API tools faq
paste
paladin316

Exes_656aed653578ca3b7d6212684950e97e_exe_2019-07-24_01_30.txt

paladin316
Jul 23rd, 2019
2,243
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.46 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Sharik"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_656aed653578ca3b7d6212684950e97e.exe"
  7. * File Size: 1292949
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "b606fd2873a3b10813c4be70f3507c3e95ec92ae003e0fc4c8f00f85964c754f"
  10. * MD5: "656aed653578ca3b7d6212684950e97e"
  11. * SHA1: "b48597bf5489f172169cada7ead8c12956617fc8"
  12. * SHA512: "016e35af231e1973f6557667a074c13ef77513c8339769b05ef446851ef3d461eb61dc5c6aa10c0b08556459c785596ff895e2bce931afeec48ce2f39aac57d9"
  13. * CRC32: "DEEBD017"
  14. * SSDEEP: "24576:bNA3R5drXpdAwnwdtxZXL2cAFV56Bla4F9lxFHGJYxGJH5SLMGw0n21:G5XAwidLrA3UBlbF/xU+xsH5So4nc"
  15.  
  16. * Process Execution:
  17. "Exes_656aed653578ca3b7d6212684950e97e.exe",
  18. "wscript.exe",
  19. "wji.exe",
  20. "wji.exe",
  21. "RegSvcs.exe",
  22. "wscript.exe",
  23. "wji.exe",
  24. "wji.exe",
  25. "RegSvcs.exe",
  26. "explorer.exe",
  27. "explorer.exe",
  28. "explorer.exe",
  29. "explorer.exe",
  30. "explorer.exe",
  31. "explorer.exe",
  32. "explorer.exe",
  33. "cmd.exe",
  34. "explorer.exe",
  35. "services.exe",
  36. "svchost.exe",
  37. "taskhost.exe",
  38. "dwm.exe",
  39. "conhost.exe"
  40.  
  41.  
  42. * Executed Commands:
  43. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\mlg.vbs\"",
  44. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\mlg.vbs ",
  45. "\"C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe\" rfw=lwx",
  46. "wji.exe rfw=lwx",
  47. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\QROXW",
  48. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\run.vbs\"",
  49. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\run.vbs ",
  50. "C:\\Windows\\SysWOW64\\explorer.exe",
  51. "C:\\Windows\\explorer.exe",
  52. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\UOHLL",
  53. "C:\\Windows\\system32\\lsass.exe"
  54.  
  55.  
  56. * Signatures Detected:
  57.  
  58. "Description": "Attempts to connect to a dead IP:Port (2 unique times)",
  59. "Details":
  60.  
  61. "IP": "89.108.103.19:80"
  62.  
  63.  
  64. "IP": "184.28.188.203:80"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "Possible date expiration check, exits too soon after checking local time",
  70. "Details":
  71.  
  72. "process": "wji.exe, PID 1180"
  73.  
  74.  
  75.  
  76.  
  77. "Description": "Creates RWX memory",
  78. "Details":
  79.  
  80.  
  81. "Description": "Detected script timer window indicative of sleep style evasion",
  82. "Details":
  83.  
  84. "Window": "WSH-Timer"
  85.  
  86.  
  87.  
  88.  
  89. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  90. "Details":
  91.  
  92. "ioc": "wji.exe-55904091324043"
  93.  
  94.  
  95. "ioc": "wji.exe-55904091324042"
  96.  
  97.  
  98. "ioc": "v2.0.50727"
  99.  
  100.  
  101. "ioc": "vcs.exe-55904091325203"
  102.  
  103.  
  104. "ioc": "vcs.exe-55904091325202"
  105.  
  106.  
  107. "ioc": "wm.exe-55904091319683"
  108.  
  109.  
  110. "ioc": "taskhost.exe-55904091313043"
  111.  
  112.  
  113. "ioc": "cmd.exe-5590409138683"
  114.  
  115.  
  116. "ioc": "conhost.exe-55904091311843"
  117.  
  118.  
  119.  
  120.  
  121. "Description": "Expresses interest in specific running processes",
  122. "Details":
  123.  
  124. "process": "services.exe"
  125.  
  126.  
  127. "process": "wininit.exe"
  128.  
  129.  
  130. "process": "dwm.exe"
  131.  
  132.  
  133. "process": "RegSvcs.exe"
  134.  
  135.  
  136. "process": "System"
  137.  
  138.  
  139. "process": "csrss.exe"
  140.  
  141.  
  142. "process": "spoolsv.exe"
  143.  
  144.  
  145. "process": "smss.exe"
  146.  
  147.  
  148. "process": "svchost.exe"
  149.  
  150.  
  151. "process": "taskhost.exe"
  152.  
  153.  
  154. "process": "taskeng.exe"
  155.  
  156.  
  157. "process": "explorer.exe"
  158.  
  159.  
  160. "process": "winlogon.exe"
  161.  
  162.  
  163. "process": "WmiPrvSE.exe"
  164.  
  165.  
  166.  
  167.  
  168. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  169. "Details":
  170.  
  171.  
  172. "Description": "Reads data out of its own binary image",
  173. "Details":
  174.  
  175. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00000000, length: 0x00000007"
  176.  
  177.  
  178. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00000000, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00000007, length: 0x0013ba8e"
  182.  
  183.  
  184. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00001ff0, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00003fe0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00005fd0, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00007fc0, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00009fb0, length: 0x00002000"
  197.  
  198.  
  199. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0000bfa0, length: 0x00002000"
  200.  
  201.  
  202. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0000df90, length: 0x00002000"
  203.  
  204.  
  205. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0000ff80, length: 0x00002000"
  206.  
  207.  
  208. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00011f70, length: 0x00002000"
  209.  
  210.  
  211. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00013f60, length: 0x00002000"
  212.  
  213.  
  214. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00015f50, length: 0x00002000"
  215.  
  216.  
  217. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00017f40, length: 0x00002000"
  218.  
  219.  
  220. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00019f30, length: 0x00002000"
  221.  
  222.  
  223. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0001bf20, length: 0x00002000"
  224.  
  225.  
  226. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0001df10, length: 0x00002000"
  227.  
  228.  
  229. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0001ff00, length: 0x00002000"
  230.  
  231.  
  232. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00021ef0, length: 0x00002000"
  233.  
  234.  
  235. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00023ee0, length: 0x00002000"
  236.  
  237.  
  238. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00025ed0, length: 0x00002000"
  239.  
  240.  
  241. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00027ec0, length: 0x00002000"
  242.  
  243.  
  244. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00029eb0, length: 0x00002000"
  245.  
  246.  
  247. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0002bea0, length: 0x00002000"
  248.  
  249.  
  250. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0002de90, length: 0x00002000"
  251.  
  252.  
  253. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0002fe80, length: 0x00002000"
  254.  
  255.  
  256. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00031e70, length: 0x00002000"
  257.  
  258.  
  259. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00033e60, length: 0x00002000"
  260.  
  261.  
  262. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00035e50, length: 0x00002000"
  263.  
  264.  
  265. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00037e40, length: 0x00002000"
  266.  
  267.  
  268. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00039e30, length: 0x00002000"
  269.  
  270.  
  271. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0003be20, length: 0x00002000"
  272.  
  273.  
  274. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0003de10, length: 0x00002000"
  275.  
  276.  
  277. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0003fe00, length: 0x00002000"
  278.  
  279.  
  280. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00041df0, length: 0x00002000"
  281.  
  282.  
  283. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00043de0, length: 0x00002000"
  284.  
  285.  
  286. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00045dd0, length: 0x00002000"
  287.  
  288.  
  289. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00047dc0, length: 0x00002000"
  290.  
  291.  
  292. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00049db0, length: 0x00002000"
  293.  
  294.  
  295. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0004bda0, length: 0x00002000"
  296.  
  297.  
  298. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0004dd90, length: 0x00002000"
  299.  
  300.  
  301. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0004fd80, length: 0x00002000"
  302.  
  303.  
  304. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00050a00, length: 0x00000032"
  305.  
  306.  
  307. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00050a1a, length: 0x000e7b76"
  308.  
  309.  
  310. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013877b, length: 0x00000028"
  311.  
  312.  
  313. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013895f, length: 0x00000028"
  314.  
  315.  
  316. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00138b81, length: 0x00000028"
  317.  
  318.  
  319. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00138d49, length: 0x00000028"
  320.  
  321.  
  322. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00138f24, length: 0x00000028"
  323.  
  324.  
  325. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013914c, length: 0x00000028"
  326.  
  327.  
  328. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00139338, length: 0x00000027"
  329.  
  330.  
  331. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00139542, length: 0x00000028"
  332.  
  333.  
  334. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013971c, length: 0x00000028"
  335.  
  336.  
  337. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x001398ec, length: 0x00000028"
  338.  
  339.  
  340. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00139ada, length: 0x00000028"
  341.  
  342.  
  343. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00139cdc, length: 0x00000028"
  344.  
  345.  
  346. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x00139ee9, length: 0x00000027"
  347.  
  348.  
  349. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013a0fa, length: 0x00000028"
  350.  
  351.  
  352. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013a2f2, length: 0x00000028"
  353.  
  354.  
  355. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013a4ed, length: 0x00000028"
  356.  
  357.  
  358. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013a6c5, length: 0x00000029"
  359.  
  360.  
  361. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013a893, length: 0x00000028"
  362.  
  363.  
  364. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013aaa4, length: 0x00000029"
  365.  
  366.  
  367. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013ac9c, length: 0x00000029"
  368.  
  369.  
  370. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013ae77, length: 0x00000028"
  371.  
  372.  
  373. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b05e, length: 0x00000028"
  374.  
  375.  
  376. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b22d, length: 0x00000028"
  377.  
  378.  
  379. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b41e, length: 0x00000028"
  380.  
  381.  
  382. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b5f1, length: 0x00000028"
  383.  
  384.  
  385. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b7f3, length: 0x00000028"
  386.  
  387.  
  388. "self_read": "process: Exes_656aed653578ca3b7d6212684950e97e.exe, pid: 1728, offset: 0x0013b9d8, length: 0x0000001b"
  389.  
  390.  
  391. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00000000, length: 0x00000040"
  392.  
  393.  
  394. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000000f0, length: 0x00000018"
  395.  
  396.  
  397. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000001e8, length: 0x00000078"
  398.  
  399.  
  400. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018000, length: 0x00000020"
  401.  
  402.  
  403. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018058, length: 0x00000018"
  404.  
  405.  
  406. "self_read": "process: wscript.exe, pid: 2336, offset: 0x000181a8, length: 0x00000018"
  407.  
  408.  
  409. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018470, length: 0x00000010"
  410.  
  411.  
  412. "self_read": "process: wscript.exe, pid: 2336, offset: 0x00018640, length: 0x00000012"
  413.  
  414.  
  415. "self_read": "process: wscript.exe, pid: 1520, offset: 0x00000000, length: 0x00000040"
  416.  
  417.  
  418. "self_read": "process: wscript.exe, pid: 1520, offset: 0x000000f0, length: 0x00000018"
  419.  
  420.  
  421. "self_read": "process: wscript.exe, pid: 1520, offset: 0x000001e8, length: 0x00000078"
  422.  
  423.  
  424. "self_read": "process: wscript.exe, pid: 1520, offset: 0x00018000, length: 0x00000020"
  425.  
  426.  
  427. "self_read": "process: wscript.exe, pid: 1520, offset: 0x00018058, length: 0x00000018"
  428.  
  429.  
  430. "self_read": "process: wscript.exe, pid: 1520, offset: 0x000181a8, length: 0x00000018"
  431.  
  432.  
  433. "self_read": "process: wscript.exe, pid: 1520, offset: 0x00018470, length: 0x00000010"
  434.  
  435.  
  436. "self_read": "process: wscript.exe, pid: 1520, offset: 0x00018640, length: 0x00000012"
  437.  
  438.  
  439.  
  440.  
  441. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  442. "Details":
  443.  
  444. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  445.  
  446.  
  447. "suspicious_request": "http://kingj4me5.xyz/my/"
  448.  
  449.  
  450.  
  451.  
  452. "Description": "Performs some HTTP requests",
  453. "Details":
  454.  
  455. "url": "http://www.msftncsi.com/ncsi.txt"
  456.  
  457.  
  458. "url": "http://kingj4me5.xyz/my/"
  459.  
  460.  
  461.  
  462.  
  463. "Description": "Executed a process and injected code into it, probably while unpacking",
  464. "Details":
  465.  
  466. "Injection": "wji.exe(2244) -> RegSvcs.exe(2208)"
  467.  
  468.  
  469.  
  470.  
  471. "Description": "Detects Sandboxie through the presence of a library",
  472. "Details":
  473.  
  474.  
  475. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  476. "Details":
  477.  
  478. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier"
  479.  
  480.  
  481.  
  482.  
  483. "Description": "Sniffs keystrokes",
  484. "Details":
  485.  
  486. "SetWindowsHookExW": "Process: explorer.exe(2004)"
  487.  
  488.  
  489.  
  490.  
  491. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  492. "Details":
  493.  
  494. "Process": "wji.exe (2404)"
  495.  
  496.  
  497.  
  498.  
  499. "Description": "Code injection with CreateRemoteThread in a remote process",
  500. "Details":
  501.  
  502. "Injection": "explorer.exe(180) -> wji.exe(2404)"
  503.  
  504.  
  505.  
  506.  
  507. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  508. "Details":
  509.  
  510. "unhook": "function_name: WSASend, type: modification"
  511.  
  512.  
  513. "unhook": "function_name: send, type: modification"
  514.  
  515.  
  516.  
  517.  
  518. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  519. "Details":
  520.  
  521. "regkeyval": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache"
  522.  
  523.  
  524.  
  525.  
  526. "Description": "Installs itself for autorun at Windows startup",
  527. "Details":
  528.  
  529. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  530.  
  531.  
  532. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\RFW_LW~1"
  533.  
  534.  
  535. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\75867420"
  536.  
  537.  
  538. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\start.vbs"
  539.  
  540.  
  541. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk"
  542.  
  543.  
  544. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk"
  545.  
  546.  
  547.  
  548.  
  549. "Description": "Creates a hidden or system file",
  550. "Details":
  551.  
  552. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe"
  553.  
  554.  
  555. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\abi.mp3"
  556.  
  557.  
  558. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\afe.dat"
  559.  
  560.  
  561. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\afp.mp4"
  562.  
  563.  
  564. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ara.xl"
  565.  
  566.  
  567. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\bug.mp4"
  568.  
  569.  
  570. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\cvk.dat"
  571.  
  572.  
  573. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\dla.pdf"
  574.  
  575.  
  576. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\dxj.txt"
  577.  
  578.  
  579. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\eht.icm"
  580.  
  581.  
  582. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\eow.icm"
  583.  
  584.  
  585. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\fqt.mp3"
  586.  
  587.  
  588. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\gft.icm"
  589.  
  590.  
  591. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\gpe.ico"
  592.  
  593.  
  594. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\hsk.xl"
  595.  
  596.  
  597. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\igq.ppt"
  598.  
  599.  
  600. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jav.pdf"
  601.  
  602.  
  603. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jji.xl"
  604.  
  605.  
  606. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jpo.ico"
  607.  
  608.  
  609. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\kkj.docx"
  610.  
  611.  
  612. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\kvi.mp3"
  613.  
  614.  
  615. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\lkh.icm"
  616.  
  617.  
  618. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\llb.txt"
  619.  
  620.  
  621. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\mlg.vbs"
  622.  
  623.  
  624. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\nea.bmp"
  625.  
  626.  
  627. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ooe.ico"
  628.  
  629.  
  630. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pcx.mp3"
  631.  
  632.  
  633. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pgj.docx"
  634.  
  635.  
  636. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\poq.pdf"
  637.  
  638.  
  639. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pqc.bmp"
  640.  
  641.  
  642. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\prh.dat"
  643.  
  644.  
  645. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\qix.mp4"
  646.  
  647.  
  648. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\qpw.docx"
  649.  
  650.  
  651. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rfw=lwx"
  652.  
  653.  
  654. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rhj.ico"
  655.  
  656.  
  657. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rik.pdf"
  658.  
  659.  
  660. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rjq.dat"
  661.  
  662.  
  663. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rls.ico"
  664.  
  665.  
  666. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\sut.icm"
  667.  
  668.  
  669. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tis.ppt"
  670.  
  671.  
  672. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tmt.icm"
  673.  
  674.  
  675. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tps.jpg"
  676.  
  677.  
  678. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ujc.dat"
  679.  
  680.  
  681. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\uuo.bmp"
  682.  
  683.  
  684. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vcd.dat"
  685.  
  686.  
  687. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vhg.mp3"
  688.  
  689.  
  690. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vnp.ico"
  691.  
  692.  
  693. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wiu.pdf"
  694.  
  695.  
  696. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420"
  697.  
  698.  
  699. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe"
  700.  
  701.  
  702. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat"
  703.  
  704.  
  705. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat"
  706.  
  707.  
  708. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ini"
  709.  
  710.  
  711. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\run.vbs"
  712.  
  713.  
  714. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\start.cmd"
  715.  
  716.  
  717. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\start.vbs"
  718.  
  719.  
  720.  
  721.  
  722. "Description": "File has been identified by 36 Antiviruses on VirusTotal as malicious",
  723. "Details":
  724.  
  725. "MicroWorld-eScan": "Trojan.GenericKD.32177643"
  726.  
  727.  
  728. "FireEye": "Generic.mg.656aed653578ca3b"
  729.  
  730.  
  731. "McAfee": "Artemis!656AED653578"
  732.  
  733.  
  734. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  735.  
  736.  
  737. "K7GW": "Riskware ( 0040eff71 )"
  738.  
  739.  
  740. "K7AntiVirus": "Riskware ( 0040eff71 )"
  741.  
  742.  
  743. "Arcabit": "Trojan.Generic.D1EAFDEB"
  744.  
  745.  
  746. "TrendMicro": "TROJ_GEN.R002C0WGN19"
  747.  
  748.  
  749. "Symantec": "Trojan.Gen.MBT"
  750.  
  751.  
  752. "APEX": "Malicious"
  753.  
  754.  
  755. "Avast": "Win32:Malware-gen"
  756.  
  757.  
  758. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  759.  
  760.  
  761. "Kaspersky": "Trojan.Win32.Propagate.med"
  762.  
  763.  
  764. "BitDefender": "Trojan.GenericKD.32177643"
  765.  
  766.  
  767. "Paloalto": "generic.ml"
  768.  
  769.  
  770. "AegisLab": "Trojan.Win32.Generic.4!c"
  771.  
  772.  
  773. "Endgame": "malicious (high confidence)"
  774.  
  775.  
  776. "Emsisoft": "Trojan.GenericKD.32177643 (B)"
  777.  
  778.  
  779. "Invincea": "heuristic"
  780.  
  781.  
  782. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  783.  
  784.  
  785. "Sophos": "Mal/Generic-S"
  786.  
  787.  
  788. "Ikarus": "Trojan.Inject"
  789.  
  790.  
  791. "Microsoft": "Trojan:AutoIt/Wiausf.AC!MTB"
  792.  
  793.  
  794. "ZoneAlarm": "Trojan.Win32.Propagate.med"
  795.  
  796.  
  797. "GData": "Trojan.GenericKD.32177643"
  798.  
  799.  
  800. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  801.  
  802.  
  803. "ALYac": "Trojan.GenericKD.32177643"
  804.  
  805.  
  806. "Ad-Aware": "Trojan.GenericKD.32177643"
  807.  
  808.  
  809. "Zoner": "Probably RARAutorun"
  810.  
  811.  
  812. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  813.  
  814.  
  815. "TrendMicro-HouseCall": "TROJ_GEN.R002C0WGN19"
  816.  
  817.  
  818. "MAX": "malware (ai score=100)"
  819.  
  820.  
  821. "Fortinet": "AutoIt/Injector.EDS!tr"
  822.  
  823.  
  824. "AVG": "Win32:Malware-gen"
  825.  
  826.  
  827. "Cybereason": "malicious.f5489f"
  828.  
  829.  
  830. "CrowdStrike": "win/malicious_confidence_70% (W)"
  831.  
  832.  
  833.  
  834.  
  835. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  836. "Details":
  837.  
  838.  
  839. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  840. "Details":
  841.  
  842. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:b606fd2873a3b10813c4be70f3507c3e95ec92ae003e0fc4c8f00f85964c754f, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  843.  
  844.  
  845.  
  846.  
  847. "Description": "Harvests information related to installed mail clients",
  848. "Details":
  849.  
  850. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  851.  
  852.  
  853.  
  854.  
  855. "Description": "Created network traffic indicative of malicious activity",
  856. "Details":
  857.  
  858. "signature": "ET TROJAN Sharik/Smoke CnC Beacon 7"
  859.  
  860.  
  861.  
  862.  
  863.  
  864. * Started Service:
  865.  
  866. * Mutexes:
  867. "DefaultTabtip-MainUI",
  868. "CicLoadWinStaWinSta0",
  869. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  870. "Local\\ZoneAttributeCacheCounterMutex",
  871. "Local\\ZonesCacheCounterMutex",
  872. "Local\\ZonesLockedCacheCounterMutex",
  873. "7E8C820C05FE53DA70B24D931AD9346CC1C5B64F",
  874. "161488323F4895CF3567734A2F26656A",
  875. "EC6C8F71DB0B60CDE6F85B5C72CD31AE",
  876. "2382F10D9E9479CB03F0F878D238FE07",
  877. "E4AB2EC531E619974844D35B1F361D70",
  878. "opera_shared_counter",
  879. "opera_shared_counter64",
  880. "AF8581BE32F8157752064C48304402CF",
  881. "CEB5E69FEC3F4009920A5BE6EA9971D2",
  882. "4D143007260783F5F5DE2EF4D57CDC0B",
  883. "1F72EE43F3B8FC9FDB10940A43A73026"
  884.  
  885.  
  886. * Modified Files:
  887. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\__tmp_rar_sfx_access_check_29611390",
  888. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rls.ico",
  889. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rfw=lwx",
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\mlg.vbs",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wji.exe",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ujc.dat",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\dxj.txt",
  894. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\uuo.bmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\poq.pdf",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\bug.mp4",
  897. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jji.xl",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jav.pdf",
  899. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vcd.dat",
  900. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\afp.mp4",
  901. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\afe.dat",
  902. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ooe.ico",
  903. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\abi.mp3",
  904. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tis.ppt",
  905. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\sut.icm",
  906. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tps.jpg",
  907. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\igq.ppt",
  908. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\wiu.pdf",
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\eow.icm",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\cvk.dat",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\jpo.ico",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rjq.dat",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\llb.txt",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rik.pdf",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\gpe.ico",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ara.xl",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\gft.icm",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\tmt.icm",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\lkh.icm",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\nea.bmp",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pcx.mp3",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\hsk.xl",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\fqt.mp3",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\rhj.ico",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\prh.dat",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\qpw.docx",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pqc.bmp",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\kkj.docx",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\pgj.docx",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\kvi.mp3",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\eht.icm",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vhg.mp3",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\qix.mp4",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\vnp.ico",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\dla.pdf",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\QROXW",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\ini",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\start.vbs",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\start.cmd",
  940. "\\??\\PIPE\\srvsvc",
  941. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\run.vbs",
  943. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  944. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat",
  945. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk",
  946. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\UOHLL",
  948. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 3007180813",
  949. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf"
  950.  
  951.  
  952. * Deleted Files:
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\__tmp_rar_sfx_access_check_29611390",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\QROXW",
  955. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  956. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe",
  957. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier",
  958. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  959. "C:\\Windows\\Tasks\\Opera scheduled Autoupdate 3007180813.job",
  960. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 3007180813",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\75867420\\UOHLL"
  962.  
  963.  
  964. * Modified Registry Keys:
  965. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  966. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  967. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  968. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  969. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  970. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  971. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\75867420",
  972. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
  973. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  974. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  975. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A46168B5-4584-47CD-9A65-8D90045C9BD3\\Path",
  976. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A46168B5-4584-47CD-9A65-8D90045C9BD3\\Hash",
  977. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 3007180813\\Id",
  978. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 3007180813\\Index",
  979. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A46168B5-4584-47CD-9A65-8D90045C9BD3\\Triggers",
  980. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\A46168B5-4584-47CD-9A65-8D90045C9BD3\\DynamicInfo",
  981. "HKEY_CURRENT_USER\\Software\\ec9f845d",
  982. "HKEY_CURRENT_USER\\Software\\bac9d20b"
  983.  
  984.  
  985. * Deleted Registry Keys:
  986. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  987. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  989. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  990. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 3007180813.job",
  991. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 3007180813.job.fp"
  992.  
  993.  
  994. * DNS Communications:
  995.  
  996. "type": "A",
  997. "request": "kingj4me5.xyz",
  998. "answers":
  999.  
  1000. "data": "89.108.103.19",
  1001. "type": "A"
  1002.  
  1003.  
  1004.  
  1005.  
  1006.  
  1007. * Domains:
  1008.  
  1009. "ip": "89.108.103.19",
  1010. "domain": "kingj4me5.xyz"
  1011.  
  1012.  
  1013.  
  1014. * Network Communication - ICMP:
  1015.  
  1016. * Network Communication - HTTP:
  1017.  
  1018. "count": 1,
  1019. "body": "",
  1020. "uri": "http://www.msftncsi.com/ncsi.txt",
  1021. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1022. "method": "GET",
  1023. "host": "www.msftncsi.com",
  1024. "version": "1.1",
  1025. "path": "/ncsi.txt",
  1026. "data": "GET /ncsi.txt HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.msftncsi.com\r\n\r\n",
  1027. "port": 80
  1028.  
  1029.  
  1030. "count": 1,
  1031. "body": "",
  1032. "uri": "http://kingj4me5.xyz/my/",
  1033. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1034. "method": "POST",
  1035. "host": "kingj4me5.xyz",
  1036. "version": "1.1",
  1037. "path": "/my/",
  1038. "data": "POST /my/ HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nContent-Length: 63\r\nHost: kingj4me5.xyz\r\n\r\n",
  1039. "port": 80
  1040.  
  1041.  
  1042.  
  1043. * Network Communication - SMTP:
  1044.  
  1045. * Network Communication - Hosts:
  1046.  
  1047. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!