Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- * MalFamily: "Remcos"
- * MalScore: 10.0
- * File Name: "remcos_3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64"
- * File Size: 3034912
- * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
- * SHA256: "3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64"
- * MD5: "0c3755dfc856fff98807c041c0171115"
- * SHA1: "c488516a1d14ba4099d863396797c6a2e17b763f"
- * SHA512: "b9a49a8eb069e9b0cc818b953c6c495744feef4d74b88e433078808e3f1a4d39940c779e3cea93840642f072a446877b5e4749ebcb4ca23131926e2c880b1511"
- * CRC32: "E7FCF2F2"
- * SSDEEP: "49152:hh+ZkldoPK8Yad7cwj644Mh+ZkldoPK8YaLDNcY:C2cPK8YwjE2cPK8d"
- * Process Execution:
- "remcos_3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64.exe",
- "remcos_agent_Protected.exe",
- "remcos_agent_Protected.exe",
- "wscript.exe",
- "cmd.exe",
- "remcos.exe",
- "remcos.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "svchost.exe",
- "schtasks.exe",
- "schtasks.exe",
- "AcroRd32.exe",
- "Eula.exe",
- "schtasks.exe",
- "svchost.exe",
- "taskeng.exe",
- "taskeng.exe",
- "msoia.exe",
- "msoia.exe",
- "taskeng.exe",
- "taskeng.exe",
- "svchost.exe"
- * Executed Commands:
- "\"C:\\Users\\user\\AppData\\Roaming\\remcos_agent_Protected.exe\"",
- "C:\\Users\\user\\AppData\\Roaming\\remcos_agent_Protected.exe ",
- "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\medical-application-form.pdf\"",
- "C:\\Users\\user\\AppData\\Local\\Temp\\medical-application-form.pdf ",
- "\"C:\\Windows\\SysWOW64\\schtasks.exe\" /create /tn WWAHost /tr \"C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe\" /sc minute /mo 1 /F",
- "schtasks /create /tn WWAHost /tr \"C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe\" /sc minute /mo 1 /F",
- "\"C:\\Windows\\SysWOW64\\schtasks.exe\" /create /tn setx /tr \"C:\\Users\\user\\AppData\\Roaming\\CapabilityAccessHandlers\\sfc.exe\" /sc minute /mo 1 /F",
- "schtasks /create /tn setx /tr \"C:\\Users\\user\\AppData\\Roaming\\CapabilityAccessHandlers\\sfc.exe\" /sc minute /mo 1 /F",
- "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs\"",
- "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs ",
- "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" --type=renderer \"C:\\Users\\user\\AppData\\Local\\Temp\\medical-application-form.pdf\"",
- "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\" --backgroundcolor=16514043",
- "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\Eula.exe\" Adobe Acrobat Reader DC;1507816;1033",
- "taskeng.exe 06027CFB-0B68-4E4C-BEA4-8559A6F9E1BF S-1-5-18:NT AUTHORITY\\System:Service:",
- "taskeng.exe 69E21F04-938C-46A8-B4AD-6FCB4F20E4CC S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
- "taskeng.exe E80BCF90-2770-40E3-A64D-3E6331A4BEE3 S-1-5-18:NT AUTHORITY\\System:Service:",
- "taskeng.exe ADBB9E87-285F-47FB-9A76-77BB6D9513A9 S-1-5-18:NT AUTHORITY\\System:Service:",
- "\"C:\\Windows\\System32\\cmd.exe\" /c \"C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe\"",
- "cmd /c \"C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe\"",
- "C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe",
- "C:\\Windows\\SysWOW64\\svchost.exe",
- "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
- "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
- "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
- * Signatures Detected:
- "Description": "Creates RWX memory",
- "Details":
- "Description": "Possible date expiration check, exits too soon after checking local time",
- "Details":
- "process": "schtasks.exe, PID 348"
- "Description": "Detected script timer window indicative of sleep style evasion",
- "Details":
- "Window": "WSH-Timer"
- "Description": "Expresses interest in specific running processes",
- "Details":
- "process": "RdrCEF.exe"
- "Description": "Reads data out of its own binary image",
- "Details":
- "self_read": "process: remcos_3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64.exe, pid: 976, offset: 0x00000000, length: 0x002e4f20"
- "self_read": "process: remcos_agent_Protected.exe, pid: 1032, offset: 0x00000000, length: 0x0011fe00"
- "self_read": "process: Eula.exe, pid: 2712, offset: 0x00000000, length: 0x00000040"
- "self_read": "process: Eula.exe, pid: 2712, offset: 0x00000100, length: 0x00000018"
- "self_read": "process: Eula.exe, pid: 2712, offset: 0x000001f8, length: 0x000000a0"
- "self_read": "process: Eula.exe, pid: 2712, offset: 0x00012600, length: 0x00000010"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x00000000, length: 0x00000040"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x000000f0, length: 0x00000018"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x000001e8, length: 0x00000078"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x00018000, length: 0x00000020"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x00018058, length: 0x00000018"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x000181a8, length: 0x00000018"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x00018470, length: 0x00000010"
- "self_read": "process: wscript.exe, pid: 2772, offset: 0x00018640, length: 0x00000012"
- "self_read": "process: remcos.exe, pid: 2936, offset: 0x00000000, length: 0x0011fe00"
- "self_read": "process: remcos.exe, pid: 2892, offset: 0x00000000, length: 0x0011fe00"
- "Description": "A process created a hidden window",
- "Details":
- "Process": "remcos_3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64.exe -> schtasks"
- "Process": "remcos_agent_Protected.exe -> schtasks"
- "Process": "remcos_agent_Protected.exe -> C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs"
- "Process": "wscript.exe -> cmd"
- "Process": "remcos.exe -> schtasks"
- "Description": "Drops a binary and executes it",
- "Details":
- "binary": "C:\\Users\\user\\AppData\\Roaming\\remcos_agent_Protected.exe"
- "binary": "C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe"
- "Description": "Executed a process and injected code into it, probably while unpacking",
- "Details":
- "Injection": "remcos_agent_Protected.exe(1032) -> remcos_agent_Protected.exe(2140)"
- "Description": "Sniffs keystrokes",
- "Details":
- "SetWindowsHookExA": "Process: remcos.exe(2892)"
- "Description": "A process attempted to delay the analysis task by a long amount of time.",
- "Details":
- "Process": "taskeng.exe tried to sleep 480 seconds, actually delayed analysis time by 0 seconds"
- "Process": "remcos.exe tried to sleep 3124 seconds, actually delayed analysis time by 0 seconds"
- "Description": "A potential decoy document was displayed to the user",
- "Details":
- "disguised_executable": "The submitted file was an executable indicative of an attempt to get a user to run executable content disguised as a document"
- "Decoy Document": "\"c:\\program files (x86)\\adobe\\acrobat reader dc\\reader\\acrord32.exe\" \"c:\\users\\user\\appdata\\local\\temp\\medical-application-form.pdf\""
- "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
- "Details":
- "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
- "Description": "Installs itself for autorun at Windows startup",
- "Details":
- "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\remcos"
- "data": "\"C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe\""
- "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\remcos"
- "data": "\"C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe\""
- "task": "\"C:\\Windows\\SysWOW64\\schtasks.exe\" /create /tn WWAHost /tr \"C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe\" /sc minute /mo 1 /F"
- "Description": "Creates a hidden or system file",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe"
- "file": "C:\\Users\\user\\AppData\\Roaming\\remcos"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat"
- "file": "C:\\Users\\user\\AppData\\Roaming\\remcos\\logs.dat"
- "Description": "File has been identified by 47 Antiviruses on VirusTotal as malicious",
- "Details":
- "MicroWorld-eScan": "Trojan.GenericKD.41548276"
- "CAT-QuickHeal": "PUA.Presenoker.S5304897"
- "McAfee": "Trojan-AitInject.ak"
- "Malwarebytes": "Backdoor.Remcos.AutoIt"
- "CrowdStrike": "win/malicious_confidence_100% (W)"
- "Alibaba": "Backdoor:Win32/Remcos.90bce6ee"
- "K7GW": "Trojan ( 700000111 )"
- "K7AntiVirus": "Trojan ( 700000111 )"
- "Arcabit": "Trojan.Generic.D279F9F4"
- "Invincea": "heuristic"
- "F-Prot": "W32/AutoIt.JD.gen!Eldorado"
- "Symantec": "ML.Attribute.HighConfidence"
- "APEX": "Malicious"
- "ClamAV": "Win.Downloader.LokiBot-6962970-0"
- "Kaspersky": "Backdoor.Win32.Remcos.cxb"
- "BitDefender": "Trojan.GenericKD.41548276"
- "NANO-Antivirus": "Trojan.Win32.Remcos.fqrrmb"
- "Avast": "Win32:Trojan-gen"
- "Ad-Aware": "Trojan.GenericKD.41548276"
- "Sophos": "Troj/AutoIt-CKU"
- "F-Secure": "Dropper.DR/AutoIt.Gen8"
- "DrWeb": "Trojan.Inject3.16009"
- "VIPRE": "Trojan.Win32.Generic!BT"
- "TrendMicro": "Trojan.AutoIt.CRYPTINJECT.SMA"
- "McAfee-GW-Edition": "BehavesLike.Win32.Dropper.vh"
- "FireEye": "Generic.mg.0c3755dfc856fff9"
- "Emsisoft": "Trojan.GenericKD.41548276 (B)"
- "Ikarus": "Trojan.Autoit"
- "Cyren": "W32/AutoIt.JD.gen!Eldorado"
- "Avira": "DR/AutoIt.Gen8"
- "MAX": "malware (ai score=81)"
- "Antiy-AVL": "GrayWare/Autoit.ShellCode.a"
- "Microsoft": "Trojan:Win32/Ditertag.A"
- "Endgame": "malicious (high confidence)"
- "ZoneAlarm": "Backdoor.Win32.Remcos.cxb"
- "GData": "Trojan.GenericKD.41548276"
- "AhnLab-V3": "Win-Trojan/AutoInj.Exp"
- "Acronis": "suspicious"
- "ALYac": "Trojan.GenericKD.41548276"
- "Cylance": "Unsafe"
- "ESET-NOD32": "a variant of Win32/Injector.Autoit.DUR"
- "TrendMicro-HouseCall": "Trojan.AutoIt.CRYPTINJECT.SMA"
- "Fortinet": "AutoIt/Injector.DWD!tr"
- "AVG": "Win32:Trojan-gen"
- "Cybereason": "malicious.fc856f"
- "Panda": "Trj/Genetic.gen"
- "Qihoo-360": "HEUR/QVM41.1.58A7.Malware.Gen"
- "Description": "Attempts to modify browser security settings",
- "Details":
- "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
- "Details":
- "target": "clamav:Win.Downloader.LokiBot-6962970-0, sha256:3eb89add7bf6001fdd50b141228810010fd3c0b94380e27db59894e1b8954c64, type:PE32 executable (GUI) Intel 80386, for MS Windows"
- "dropped": "clamav:Win.Downloader.LokiBot-6962970-0, sha256:99e409f24aefe3413c43eed73890bdc6c74a2df18e77521b9695200be50e4af1 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
- "dropped": "clamav:Win.Malware.Autoit-6985962-0, sha256:472ce643d1faee0ead973e9b2815a89146e9b3828f1831bc47fc34e4357925d8 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\CapabilityAccessHandlers\\sfc.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
- "dropped": "clamav:Win.Malware.Autoit-6985962-0, sha256:7210f2ca290296d1f6e61da4b3192ad19afd719d6cf77dbb2d6810734b349826 , guest_paths:C:\\Users\\user\\AppData\\Roaming\\remcos_agent_Protected.exe*C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
- "Description": "Creates a slightly modified copy of itself",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe"
- "percent_match": 99
- "Description": "Anomalous binary characteristics",
- "Details":
- "anomaly": "Actual checksum does not match that reported in PE header"
- "Description": "Clears web history",
- "Details":
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@www.google1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@doubleclick1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@advertising1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@c.bing2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@media2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google5.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google4.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google3.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@c.msn2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@msn1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@www.msn2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@3lift1.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@bing2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@scorecardresearch2.txt"
- "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@atwola2.txt"
- * Started Service:
- * Mutexes:
- "bderepair",
- "Local\\ZoneAttributeCacheCounterMutex",
- "Local\\ZonesCacheCounterMutex",
- "Local\\ZonesLockedCacheCounterMutex",
- "MDMAppInstaller",
- "Remcos_Mutex_Inj",
- "Remcos-S1KNPZ",
- "Global\\ARM Update Mutex",
- "Global\\Acro Update Mutex",
- "100184D2-BDC3-477a-B8D3-65548B67914C_2480",
- "Global\\100184D2-BDC3-477a-B8D3-65548B67914C_936",
- "com.adobe.acrobat.rna.RdrCefBrowserLock.DC",
- "Local\\WininetStartupMutex",
- "Local\\ZonesCounterMutex",
- "Local\\_!MSFTHISTORY!_",
- "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
- "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
- "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!",
- "Local\\!IETld!Mutex",
- "_!SHMSFTHISTORY!_",
- "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!mshist012019082120190822!",
- "CicLoadWinStaWinSta0",
- "Local\\MSCTF.CtfMonitorInstMutexDefault1",
- "Mutex_RemWatchdog"
- * Modified Files:
- "C:\\Users\\user\\AppData\\Roaming\\remcos_agent_Protected.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\medical-application-form.pdf",
- "C:\\Users\\user\\AppData\\Roaming\\RtDCpl64\\driverquery.exe",
- "C:\\Users\\user\\AppData\\Roaming\\CapabilityAccessHandlers\\sfc.exe",
- "C:\\Users\\user\\AppData\\Roaming\\remcos\\remcos.exe",
- "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Color\\ACECache11.lst",
- "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\UserCache.bin",
- "\\??\\pipe\\com.adobe.reader.rna.user.DC.0",
- "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Reader\\DesktopNotification\\NotificationsDB\\notificationsDB",
- "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\Reader\\DesktopNotification\\NotificationsDB\\notificationsDB-journal",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents",
- "C:\\Users\\user\\AppData\\Local\\Adobe\\Acrobat\\DC\\SharedDataEvents-journal",
- "C:\\Users\\user\\AppData\\LocalLow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal",
- "C:\\Windows\\sysnative\\Tasks\\setx",
- "C:\\Windows\\sysnative\\Tasks\\WWAHost",
- "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
- "\\Device\\LanmanDatagramReceiver",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019082120190822\\index.dat",
- "C:\\Users\\user\\AppData\\Roaming\\remcos\\logs.dat"
- * Deleted Files:
- "C:\\Windows\\Tasks\\setx.job",
- "C:\\Windows\\Tasks\\WWAHost.job",
- "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\index.dat",
- "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019052620190527\\",
- "C:\\Users\\user\\AppData\\Local\\Temp\\install.vbs",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\index.dat",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@3lift1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@advertising1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@atwola2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@bing2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@c.bing2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@c.msn2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@doubleclick1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google3.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google4.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@google5.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@media2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@msn1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@scorecardresearch2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@www.google1.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\user@www.msn2.txt",
- "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies",
- "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies",
- "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
- * Modified Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\remcos",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\remcos",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Acrobat\\DC\\DiskCabs",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC",
- "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\AcrobatDC",
- "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader DC",
- "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader 19_Acrobat19_Reader_19.10.20069",
- "HKEY_LOCAL_MACHINE\\System\\Acrobatbrokerserverdispatchercpp789",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Installer",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Installer\\Migrated",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\UseMUI",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\next",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Language\\current",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Originals",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\ExitSection",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\Acrobat.com",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\Acrobat.com.v2",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVConnector",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVConnector\\cv1",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cTaskPanes",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cTaskPanes\\cBasicCommentPane",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\FTEDialog",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\FlashDebug",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\OnBoardingSection",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\OnBoardingSection\\chomeView",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\SDI",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Selection",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Window",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\Window\\cAVUIPopupList",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\aFS",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\tDIText",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\tFileName",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sFileAncestors",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sDI",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVGeneral\\cRecentFiles\\c1\\sDate",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AVEntitlement",
- "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_BROWSER_EMULATION\\AcroRd32.exe",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Adobe Synchronizer\\DC\\CredentialsV3",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\UsageMeasurement",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\IPM",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B926EF10-D13E-4D81-821D-60510153030F\\Path",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B926EF10-D13E-4D81-821D-60510153030F\\Hash",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\setx\\Id",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\setx\\Index",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B926EF10-D13E-4D81-821D-60510153030F\\Triggers",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B926EF10-D13E-4D81-821D-60510153030F\\DynamicInfo",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A027D22A-0941-4A3D-8BCD-DE460257E5C4\\Path",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A027D22A-0941-4A3D-8BCD-DE460257E5C4\\Hash",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\WWAHost\\Id",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\WWAHost\\Index",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A027D22A-0941-4A3D-8BCD-DE460257E5C4\\Triggers",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A027D22A-0941-4A3D-8BCD-DE460257E5C4\\DynamicInfo",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05\\DynamicInfo",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\06027CFB-0B68-4E4C-BEA4-8559A6F9E1BF",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B17E070E-57E3-43F6-96F5-A9A9C921DEBF\\DynamicInfo",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\69E21F04-938C-46A8-B4AD-6FCB4F20E4CC",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DF000DCA-3FA2-48A6-9E59-C0606F9F8D73\\DynamicInfo",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\E80BCF90-2770-40E3-A64D-3E6331A4BEE3",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ADBB9E87-285F-47FB-9A76-77BB6D9513A9",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822\\CachePath",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822\\CachePrefix",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822\\CacheLimit",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822\\CacheOptions",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache\\MSHist012019082120190822\\CacheRepair",
- "HKEY_LOCAL_MACHINE\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Adobe\\Acrobat Reader\\DC\\AdobeViewer\\EULA",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer",
- "HKEY_CURRENT_USER\\Software\\Adobe\\Acrobat Reader\\DC\\AdobeViewer\\EULA",
- "HKEY_CURRENT_USER\\Software\\Remcos-S1KNPZ\\",
- "HKEY_CURRENT_USER\\Software\\Remcos-S1KNPZ\\exepath",
- "HKEY_CURRENT_USER\\Software\\Remcos-S1KNPZ\\licence",
- "HKEY_CURRENT_USER\\Software\\Remcos-S1KNPZ\\WD",
- "HKEY_CURRENT_USER\\Software\\Remcos-S1KNPZ\\FR",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\06027CFB-0B68-4E4C-BEA4-8559A6F9E1BF\\data",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\69E21F04-938C-46A8-B4AD-6FCB4F20E4CC\\data",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\E80BCF90-2770-40E3-A64D-3E6331A4BEE3\\data",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\ADBB9E87-285F-47FB-9A76-77BB6D9513A9\\data"
- * Deleted Registry Keys:
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
- "HKEY_CURRENT_USER\\Software\\Adobe\\CommonFiles\\Usage\\Reader DC\\OptIn",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\setx.job",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\setx.job.fp",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\WWAHost.job",
- "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\WWAHost.job.fp",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFavoritesInitialSelection",
- "HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\AddToFeedsInitialSelection"
- * DNS Communications:
- "type": "A",
- "request": "daya4659.ddns.net",
- "answers":
- * Domains:
- "ip": "",
- "domain": "daya4659.ddns.net"
- * Network Communication - ICMP:
- * Network Communication - HTTP:
- * Network Communication - SMTP:
- * Network Communication - Hosts:
- * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement