API tools faq
paste
paladin316

Exes_c11de7e5bfe3e6075522800ec0f23919_exe_2019-08-08_14_30.txt

paladin316
Aug 8th, 2019
2,166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 22.34 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: ""
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_c11de7e5bfe3e6075522800ec0f23919.exe"
  7. * File Size: 945817
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "f80acc2bd1e7e87cde554786185dfd9f553465bb24b98bd484517e82613298c2"
  10. * MD5: "c11de7e5bfe3e6075522800ec0f23919"
  11. * SHA1: "36f7ff5505f2bf870870997d8780d7a4f9bd345a"
  12. * SHA512: "c4f4b4a789620d77956217b17fa00b4fe5fb826fa6259d3bf3a866a6b7ccd4afa3d63997f984437658d6b3303547bac43278035d8c310993c52951c8c64004ee"
  13. * CRC32: "F09F059E"
  14. * SSDEEP: "24576:8NA3R5drXVuJ4jEakB+vQ4YlNeDbeiRpoLDKHNiTIaIM:95V64A3Bo4URpoqtdaIM"
  15.  
  16. * Process Execution:
  17. "Exes_c11de7e5bfe3e6075522800ec0f23919.exe",
  18. "wscript.exe",
  19. "vmo.exe",
  20. "RegSvcs.exe",
  21. "powershell.exe"
  22.  
  23.  
  24. * Executed Commands:
  25. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\dcw.vbs\"",
  26. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\dcw.vbs ",
  27. "\"C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vmo.exe\" fxx=cgd",
  28. "vmo.exe fxx=cgd",
  29. "powershell Add-MpPreference -ExclusionPath C:\\"
  30.  
  31.  
  32. * Signatures Detected:
  33.  
  34. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  35. "Details":
  36.  
  37. "IP": "185.234.216.191:2189"
  38.  
  39.  
  40.  
  41.  
  42. "Description": "Creates RWX memory",
  43. "Details":
  44.  
  45.  
  46. "Description": "Detected script timer window indicative of sleep style evasion",
  47. "Details":
  48.  
  49. "Window": "WSH-Timer"
  50.  
  51.  
  52.  
  53.  
  54. "Description": "Reads data out of its own binary image",
  55. "Details":
  56.  
  57. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00000000, length: 0x00000007"
  58.  
  59.  
  60. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00000000, length: 0x00002000"
  61.  
  62.  
  63. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00000007, length: 0x000e6e92"
  64.  
  65.  
  66. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00001ff0, length: 0x00002000"
  67.  
  68.  
  69. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00003fe0, length: 0x00002000"
  70.  
  71.  
  72. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00005fd0, length: 0x00002000"
  73.  
  74.  
  75. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00007fc0, length: 0x00002000"
  76.  
  77.  
  78. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00009fb0, length: 0x00002000"
  79.  
  80.  
  81. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0000bfa0, length: 0x00002000"
  82.  
  83.  
  84. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0000df90, length: 0x00002000"
  85.  
  86.  
  87. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0000ff80, length: 0x00002000"
  88.  
  89.  
  90. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00011f70, length: 0x00002000"
  91.  
  92.  
  93. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00013f60, length: 0x00002000"
  94.  
  95.  
  96. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00015f50, length: 0x00002000"
  97.  
  98.  
  99. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00017f40, length: 0x00002000"
  100.  
  101.  
  102. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00019f30, length: 0x00002000"
  103.  
  104.  
  105. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0001bf20, length: 0x00002000"
  106.  
  107.  
  108. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0001df10, length: 0x00002000"
  109.  
  110.  
  111. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0001ff00, length: 0x00002000"
  112.  
  113.  
  114. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00021ef0, length: 0x00002000"
  115.  
  116.  
  117. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00023ee0, length: 0x00002000"
  118.  
  119.  
  120. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00025ed0, length: 0x00002000"
  121.  
  122.  
  123. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00027ec0, length: 0x00002000"
  124.  
  125.  
  126. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00029eb0, length: 0x00002000"
  127.  
  128.  
  129. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0002bea0, length: 0x00002000"
  130.  
  131.  
  132. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0002de90, length: 0x00002000"
  133.  
  134.  
  135. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0002fe80, length: 0x00002000"
  136.  
  137.  
  138. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00031e70, length: 0x00002000"
  139.  
  140.  
  141. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00033e60, length: 0x00002000"
  142.  
  143.  
  144. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00035e50, length: 0x00002000"
  145.  
  146.  
  147. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00037e40, length: 0x00002000"
  148.  
  149.  
  150. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00039e30, length: 0x00002000"
  151.  
  152.  
  153. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0003be20, length: 0x00002000"
  154.  
  155.  
  156. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0003de10, length: 0x00002000"
  157.  
  158.  
  159. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x0003fe00, length: 0x00002000"
  160.  
  161.  
  162. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00041df0, length: 0x00002000"
  163.  
  164.  
  165. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00043de0, length: 0x00002000"
  166.  
  167.  
  168. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00045600, length: 0x00000031"
  169.  
  170.  
  171. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x00045619, length: 0x0009eb74"
  172.  
  173.  
  174. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e435c, length: 0x00000028"
  175.  
  176.  
  177. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e4585, length: 0x00000028"
  178.  
  179.  
  180. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e475a, length: 0x00000028"
  181.  
  182.  
  183. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e492b, length: 0x00000028"
  184.  
  185.  
  186. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e4b56, length: 0x00000028"
  187.  
  188.  
  189. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e4d35, length: 0x00000028"
  190.  
  191.  
  192. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e4f20, length: 0x00000028"
  193.  
  194.  
  195. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5104, length: 0x00000028"
  196.  
  197.  
  198. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e52db, length: 0x00000028"
  199.  
  200.  
  201. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e54b6, length: 0x00000028"
  202.  
  203.  
  204. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5690, length: 0x00000028"
  205.  
  206.  
  207. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5867, length: 0x00000028"
  208.  
  209.  
  210. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5a3e, length: 0x00000028"
  211.  
  212.  
  213. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5c09, length: 0x00000028"
  214.  
  215.  
  216. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5de5, length: 0x00000028"
  217.  
  218.  
  219. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e5fb9, length: 0x00000028"
  220.  
  221.  
  222. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e61cc, length: 0x00000028"
  223.  
  224.  
  225. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e639b, length: 0x00000028"
  226.  
  227.  
  228. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e6587, length: 0x00000028"
  229.  
  230.  
  231. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e67c0, length: 0x00000028"
  232.  
  233.  
  234. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e69a1, length: 0x00000028"
  235.  
  236.  
  237. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e6bd6, length: 0x00000028"
  238.  
  239.  
  240. "self_read": "process: Exes_c11de7e5bfe3e6075522800ec0f23919.exe, pid: 744, offset: 0x000e6de0, length: 0x0000001b"
  241.  
  242.  
  243. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00000000, length: 0x00000040"
  244.  
  245.  
  246. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000000f0, length: 0x00000018"
  247.  
  248.  
  249. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000001e8, length: 0x00000078"
  250.  
  251.  
  252. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018000, length: 0x00000020"
  253.  
  254.  
  255. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018058, length: 0x00000018"
  256.  
  257.  
  258. "self_read": "process: wscript.exe, pid: 2484, offset: 0x000181a8, length: 0x00000018"
  259.  
  260.  
  261. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018470, length: 0x00000010"
  262.  
  263.  
  264. "self_read": "process: wscript.exe, pid: 2484, offset: 0x00018640, length: 0x00000012"
  265.  
  266.  
  267.  
  268.  
  269. "Description": "Drops a binary and executes it",
  270. "Details":
  271.  
  272. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vmo.exe"
  273.  
  274.  
  275.  
  276.  
  277. "Description": "Executed a process and injected code into it, probably while unpacking",
  278. "Details":
  279.  
  280. "Injection": "vmo.exe(2628) -> RegSvcs.exe(2932)"
  281.  
  282.  
  283.  
  284.  
  285. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  286. "Details":
  287.  
  288. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\:Zone.Identifier"
  289.  
  290.  
  291.  
  292.  
  293. "Description": "Installs itself for autorun at Windows startup",
  294. "Details":
  295.  
  296. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyhgfdghntre.exe"
  297.  
  298.  
  299. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vmo.exe C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\fxx=cgd"
  300.  
  301.  
  302.  
  303.  
  304. "Description": "Creates a hidden or system file",
  305. "Details":
  306.  
  307. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vmo.exe"
  308.  
  309.  
  310. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\22590065"
  311.  
  312.  
  313.  
  314.  
  315. "Description": "File has been identified by 29 Antiviruses on VirusTotal as malicious",
  316. "Details":
  317.  
  318. "McAfee": "RDN/Generic.grp"
  319.  
  320.  
  321. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  322.  
  323.  
  324. "K7GW": "Riskware ( 0040eff71 )"
  325.  
  326.  
  327. "K7AntiVirus": "Riskware ( 0040eff71 )"
  328.  
  329.  
  330. "F-Prot": "W32/Autoit.ADO"
  331.  
  332.  
  333. "Symantec": "Trojan.Gen.2"
  334.  
  335.  
  336. "APEX": "Malicious"
  337.  
  338.  
  339. "Avast": "Win32:Malware-gen"
  340.  
  341.  
  342. "ClamAV": "Win.Malware.0040eff-7088474-0"
  343.  
  344.  
  345. "Kaspersky": "Exploit.Win32.BypassUAC.xgl"
  346.  
  347.  
  348. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  349.  
  350.  
  351. "Sophos": "Mal/Generic-S"
  352.  
  353.  
  354. "Invincea": "heuristic"
  355.  
  356.  
  357. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.dc"
  358.  
  359.  
  360. "Trapmine": "suspicious.low.ml.score"
  361.  
  362.  
  363. "FireEye": "Generic.mg.c11de7e5bfe3e607"
  364.  
  365.  
  366. "Paloalto": "generic.ml"
  367.  
  368.  
  369. "Cyren": "W32/Autoit.XBNK-0841"
  370.  
  371.  
  372. "Microsoft": "Trojan:AutoIt/Wiausf.AC!MTB"
  373.  
  374.  
  375. "ZoneAlarm": "Exploit.Win32.BypassUAC.xgl"
  376.  
  377.  
  378. "AhnLab-V3": "Malware/Win32.Generic.R285222"
  379.  
  380.  
  381. "Malwarebytes": "Trojan.MalPack.AISFX.Generic"
  382.  
  383.  
  384. "Zoner": "Probably RARAutorun"
  385.  
  386.  
  387. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  388.  
  389.  
  390. "Webroot": "W32.Malware.Gen"
  391.  
  392.  
  393. "AVG": "Win32:Malware-gen"
  394.  
  395.  
  396. "Cybereason": "malicious.505f2b"
  397.  
  398.  
  399. "CrowdStrike": "win/malicious_confidence_70% (W)"
  400.  
  401.  
  402. "Qihoo-360": "HEUR/QVM06.3.0A71.Malware.Gen"
  403.  
  404.  
  405.  
  406.  
  407. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  408. "Details":
  409.  
  410. "target": "clamav:Win.Malware.0040eff-7088474-0, sha256:f80acc2bd1e7e87cde554786185dfd9f553465bb24b98bd484517e82613298c2, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  411.  
  412.  
  413.  
  414.  
  415.  
  416. * Started Service:
  417.  
  418. * Mutexes:
  419. "DefaultTabtip-MainUI",
  420. "CicLoadWinStaWinSta0",
  421. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  422. "Local\\ZoneAttributeCacheCounterMutex",
  423. "Local\\ZonesCacheCounterMutex",
  424. "Local\\ZonesLockedCacheCounterMutex",
  425. "Global\\CLR_CASOFF_MUTEX"
  426.  
  427.  
  428. * Modified Files:
  429. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\__tmp_rar_sfx_access_check_9455812",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\fpb.ppt",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\fxx=cgd",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\dcw.vbs",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vmo.exe",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\rnx.ppt",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\qts.bmp",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\hik.mp3",
  437. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\ouk.jpg",
  438. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\bxn.dat",
  439. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\qmv.ppt",
  440. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\dqk.jpg",
  441. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\hcn.ico",
  442. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\cbi.docx",
  443. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\hkt.ppt",
  444. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\irm.icm",
  445. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\jqb.ppt",
  446. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\qfm.bmp",
  447. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\xch.jpg",
  448. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\aeh.txt",
  449. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\jjc.pdf",
  450. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\bax.mp3",
  451. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\sfv.mp3",
  452. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\dpl.pdf",
  453. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\vfr.txt",
  454. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\evl.bmp",
  455. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\qna.pdf",
  456. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\ihr.mp3",
  457. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\eel.mp4",
  458. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\jmf.ico",
  459. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\ork.ico",
  460. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\seu.ppt",
  461. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\bnt.ico",
  462. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\gak.ppt",
  463. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\shk.txt",
  464. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\irm.ppt",
  465. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\gkc.jpg",
  466. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\srx.ppt",
  467. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\ahk.pdf",
  468. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\sne.jpg",
  469. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\ogq.mp3",
  470. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\esb.ico",
  471. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\rtk.mp3",
  472. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\hbq.txt",
  473. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\hfn.mp3",
  474. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  475. "\\??\\PIPE\\srvsvc",
  476. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NFMN4TN0I7FHLZR8TVAO.temp",
  477. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms"
  478.  
  479.  
  480. * Deleted Files:
  481. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\__tmp_rar_sfx_access_check_9455812",
  482. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\fxx=cgd",
  483. "C:\\Users\\user\\AppData\\Local\\Temp\\22590065\\:Zone.Identifier",
  484. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\NFMN4TN0I7FHLZR8TVAO.temp",
  485. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.2972.9486484",
  486. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2972.9486484",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.2972.9486484"
  488.  
  489.  
  490. * Modified Registry Keys:
  491. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  492. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  493. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  494. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyhgfdghntre.exe",
  495. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo",
  496. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPer1_0Server",
  497. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\MaxConnectionsPerServer",
  498. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\92HL0XD4TE"
  499.  
  500.  
  501. * Deleted Registry Keys:
  502. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  503. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  504. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  505. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  506.  
  507.  
  508. * DNS Communications:
  509.  
  510. "type": "A",
  511. "request": "cozia.hopto.org",
  512. "answers":
  513.  
  514. "data": "185.234.216.191",
  515. "type": "A"
  516.  
  517.  
  518.  
  519.  
  520.  
  521. * Domains:
  522.  
  523. "ip": "185.234.216.191",
  524. "domain": "cozia.hopto.org"
  525.  
  526.  
  527.  
  528. * Network Communication - ICMP:
  529.  
  530. * Network Communication - HTTP:
  531.  
  532. * Network Communication - SMTP:
  533.  
  534. * Network Communication - Hosts:
  535.  
  536. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!