"
  376.  
  377.  
  378. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20650.TMP"
  379.  
  380.  
  381. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff1a27.TMP"
  382.  
  383.  
  384. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20eeb.TMP"
  385.  
  386.  
  387. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18950.TMP"
  388.  
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18aa7.TMP"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf21b3f.TMP"
  394.  
  395.  
  396. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25105.TMP"
  397.  
  398.  
  399. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff336b.TMP"
  400.  
  401.  
  402. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a0a0.TMP"
  403.  
  404.  
  405. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25c11.TMP"
  406.  
  407.  
  408. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf257bb.TMP"
  409.  
  410.  
  411. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a592.TMP"
  412.  
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25eef.TMP"
  415.  
  416.  
  417. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf2618f.TMP"
  418.  
  419.  
  420. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf26681.TMP"
  421.  
  422.  
  423.  
  424.  
  425. "Description": "Creates a copy of itself",
  426. "Details":
  427.  
  428. "copy": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_982927c0999a31eceb8194deeddb41f1.exe"
  429.  
  430.  
  431.  
  432.  
  433. "Description": "Attempts to disable Windows Defender",
  434. "Details":
  435.  
  436.  
  437. "Description": "Anomalous binary characteristics",
  438. "Details":
  439.  
  440. "anomaly": "Actual checksum does not match that reported in PE header"
  441.  
  442.  
  443.  
  444.  
  445.  
  446. * Started Service:
  447. "KeyIso"
  448.  
  449.  
  450. * Mutexes:
  451. "Global\\CLR_CASOFF_MUTEX",
  452. "Global\\838B6C9EB27932960",
  453. "Global\\ADAP_WMI_ENTRY",
  454. "Global\\RefreshRA_Mutex",
  455. "Global\\RefreshRA_Mutex_Lib",
  456. "Global\\RefreshRA_Mutex_Flag"
  457.  
  458.  
  459. * Modified Files:
  460. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF133383422BF40E17.TMP",
  461. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\Exeu_982927c0999a31eceb8194deeddb41f1.exe",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  463. "\\??\\PIPE\\srvsvc",
  464. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\N4JVE6ZGHMXNKQERGPLX.temp",
  465. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1f43f.TMP",
  466. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\QGC02F0UQ8VNAOODFMNN.temp",
  467. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18132.TMP",
  468. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HJ98ID7042L9SG4SHRIA.temp",
  469. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf180e3.TMP",
  470. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\8O9C2G0JG8PI88TN0CTY.temp",
  471. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18299.TMP",
  472. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AO86JIUG3DBX6FL2C9FN.temp",
  473. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20650.TMP",
  474. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\C9601N7YXNF1ZB6GX3DI.temp",
  475. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff1a27.TMP",
  476. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZZ681V3EZL5VSSOFU0GR.temp",
  477. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20eeb.TMP",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PQRTXY3DBH4EY5E13GMY.temp",
  479. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18950.TMP",
  480. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7C6A11A85D497DE7.TMP",
  481. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RLTFDLCW1Y6TBEB6JFCU.temp",
  482. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18aa7.TMP",
  483. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RRX1ZNSDQKS1C2CK137R.temp",
  484. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf21b3f.TMP",
  485. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  486. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TJAHWIP0G2RTJ8992AKB.temp",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25105.TMP",
  488. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\X7S3LFBPB8FFS6JUXWAB.temp",
  489. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff336b.TMP",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZZ7BNQJTWK7WQATJGHVV.temp",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a0a0.TMP",
  492. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\EDRVWW1Q535CE8RRJ2GC.temp",
  493. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25c11.TMP",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LV654A4SQ8505K7VRKB6.temp",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf257bb.TMP",
  496. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9Q4C0B6J2UT6XBKFDKGU.temp",
  497. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a592.TMP",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NCPD3EKQAGDLBJBXVXPD.temp",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25eef.TMP",
  500. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TZM65UDF9LNBP1MM2VXA.temp",
  501. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf2618f.TMP",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\QW1WIHUQ3S85IQ7VFS7Q.temp",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZM2PR8L0LYOAMM5MX73T.temp",
  504. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf26681.TMP",
  505. "C:\\Windows\\sysnative\\Tasks\\Ms Dll libraries",
  506. "\\Device\\LanmanDatagramReceiver",
  507. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  508. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  509. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  510. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  511. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  512. "\\??\\PIPE\\samr",
  513. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  514. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  515. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  516. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  517. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  518. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  519. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  520. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  521. "C:\\Windows\\Temp\\~DFDE8466C6402FD24E.TMP",
  522. "\\??\\WMIDataDevice",
  523. "C:\\Windows\\sysnative\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk"
  524.  
  525.  
  526. * Deleted Files:
  527. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF133383422BF40E17.TMP",
  528. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1f43f.TMP",
  529. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2260.15857562",
  530. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2260.15857578",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2260.15857578",
  532. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18132.TMP",
  533. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3048.15840171",
  534. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3048.15840171",
  535. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3048.15840187",
  536. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf180e3.TMP",
  537. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1944.15839781",
  538. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1944.15839781",
  539. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1944.15839781",
  540. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18299.TMP",
  541. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2468.15841890",
  542. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2468.15841906",
  543. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2468.15841906",
  544. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20650.TMP",
  545. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2124.15861781",
  546. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2124.15861781",
  547. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2124.15861781",
  548. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff1a27.TMP",
  549. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1420.16733015",
  550. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1420.16733015",
  551. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1420.16733015",
  552. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf20eeb.TMP",
  553. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2372.15864390",
  554. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2372.15864406",
  555. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2372.15864406",
  556. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18950.TMP",
  557. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2976.15846421",
  558. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2976.15846421",
  559. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2976.15846421",
  560. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7C6A11A85D497DE7.TMP",
  561. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf18aa7.TMP",
  562. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3212.15846656",
  563. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3212.15846671",
  564. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3212.15846671",
  565. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf21b3f.TMP",
  566. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3244.15867734",
  567. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3244.15867734",
  568. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3244.15867750",
  569. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25105.TMP",
  570. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3900.15880515",
  571. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3900.15880531",
  572. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3900.15880531",
  573. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFff336b.TMP",
  574. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4084.16751812",
  575. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4084.16751812",
  576. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4084.16751812",
  577. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a0a0.TMP",
  578. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3284.15863609",
  579. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3284.15863609",
  580. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3284.15863625",
  581. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25c11.TMP",
  582. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2000.15883359",
  583. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2000.15883359",
  584. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2000.15883359",
  585. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf257bb.TMP",
  586. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4048.15883281",
  587. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4048.15883281",
  588. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4048.15883281",
  589. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf1a592.TMP",
  590. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2880.15864359",
  591. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2880.15864359",
  592. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2880.15864359",
  593. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf25eef.TMP",
  594. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4056.15884750",
  595. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4056.15884750",
  596. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4056.15884765",
  597. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf2618f.TMP",
  598. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3564.15885546",
  599. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3564.15885546",
  600. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3564.15885578",
  601. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\QW1WIHUQ3S85IQ7VFS7Q.temp",
  602. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3996.16756562",
  603. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3996.16756562",
  604. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3996.16756578",
  605. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFf26681.TMP",
  606. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4252.15886796",
  607. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4252.15886812",
  608. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4252.15886812",
  609. "C:\\Windows\\Tasks\\Ms Dll libraries.job",
  610. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  611. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  612. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  613. "C:\\Windows\\Temp\\~DFDE8466C6402FD24E.TMP",
  614. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Caches\\AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9.1.ver0x0000000000000000.db",
  615. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3600.17428779",
  616. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3600.17428779",
  617. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3600.17428794",
  618. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4856.17457196",
  619. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4856.17457196",
  620. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4856.17457196",
  621. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2584.17424165",
  622. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2584.17424165",
  623. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2584.17424181",
  624. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4424.17472661",
  625. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4424.17472661",
  626. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4424.17472661",
  627. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3488.17444125",
  628. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3488.17444125",
  629. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3488.17444141",
  630. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2140.17443820",
  631. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2140.17443836",
  632. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2140.17443836",
  633. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1824.17470086",
  634. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1824.17470086",
  635. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1824.17470086",
  636. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1484.17463771",
  637. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1484.17463771",
  638. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1484.17463787",
  639. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2556.17465582",
  640. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2556.17465582",
  641. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2556.17465582",
  642. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4152.17447401",
  643. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4152.17447401",
  644. "C:\\Windows\\sysnative\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4152.17447401"
  645.  
  646.  
  647. * Modified Registry Keys:
  648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  651. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  653. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable",
  654. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  655. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\0096502D-E5A8-4303-A737-CBA2A8BA171E\\Path",
  657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\0096502D-E5A8-4303-A737-CBA2A8BA171E\\Hash",
  658. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Id",
  659. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Index",
  660. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\0096502D-E5A8-4303-A737-CBA2A8BA171E\\Triggers",
  661. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\0096502D-E5A8-4303-A737-CBA2A8BA171E\\DynamicInfo",
  662. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  663. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  664. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  665. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\4022A7A4-AFF7-46BC-AE30-7CFBE46E6DF8",
  666. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  669. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  670. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  672. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  673. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\4022A7A4-AFF7-46BC-AE30-7CFBE46E6DF8\\data",
  674. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  675. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  676. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  677. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  678. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  679. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  680. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  681. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  682. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  683. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  684. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  685. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  686. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  687. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  688. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  689. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  690.  
  691.  
  692. * Deleted Registry Keys:
  693. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job",
  694. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job.fp",
  695. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  696. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  697.  
  698.  
  699. * DNS Communications:
  700.  
  701. * Domains:
  702.  
  703. * Network Communication - ICMP:
  704.  
  705. * Network Communication - HTTP:
  706.  
  707. * Network Communication - SMTP:
  708.  
  709. * Network Communication - Hosts:
  710.  
  711. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!