API tools faq
paste
paladin316

file_1_2019-08-10_19_30.txt

paladin316
Aug 10th, 2019
2,124
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.70 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "file.1"
  7. * File Size: 552960
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "be29d5305364eecf747e934e343a6793b66d9e319f48040c285ff877ac172b45"
  10. * MD5: "f999a1c45e8564fa08fbd036ba8adbf6"
  11. * SHA1: "56c9be7796c7e3fad44ed1f098161cf5e6f97af0"
  12. * SHA512: "6ae3546713f26389e0c56737afef9fd0ac071cc70fd1b33b1fe695f075869282d9f406765431a37013b13f1fe191e1ebd56aacd4395a4b4528c10cad7888337a"
  13. * CRC32: "9E1B63C8"
  14. * SSDEEP: "12288:qB147SsqUh/SwkpF3hDAxqF25BaxpswTs+7OO3j4f81MTgWi2DNykf01NRJdNarM:qBRsqUh/SwkpF3hDAxqF25BaxpswTs+d"
  15.  
  16. * Process Execution:
  17. "file.1",
  18. "cmd.exe",
  19. "sc.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "powershell.exe",
  24. "cmd.exe",
  25. "powershell.exe",
  26. "cmd.exe",
  27. "powershell.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "cmd.exe",
  31. "powershell.exe",
  32. "cmd.exe",
  33. "powershell.exe",
  34. "cmd.exe",
  35. "powershell.exe",
  36. "cmd.exe",
  37. "powershell.exe",
  38. "cmd.exe",
  39. "powershell.exe",
  40. "cmd.exe",
  41. "powershell.exe",
  42. "fine.exe",
  43. "cmd.exe",
  44. "sc.exe",
  45. "cmd.exe",
  46. "sc.exe",
  47. "cmd.exe",
  48. "powershell.exe",
  49. "cmd.exe",
  50. "powershell.exe",
  51. "cmd.exe",
  52. "powershell.exe",
  53. "cmd.exe",
  54. "powershell.exe",
  55. "cmd.exe",
  56. "powershell.exe",
  57. "cmd.exe",
  58. "powershell.exe",
  59. "cmd.exe",
  60. "powershell.exe",
  61. "cmd.exe",
  62. "powershell.exe",
  63. "cmd.exe",
  64. "powershell.exe",
  65. "cmd.exe",
  66. "powershell.exe",
  67. "svchost.exe",
  68. "svchost.exe"
  69.  
  70.  
  71. * Executed Commands:
  72. "cmd.exe /c sc stop WinDefend",
  73. "cmd.exe /c sc delete WinDefend",
  74. "cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  75. "cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  76. "cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  77. "cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true",
  78. "cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true",
  79. "cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  80. "cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6",
  81. "cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6",
  82. "cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  83. "cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true",
  84. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\fine.exe",
  85. "sc stop WinDefend",
  86. "sc delete WinDefend",
  87. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  88. "powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  89. "powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  90. "powershell Set-MpPreference -DisableIOAVProtection $true",
  91. "powershell Set-MpPreference -DisablePrivacyMode $true",
  92. "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  93. "powershell Set-MpPreference -SevereThreatDefaultAction 6",
  94. "powershell Set-MpPreference -LowThreatDefaultAction 6",
  95. "powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  96. "powershell Set-MpPreference -DisableScriptScanning $true",
  97. "C:\\Windows\\system32\\svchost.exe"
  98.  
  99.  
  100. * Signatures Detected:
  101.  
  102. "Description": "Creates RWX memory",
  103. "Details":
  104.  
  105.  
  106. "Description": "Possible date expiration check, exits too soon after checking local time",
  107. "Details":
  108.  
  109. "process": "cmd.exe, PID 2552"
  110.  
  111.  
  112.  
  113.  
  114. "Description": "A process created a hidden window",
  115. "Details":
  116.  
  117. "Process": "file.1 -> cmd.exe"
  118.  
  119.  
  120. "Process": "file.1 -> cmd.exe"
  121.  
  122.  
  123. "Process": "file.1 -> cmd.exe"
  124.  
  125.  
  126. "Process": "file.1 -> cmd.exe"
  127.  
  128.  
  129. "Process": "file.1 -> cmd.exe"
  130.  
  131.  
  132. "Process": "file.1 -> cmd.exe"
  133.  
  134.  
  135. "Process": "file.1 -> cmd.exe"
  136.  
  137.  
  138. "Process": "file.1 -> cmd.exe"
  139.  
  140.  
  141. "Process": "file.1 -> cmd.exe"
  142.  
  143.  
  144. "Process": "file.1 -> cmd.exe"
  145.  
  146.  
  147. "Process": "file.1 -> cmd.exe"
  148.  
  149.  
  150. "Process": "file.1 -> cmd.exe"
  151.  
  152.  
  153. "Process": "fine.exe -> cmd.exe"
  154.  
  155.  
  156. "Process": "fine.exe -> cmd.exe"
  157.  
  158.  
  159. "Process": "fine.exe -> cmd.exe"
  160.  
  161.  
  162. "Process": "fine.exe -> cmd.exe"
  163.  
  164.  
  165. "Process": "fine.exe -> cmd.exe"
  166.  
  167.  
  168. "Process": "fine.exe -> cmd.exe"
  169.  
  170.  
  171. "Process": "fine.exe -> cmd.exe"
  172.  
  173.  
  174. "Process": "fine.exe -> cmd.exe"
  175.  
  176.  
  177. "Process": "fine.exe -> cmd.exe"
  178.  
  179.  
  180. "Process": "fine.exe -> cmd.exe"
  181.  
  182.  
  183. "Process": "fine.exe -> cmd.exe"
  184.  
  185.  
  186. "Process": "fine.exe -> cmd.exe"
  187.  
  188.  
  189.  
  190.  
  191. "Description": "Drops a binary and executes it",
  192. "Details":
  193.  
  194. "binary": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\fine.exe"
  195.  
  196.  
  197.  
  198.  
  199. "Description": "The binary likely contains encrypted or compressed data.",
  200. "Details":
  201.  
  202. "section": "name: .rsrc, entropy: 7.98, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0002b000, virtual_size: 0x0002abf0"
  203.  
  204.  
  205.  
  206.  
  207. "Description": "Attempts to stop active services",
  208. "Details":
  209.  
  210. "servicename": "WinDefend"
  211.  
  212.  
  213.  
  214.  
  215. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  216. "Details":
  217.  
  218. "Spam": "fine.exe (2976) called API GetSystemTimeAsFileTime 257980 times"
  219.  
  220.  
  221. "Spam": "file.1 (3036) called API GetSystemTimeAsFileTime 257980 times"
  222.  
  223.  
  224.  
  225.  
  226. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  227. "Details":
  228.  
  229. "modified_name": "svchost.exe",
  230. "modified_path": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\fine.exe",
  231. "original_name": "svchost.exe",
  232. "original_path": "C:\\Windows\\system32\\svchost.exe"
  233.  
  234.  
  235.  
  236.  
  237. "Description": "Creates a hidden or system file",
  238. "Details":
  239.  
  240. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb18782.TMP"
  241.  
  242.  
  243. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1830d.TMP"
  244.  
  245.  
  246. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13626.TMP"
  247.  
  248.  
  249. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13868.TMP"
  250.  
  251.  
  252. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb139fe.TMP"
  253.  
  254.  
  255. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1950f.TMP"
  256.  
  257.  
  258. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb142a9.TMP"
  259.  
  260.  
  261. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb14818.TMP"
  262.  
  263.  
  264. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb148e3.TMP"
  265.  
  266.  
  267. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb19f6f.TMP"
  268.  
  269.  
  270. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16024.TMP"
  271.  
  272.  
  273. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1b43f.TMP"
  274.  
  275.  
  276. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16593.TMP"
  277.  
  278.  
  279. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bb83.TMP"
  280.  
  281.  
  282. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bece.TMP"
  283.  
  284.  
  285. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c353.TMP"
  286.  
  287.  
  288. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17254.TMP"
  289.  
  290.  
  291. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c92f.TMP"
  292.  
  293.  
  294. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17b6c.TMP"
  295.  
  296.  
  297. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1d033.TMP"
  298.  
  299.  
  300.  
  301.  
  302. "Description": "File has been identified by 13 Antiviruses on VirusTotal as malicious",
  303. "Details":
  304.  
  305. "Cybereason": "malicious.796c7e"
  306.  
  307.  
  308. "Symantec": "ML.Attribute.HighConfidence"
  309.  
  310.  
  311. "APEX": "Malicious"
  312.  
  313.  
  314. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  315.  
  316.  
  317. "Invincea": "heuristic"
  318.  
  319.  
  320. "FireEye": "Generic.mg.f999a1c45e8564fa"
  321.  
  322.  
  323. "SentinelOne": "DFI - Malicious PE"
  324.  
  325.  
  326. "Webroot": "W32.Malware.gen"
  327.  
  328.  
  329. "Endgame": "malicious (high confidence)"
  330.  
  331.  
  332. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  333.  
  334.  
  335. "Acronis": "suspicious"
  336.  
  337.  
  338. "Qihoo-360": "HEUR/QVM03.0.17D1.Malware.Gen"
  339.  
  340.  
  341. "CrowdStrike": "win/malicious_confidence_100% (D)"
  342.  
  343.  
  344.  
  345.  
  346. "Description": "Creates a copy of itself",
  347. "Details":
  348.  
  349. "copy": "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\fine.exe"
  350.  
  351.  
  352.  
  353.  
  354. "Description": "Attempts to disable Windows Defender",
  355. "Details":
  356.  
  357.  
  358. "Description": "Anomalous binary characteristics",
  359. "Details":
  360.  
  361. "anomaly": "Actual checksum does not match that reported in PE header"
  362.  
  363.  
  364.  
  365.  
  366.  
  367. * Started Service:
  368.  
  369. * Mutexes:
  370. "Global\\CLR_CASOFF_MUTEX",
  371. "Global\\838B6C9EB27932960"
  372.  
  373.  
  374. * Modified Files:
  375. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB1DD9FF93FC32B9A.TMP",
  376. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\fine.exe",
  377. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  378. "\\??\\PIPE\\srvsvc",
  379. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\HQDU0FITD4PRAHGGQNFJ.temp",
  380. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb18782.TMP",
  381. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\V8PQ601UROADWUDFF939.temp",
  382. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1830d.TMP",
  383. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\GQRUT5FLAAJGB825FX13.temp",
  384. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13626.TMP",
  385. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\U56N0Z6MROFTOTDEELKC.temp",
  386. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13868.TMP",
  387. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1SKM4O95BN2GHSK757WI.temp",
  388. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb139fe.TMP",
  389. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\S4FSZGJV1EZZYM7WGARO.temp",
  390. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1950f.TMP",
  391. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LA10PO1MHJ78PE4EQDVA.temp",
  392. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb142a9.TMP",
  393. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\9PGT9D8OCTP0A0E53VQ3.temp",
  394. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb14818.TMP",
  395. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA1262CB81926396B.TMP",
  396. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DGTMOSBZJWXTKL2HDBWV.temp",
  397. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb148e3.TMP",
  398. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VVIM7V8WKMYWWXWM4RTK.temp",
  399. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb19f6f.TMP",
  400. "C:\\Users\\user\\AppData\\Roaming\\DllSysLib\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  401. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\77U2LF2SSU0N66IIAO66.temp",
  402. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16024.TMP",
  403. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\62YUMTLNKJBK5D8C4XFT.temp",
  404. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1b43f.TMP",
  405. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\MFQ8AD82OJV2LA6LCO7D.temp",
  406. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16593.TMP",
  407. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\2L91EF0FBLEAUKIUKPM3.temp",
  408. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bb83.TMP",
  409. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CCGBJ1NZSQUVG5V69PZX.temp",
  410. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bece.TMP",
  411. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\QVWLLXKVIBLOF3QSLJWQ.temp",
  412. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c353.TMP",
  413. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Z1C228ZO079RJVK2EZP2.temp",
  414. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17254.TMP",
  415. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L9OR93KZDKGCK2QEYNNZ.temp",
  416. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c92f.TMP",
  417. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DR1FZDRXBN7KZR6I7VJK.temp",
  418. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17b6c.TMP",
  419. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\LDVF3E7PTS82Z8QM7FQL.temp",
  420. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1d033.TMP",
  421. "C:\\Windows\\sysnative\\Tasks\\Ms Dll libraries"
  422.  
  423.  
  424. * Deleted Files:
  425. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB1DD9FF93FC32B9A.TMP",
  426. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb18782.TMP",
  427. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2156.11634625",
  428. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2156.11634625",
  429. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2156.11634625",
  430. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1830d.TMP",
  431. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2852.11633500",
  432. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2852.11633500",
  433. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2852.11633500",
  434. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13626.TMP",
  435. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2880.11615203",
  436. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2880.11615203",
  437. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2880.11615218",
  438. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb13868.TMP",
  439. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2412.11616031",
  440. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2412.11616046",
  441. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2412.11616046",
  442. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb139fe.TMP",
  443. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.576.11617328",
  444. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.576.11617328",
  445. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.576.11617328",
  446. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1950f.TMP",
  447. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2620.11638312",
  448. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2620.11638312",
  449. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2620.11638312",
  450. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb142a9.TMP",
  451. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2860.11619343",
  452. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2860.11619343",
  453. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2860.11619359",
  454. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb14818.TMP",
  455. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2432.11620359",
  456. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2432.11620359",
  457. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2432.11620359",
  458. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFA1262CB81926396B.TMP",
  459. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb148e3.TMP",
  460. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2596.11620500",
  461. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2596.11620515",
  462. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2596.11620515",
  463. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb19f6f.TMP",
  464. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3224.11641015",
  465. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3224.11641015",
  466. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3224.11641015",
  467. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16024.TMP",
  468. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1056.11624781",
  469. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1056.11624781",
  470. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1056.11624781",
  471. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1b43f.TMP",
  472. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.788.11646171",
  473. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.788.11646171",
  474. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.788.11646171",
  475. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb16593.TMP",
  476. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3004.11626890",
  477. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3004.11626890",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3004.11626906",
  479. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bb83.TMP",
  480. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2380.11647953",
  481. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2380.11647953",
  482. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2380.11647953",
  483. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1bece.TMP",
  484. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3556.11648828",
  485. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3556.11648843",
  486. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3556.11648843",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c353.TMP",
  488. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.316.11649984",
  489. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.316.11650000",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.316.11650000",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17254.TMP",
  492. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3084.11630718",
  493. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3084.11630718",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3084.11630718",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1c92f.TMP",
  496. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1520.11651484",
  497. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1520.11651484",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1520.11651484",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb17b6c.TMP",
  500. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2208.11633203",
  501. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2208.11633218",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2208.11633218",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFb1d033.TMP",
  504. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.372.11653265",
  505. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.372.11653265",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.372.11653265",
  507. "C:\\Windows\\Tasks\\Ms Dll libraries.job"
  508.  
  509.  
  510. * Modified Registry Keys:
  511. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  512. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  513. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  514. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  515. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  516. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable",
  517. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  518. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  519. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Path",
  520. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Hash",
  521. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Id",
  522. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Index",
  523. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\Triggers",
  524. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\FD45961A-5F1B-458B-B481-533498CAD7C6\\DynamicInfo"
  525.  
  526.  
  527. * Deleted Registry Keys:
  528. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job",
  529. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job.fp"
  530.  
  531.  
  532. * DNS Communications:
  533.  
  534. * Domains:
  535.  
  536. * Network Communication - ICMP:
  537.  
  538. * Network Communication - HTTP:
  539.  
  540. * Network Communication - SMTP:
  541.  
  542. * Network Communication - Hosts:
  543.  
  544. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!