API tools faq
paste
paladin316

HawkEye_befb13a4515ee53dfc060af8639c0521_exe_2019-07-05_20_30.txt

paladin316
Jul 7th, 2019
2,213
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.78 KB | None | 0 0
raw download clone embed print report
  1. * MalFamily: "Malicious"
  2.  
  3. * MalScore: 10.0
  4.  
  5. * File Name: "HawkEye_befb13a4515ee53dfc060af8639c0521.exe"
  6. * File Size: 1358848
  7. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  8. * SHA256: "aa160d4c110a7c51db770464ab28dfc4e34499da604905fe8fd47192f2528666"
  9. * MD5: "befb13a4515ee53dfc060af8639c0521"
  10. * SHA1: "5ac4f2631bff446589f492ccb1a3e444f37778e1"
  11. * SHA512: "a7375113623025bdc0f398468d0988b88d7d6b27d9933705da6850178187dd3df6b50242ebf501f9793e4a9a52c9782bf4c8da59fa6fc400710198c161d5c750"
  12. * CRC32: "B46768C2"
  13. * SSDEEP: "24576:2AHnh+eWsN3skA4RV1Hom2KXSmdaYXqjbXuQtV5EFkKbyw7AxuhG2KBtqhErdo5:Rh+ZkldoPKi2aYXqjRKkiXmuhG2KBtQB"
  14.  
  15. * Process Execution:
  16. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  17. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  18. "iexplore.exe",
  19. "iexplore.exe",
  20. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  21. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  22. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  23. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  24. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  25. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  26. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  27. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  28. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  29. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  30. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  31. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  32. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  33. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  34. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  35. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  36. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  37. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  38. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  39. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  40. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  41. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  42. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  43. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  44. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  45. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  46. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  47. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  48. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  49. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  50. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  51. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  52. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  53. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  54. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  55. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  56. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  57. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  58. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  59. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  60. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  61. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  62. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  63. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  64. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  65. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  66. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  67. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  68. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  69. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  70. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  71. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  72. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  73. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  74. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  75. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  76. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  77. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  78. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  79. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  80. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  81. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  82. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  83. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  84. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  85. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  86. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  87. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  88. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  89. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  90. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  91. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  92. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  93. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe",
  94. "HawkEye_befb13a4515ee53dfc060af8639c0521.exe"
  95.  
  96.  
  97. * Executed Commands:
  98. "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe C:\\Users\\user\\AppData\\Local\\Temp\\HawkEye_befb13a4515ee53dfc060af8639c0521.exe"
  99.  
  100.  
  101. * Signatures Detected:
  102.  
  103. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  104. "Details":
  105.  
  106. "IP": "91.193.75.252:119"
  107.  
  108.  
  109.  
  110.  
  111. "Description": "Creates RWX memory",
  112. "Details":
  113.  
  114.  
  115. "Description": "Possible date expiration check, exits too soon after checking local time",
  116. "Details":
  117.  
  118. "process": "HawkEye_befb13a4515ee53dfc060af8639c0521.exe, PID 2264"
  119.  
  120.  
  121.  
  122.  
  123. "Description": "Expresses interest in specific running processes",
  124. "Details":
  125.  
  126. "process": "HawkEye_befb13a4515ee53dfc060af8639c0521.exe"
  127.  
  128.  
  129.  
  130.  
  131. "Description": "Reads data out of its own binary image",
  132. "Details":
  133.  
  134. "self_read": "process: HawkEye_befb13a4515ee53dfc060af8639c0521.exe, pid: 2556, offset: 0x00000000, length: 0x0014bc00"
  135.  
  136.  
  137.  
  138.  
  139. "Description": "The binary likely contains encrypted or compressed data.",
  140. "Details":
  141.  
  142. "section": "name: .rsrc, entropy: 7.93, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x00081600, virtual_size: 0x0008157c"
  143.  
  144.  
  145.  
  146.  
  147. "Description": "Executed a process and injected code into it, probably while unpacking",
  148. "Details":
  149.  
  150. "Injection": "HawkEye_befb13a4515ee53dfc060af8639c0521.exe(2556) -> HawkEye_befb13a4515ee53dfc060af8639c0521.exe(2264)"
  151.  
  152.  
  153.  
  154.  
  155. "Description": "Installs itself for autorun at Windows startup",
  156. "Details":
  157.  
  158. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\lFqtZodlHg"
  159.  
  160.  
  161. "data": "C:\\Users\\Public\\lFqtZodlHg.vbs"
  162.  
  163.  
  164.  
  165.  
  166. "Description": "File has been identified by 31 Antiviruses on VirusTotal as malicious",
  167. "Details":
  168.  
  169. "MicroWorld-eScan": "AIT.Injector.2.Gen"
  170.  
  171.  
  172. "FireEye": "Generic.mg.befb13a4515ee53d"
  173.  
  174.  
  175. "McAfee": "Artemis!BEFB13A4515E"
  176.  
  177.  
  178. "Cylance": "Unsafe"
  179.  
  180.  
  181. "CrowdStrike": "win/malicious_confidence_90% (W)"
  182.  
  183.  
  184. "Cyren": "W32/AutoIt.IJ.gen!Eldorado"
  185.  
  186.  
  187. "Symantec": "ML.Attribute.HighConfidence"
  188.  
  189.  
  190. "ESET-NOD32": "a variant of Win32/Injector.Autoit.ECO"
  191.  
  192.  
  193. "APEX": "Malicious"
  194.  
  195.  
  196. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  197.  
  198.  
  199. "BitDefender": "AIT.Injector.2.Gen"
  200.  
  201.  
  202. "Paloalto": "generic.ml"
  203.  
  204.  
  205. "Endgame": "malicious (high confidence)"
  206.  
  207.  
  208. "Emsisoft": "AIT.Injector.2.Gen (B)"
  209.  
  210.  
  211. "Invincea": "heuristic"
  212.  
  213.  
  214. "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.tc"
  215.  
  216.  
  217. "Trapmine": "malicious.high.ml.score"
  218.  
  219.  
  220. "F-Prot": "W32/AutoIt.IJ.gen!Eldorado"
  221.  
  222.  
  223. "Antiy-AVL": "Trojan/Generic.ASVCS3S.1E5"
  224.  
  225.  
  226. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  227.  
  228.  
  229. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  230.  
  231.  
  232. "GData": "AIT.Injector.2.Gen (2x)"
  233.  
  234.  
  235. "Acronis": "suspicious"
  236.  
  237.  
  238. "ALYac": "AIT.Injector.2.Gen"
  239.  
  240.  
  241. "MAX": "malware (ai score=87)"
  242.  
  243.  
  244. "Ad-Aware": "AIT.Injector.2.Gen"
  245.  
  246.  
  247. "TrendMicro-HouseCall": "Trojan.Win32.CRYPTINJECT.SMA"
  248.  
  249.  
  250. "Rising": "Trojan.Win32.Agent_.sa (CLASSIC)"
  251.  
  252.  
  253. "SentinelOne": "DFI - Suspicious PE"
  254.  
  255.  
  256. "Cybereason": "malicious.31bff4"
  257.  
  258.  
  259. "Qihoo-360": "HEUR/QVM10.1.515B.Malware.Gen"
  260.  
  261.  
  262.  
  263.  
  264. "Description": "Attempts to disable UAC",
  265. "Details":
  266.  
  267.  
  268. "Description": "Attempts to modify or disable Security Center warnings",
  269. "Details":
  270.  
  271.  
  272. "Description": "Creates a slightly modified copy of itself",
  273. "Details":
  274.  
  275. "file": "C:\\Users\\user\\AppData\\Roaming\\aadcloudap\\lpkinstall.bat"
  276.  
  277.  
  278. "percent_match": 100
  279.  
  280.  
  281.  
  282.  
  283. "Description": "Anomalous binary characteristics",
  284. "Details":
  285.  
  286. "anomaly": "Actual checksum does not match that reported in PE header"
  287.  
  288.  
  289.  
  290.  
  291.  
  292. * Started Service:
  293.  
  294. * Mutexes:
  295. "V550S6E3-T1K8-U8Y6-A6Q4-I8W7P5Y1L7M6"
  296.  
  297.  
  298. * Modified Files:
  299. "C:\\Users\\user\\AppData\\Roaming\\aadcloudap\\lpkinstall.bat",
  300. "C:\\Users\\Public\\lFqtZodlHg.vbs",
  301. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF995C8356873DEEE2.TMP",
  302. "\\??\\PIPE\\samr",
  303. "C:\\Users\\user\\AppData\\Local\\Temp\\user.bmp",
  304. "C:\\Users\\user\\AppData\\Local\\Temp\\ut",
  305. "C:\\Users\\user\\AppData\\Local\\Temp\\V550S6E3-T1K8-U8Y6-A6Q4-I8W7P5Y1L7M6",
  306. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF46855EFB63108424.TMP",
  307. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0DE9EA0D972937E5.TMP",
  308. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1552E76F96784B7C.TMP",
  309. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2AD715D91956748D.TMP",
  310. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF167BD6F7634EC46.TMP",
  311. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF118406C544802A08.TMP",
  312. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF73C8D9ADC84076F4.TMP",
  313. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAE0B799EA4727AF7.TMP",
  314. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB15D342615F8DDF3.TMP",
  315. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF232D87247D375846.TMP",
  316. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC9BA105F0673F326.TMP",
  317. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE37E67D581BA7076.TMP",
  318. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC3B8C68A77F5E91E.TMP",
  319. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAD66FFE1D8EF58A8.TMP",
  320. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF28FCE2D471B7C330.TMP",
  321. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA76C9DA5E3B51C31.TMP",
  322. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6622661E8533AD98.TMP",
  323. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9BA769493478E5C7.TMP",
  324. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8136CC2545195873.TMP",
  325. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE28B491BEFA71110.TMP",
  326. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBEDEEA234408D4CD.TMP",
  327. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD9BA860DBB5F5264.TMP",
  328. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5891246E2D45EFE1.TMP",
  329. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFB76CAC0D3237AFD.TMP",
  330. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8B07CF043271358B.TMP",
  331. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF90C4481ECB6A8189.TMP",
  332. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF63BA05D5BF527393.TMP",
  333. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF201E6EA7B5309C00.TMP",
  334. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9BC237FB3C1D378B.TMP",
  335. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF15CD786740FF4C94.TMP",
  336. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8CB8CFC6086496C7.TMP",
  337. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFF5571FFE5EF9953.TMP",
  338. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF961F8C090D495526.TMP",
  339. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF3EBBB0C9A13E5BE2.TMP",
  340. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7F1FD408670AA5DB.TMP",
  341. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF43ABD6F28789ABA8.TMP",
  342. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF21E54126F2676D07.TMP",
  343. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF883F14FD5C449580.TMP",
  344. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF40889E87D4455743.TMP",
  345. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF812A2774786EE766.TMP",
  346. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4D3CFB86323C1625.TMP",
  347. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF891E03AF2687593F.TMP",
  348. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8420E83491C5E718.TMP",
  349. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6ECDB54AAFD46DF5.TMP",
  350. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAC16B27649AAA584.TMP",
  351. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE3F3C8ACAEF47DA7.TMP",
  352. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0FCEE69FD5CDF0B4.TMP",
  353. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFCBE34B672103F66.TMP",
  354. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7F98BE1C20C2F69B.TMP",
  355. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2D143513CBD89064.TMP",
  356. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0739C058EDDCADA5.TMP",
  357. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD858B6EA3D546AB2.TMP",
  358. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF43C8E96A94B41853.TMP",
  359. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6D6469C513BA29CC.TMP",
  360. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC1671B35990050B0.TMP",
  361. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1C096CCA98480D71.TMP",
  362. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8F6B48EE64872F5C.TMP",
  363. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF825068BB30971354.TMP",
  364. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF431A53B15658A054.TMP",
  365. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE64B251B0088A88D.TMP",
  366. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFEB5DB94C72729F17.TMP",
  367. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8E3BC18B11BC7FA0.TMP",
  368. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9D8D9A66E43781F1.TMP",
  369. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF91BD81C7CA01AA16.TMP",
  370. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF06A901A92E116720.TMP",
  371. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF817406871E1C2668.TMP",
  372. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF2C4171954E6D2D4.TMP",
  373. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF28F66D199BF00383.TMP",
  374. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF908D5553FFB6AEC1.TMP",
  375. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE536ACB615EBF0E4.TMP",
  376. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF564C915178725E12.TMP",
  377. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0517FE364370453A.TMP",
  378. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF544770D062EE1883.TMP",
  379. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF25E53ADC3B4E9375.TMP",
  380. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF83C9E0F52C255D6D.TMP"
  381.  
  382.  
  383. * Deleted Files:
  384. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF995C8356873DEEE2.TMP",
  385. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF46855EFB63108424.TMP",
  386. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0DE9EA0D972937E5.TMP",
  387. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1552E76F96784B7C.TMP",
  388. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2AD715D91956748D.TMP",
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF167BD6F7634EC46.TMP",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF118406C544802A08.TMP",
  391. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF73C8D9ADC84076F4.TMP",
  392. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAE0B799EA4727AF7.TMP",
  393. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB15D342615F8DDF3.TMP",
  394. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF232D87247D375846.TMP",
  395. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC9BA105F0673F326.TMP",
  396. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE37E67D581BA7076.TMP",
  397. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC3B8C68A77F5E91E.TMP",
  398. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAD66FFE1D8EF58A8.TMP",
  399. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF28FCE2D471B7C330.TMP",
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA76C9DA5E3B51C31.TMP",
  401. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6622661E8533AD98.TMP",
  402. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9BA769493478E5C7.TMP",
  403. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8136CC2545195873.TMP",
  404. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE28B491BEFA71110.TMP",
  405. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFBEDEEA234408D4CD.TMP",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD9BA860DBB5F5264.TMP",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF5891246E2D45EFE1.TMP",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFB76CAC0D3237AFD.TMP",
  409. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8B07CF043271358B.TMP",
  410. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF90C4481ECB6A8189.TMP",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF63BA05D5BF527393.TMP",
  412. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF201E6EA7B5309C00.TMP",
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9BC237FB3C1D378B.TMP",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF15CD786740FF4C94.TMP",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8CB8CFC6086496C7.TMP",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFF5571FFE5EF9953.TMP",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF961F8C090D495526.TMP",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF3EBBB0C9A13E5BE2.TMP",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7F1FD408670AA5DB.TMP",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF43ABD6F28789ABA8.TMP",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF21E54126F2676D07.TMP",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF883F14FD5C449580.TMP",
  423. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF40889E87D4455743.TMP",
  424. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF812A2774786EE766.TMP",
  425. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF4D3CFB86323C1625.TMP",
  426. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF891E03AF2687593F.TMP",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8420E83491C5E718.TMP",
  428. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6ECDB54AAFD46DF5.TMP",
  429. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFAC16B27649AAA584.TMP",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE3F3C8ACAEF47DA7.TMP",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0FCEE69FD5CDF0B4.TMP",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFFCBE34B672103F66.TMP",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF7F98BE1C20C2F69B.TMP",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF2D143513CBD89064.TMP",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0739C058EDDCADA5.TMP",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFD858B6EA3D546AB2.TMP",
  437. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF43C8E96A94B41853.TMP",
  438. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF6D6469C513BA29CC.TMP",
  439. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFC1671B35990050B0.TMP",
  440. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF1C096CCA98480D71.TMP",
  441. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8F6B48EE64872F5C.TMP",
  442. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF825068BB30971354.TMP",
  443. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF431A53B15658A054.TMP",
  444. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE64B251B0088A88D.TMP",
  445. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFEB5DB94C72729F17.TMP",
  446. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF8E3BC18B11BC7FA0.TMP",
  447. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF9D8D9A66E43781F1.TMP",
  448. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF91BD81C7CA01AA16.TMP",
  449. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF06A901A92E116720.TMP",
  450. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF817406871E1C2668.TMP",
  451. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFF2C4171954E6D2D4.TMP",
  452. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF28F66D199BF00383.TMP",
  453. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF908D5553FFB6AEC1.TMP",
  454. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFE536ACB615EBF0E4.TMP",
  455. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF564C915178725E12.TMP",
  456. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF0517FE364370453A.TMP",
  457. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF544770D062EE1883.TMP",
  458. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF25E53ADC3B4E9375.TMP",
  459. "C:\\Users\\user\\AppData\\Local\\Temp\\~DF83C9E0F52C255D6D.TMP"
  460.  
  461.  
  462. * Modified Registry Keys:
  463. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\lFqtZodlHg",
  464. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Security Center\\UACDisableNotify",
  465. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA",
  466. "HKEY_CURRENT_USER\\Software\\Microsoft\\Visual Basic\\6.0"
  467.  
  468.  
  469. * Deleted Registry Keys:
  470.  
  471. * DNS Communications:
  472.  
  473. * Domains:
  474.  
  475. * Network Communication - ICMP:
  476.  
  477. * Network Communication - HTTP:
  478.  
  479. * Network Communication - SMTP:
  480.  
  481. * Network Communication - Hosts:
  482.  
  483. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!