API tools faq
paste
paladin316

Exes_2c10d55726c85b497c749969143cdc7c_png_2019-07-26_16_30.txt

paladin316
Jul 26th, 2019
2,079
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.50 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_2c10d55726c85b497c749969143cdc7c.png"
  7. * File Size: 393216
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "3f8db673acf5dcdac23dc813eab29a740b4e718330fb53e8836cfe4d7b0a8b71"
  10. * MD5: "2c10d55726c85b497c749969143cdc7c"
  11. * SHA1: "692d65db26fb43b5b51b53ac9e8d38a805802e53"
  12. * SHA512: "30f8c21ef0b1224c3ddca84a1065d5d2170cdce347f046b434b55f325dbad036cba73c462b0c35280862f23218177703f199324c97c4a7cd5aa359e33b11d7cb"
  13. * CRC32: "64EB1419"
  14. * SSDEEP: "6144:1is5Wa1tALEFdCsJ70O/6kN+IiTjAtrBjjQH7BfjMwYElYMkRU:f1L70fu+jAtlQbzzYMJ"
  15.  
  16. * Process Execution:
  17. "Exes_2c10d55726c85b497c749969143cdc7c.png",
  18. "cmd.exe",
  19. "sc.exe",
  20. "cmd.exe",
  21. "sc.exe",
  22. "cmd.exe",
  23. "powershell.exe",
  24. "cmd.exe",
  25. "powershell.exe",
  26. "cmd.exe",
  27. "powershell.exe",
  28. "cmd.exe",
  29. "powershell.exe",
  30. "cmd.exe",
  31. "powershell.exe",
  32. "cmd.exe",
  33. "powershell.exe",
  34. "cmd.exe",
  35. "powershell.exe",
  36. "cmd.exe",
  37. "powershell.exe",
  38. "cmd.exe",
  39. "powershell.exe",
  40. "cmd.exe",
  41. "powershell.exe",
  42. "Exeu_2c10d77928c87b499c949989143cdc9c.exe",
  43. "cmd.exe",
  44. "sc.exe",
  45. "cmd.exe",
  46. "sc.exe",
  47. "cmd.exe",
  48. "powershell.exe",
  49. "cmd.exe",
  50. "powershell.exe",
  51. "cmd.exe",
  52. "powershell.exe",
  53. "cmd.exe",
  54. "powershell.exe",
  55. "cmd.exe",
  56. "powershell.exe",
  57. "cmd.exe",
  58. "powershell.exe",
  59. "cmd.exe",
  60. "powershell.exe",
  61. "cmd.exe",
  62. "powershell.exe",
  63. "cmd.exe",
  64. "powershell.exe",
  65. "cmd.exe",
  66. "powershell.exe",
  67. "svchost.exe",
  68. "svchost.exe"
  69.  
  70.  
  71. * Executed Commands:
  72. "cmd.exe /c sc stop WinDefend",
  73. "cmd.exe /c sc delete WinDefend",
  74. "cmd.exe /c powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  75. "cmd.exe /c powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  76. "cmd.exe /c powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  77. "cmd.exe /c powershell Set-MpPreference -DisableIOAVProtection $true",
  78. "cmd.exe /c powershell Set-MpPreference -DisablePrivacyMode $true",
  79. "cmd.exe /c powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  80. "cmd.exe /c powershell Set-MpPreference -SevereThreatDefaultAction 6",
  81. "cmd.exe /c powershell Set-MpPreference -LowThreatDefaultAction 6",
  82. "cmd.exe /c powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  83. "cmd.exe /c powershell Set-MpPreference -DisableScriptScanning $true",
  84. "C:\\Users\\user\\AppData\\Roaming\\safessd\\Exeu_2c10d77928c87b499c949989143cdc9c.exe",
  85. "sc delete WinDefend",
  86. "sc stop WinDefend",
  87. "powershell Set-MpPreference -DisableRealtimeMonitoring $true",
  88. "powershell Set-MpPreference -DisableBehaviorMonitoring $true",
  89. "powershell Set-MpPreference -DisableBlockAtFirstSeen $true",
  90. "powershell Set-MpPreference -DisableIOAVProtection $true",
  91. "powershell Set-MpPreference -DisablePrivacyMode $true",
  92. "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true",
  93. "powershell Set-MpPreference -SevereThreatDefaultAction 6",
  94. "powershell Set-MpPreference -LowThreatDefaultAction 6",
  95. "powershell Set-MpPreference -ModerateThreatDefaultAction 6",
  96. "powershell Set-MpPreference -DisableScriptScanning $true",
  97. "C:\\Windows\\system32\\svchost.exe"
  98.  
  99.  
  100. * Signatures Detected:
  101.  
  102. "Description": "Creates RWX memory",
  103. "Details":
  104.  
  105.  
  106. "Description": "Possible date expiration check, exits too soon after checking local time",
  107. "Details":
  108.  
  109. "process": "cmd.exe, PID 2636"
  110.  
  111.  
  112.  
  113.  
  114. "Description": "A process attempted to delay the analysis task.",
  115. "Details":
  116.  
  117. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  118.  
  119.  
  120.  
  121.  
  122. "Description": "A process created a hidden window",
  123. "Details":
  124.  
  125. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  126.  
  127.  
  128. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  129.  
  130.  
  131. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  132.  
  133.  
  134. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  135.  
  136.  
  137. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  138.  
  139.  
  140. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  141.  
  142.  
  143. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  144.  
  145.  
  146. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  147.  
  148.  
  149. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  150.  
  151.  
  152. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  153.  
  154.  
  155. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  156.  
  157.  
  158. "Process": "Exes_2c10d55726c85b497c749969143cdc7c.png -> cmd.exe"
  159.  
  160.  
  161. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  162.  
  163.  
  164. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  165.  
  166.  
  167. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  168.  
  169.  
  170. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  171.  
  172.  
  173. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  174.  
  175.  
  176. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  177.  
  178.  
  179. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  180.  
  181.  
  182. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  183.  
  184.  
  185. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  186.  
  187.  
  188. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  189.  
  190.  
  191. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  192.  
  193.  
  194. "Process": "Exeu_2c10d77928c87b499c949989143cdc9c.exe -> cmd.exe"
  195.  
  196.  
  197.  
  198.  
  199. "Description": "Drops a binary and executes it",
  200. "Details":
  201.  
  202. "binary": "C:\\Users\\user\\AppData\\Roaming\\safessd\\Exeu_2c10d77928c87b499c949989143cdc9c.exe"
  203.  
  204.  
  205.  
  206.  
  207. "Description": "The binary likely contains encrypted or compressed data.",
  208. "Details":
  209.  
  210. "section": "name: .rsrc, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ, raw_size: 0x0002e000, virtual_size: 0x0002d45c"
  211.  
  212.  
  213.  
  214.  
  215. "Description": "Detects VirtualBox through the presence of a library",
  216. "Details":
  217.  
  218.  
  219. "Description": "Attempts to stop active services",
  220. "Details":
  221.  
  222. "servicename": "WinDefend"
  223.  
  224.  
  225.  
  226.  
  227. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  228. "Details":
  229.  
  230. "Spam": "Exes_2c10d55726c85b497c749969143cdc7c.png (1840) called API GetSystemTimeAsFileTime 165699 times"
  231.  
  232.  
  233. "Spam": "Exeu_2c10d77928c87b499c949989143cdc9c.exe (2872) called API GetSystemTimeAsFileTime 165699 times"
  234.  
  235.  
  236.  
  237.  
  238. "Description": "Spoofs its process name and/or associated pathname to appear as a legitimate process",
  239. "Details":
  240.  
  241. "modified_name": "svchost.exe",
  242. "modified_path": "C:\\Users\\user\\AppData\\Roaming\\safessd\\Exeu_2c10d77928c87b499c949989143cdc9c.exe",
  243. "original_name": "svchost.exe",
  244. "original_path": "C:\\Windows\\system32\\svchost.exe"
  245.  
  246.  
  247.  
  248.  
  249. "Description": "Creates a hidden or system file",
  250. "Details":
  251.  
  252. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f3284.TMP"
  253.  
  254.  
  255. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee0e9.TMP"
  256.  
  257.  
  258. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f50ba.TMP"
  259.  
  260.  
  261. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee3a8.TMP"
  262.  
  263.  
  264. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f53d7.TMP"
  265.  
  266.  
  267. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f6348.TMP"
  268.  
  269.  
  270. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee7ee.TMP"
  271.  
  272.  
  273. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeafb.TMP"
  274.  
  275.  
  276. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeaec.TMP"
  277.  
  278.  
  279. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eecef.TMP"
  280.  
  281.  
  282. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f7bf1.TMP"
  283.  
  284.  
  285. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac8a69.TMP"
  286.  
  287.  
  288. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f82d6.TMP"
  289.  
  290.  
  291. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ef953.TMP"
  292.  
  293.  
  294. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efaf9.TMP"
  295.  
  296.  
  297. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efbe3.TMP"
  298.  
  299.  
  300. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efe26.TMP"
  301.  
  302.  
  303. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac940d.TMP"
  304.  
  305.  
  306. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f8ab6.TMP"
  307.  
  308.  
  309. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f00a6.TMP"
  310.  
  311.  
  312.  
  313.  
  314. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  315. "Details":
  316.  
  317. "McAfee": "Artemis!2C10D55726C8"
  318.  
  319.  
  320. "Cylance": "Unsafe"
  321.  
  322.  
  323. "AegisLab": "Trojan.Multi.Generic.4!c"
  324.  
  325.  
  326. "APEX": "Malicious"
  327.  
  328.  
  329. "Paloalto": "generic.ml"
  330.  
  331.  
  332. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  333.  
  334.  
  335. "Avast": "FileRepMalware"
  336.  
  337.  
  338. "Rising": "Malware.FakeFolder@CV!1.6AC4 (CLASSIC)"
  339.  
  340.  
  341. "Invincea": "heuristic"
  342.  
  343.  
  344. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.fc"
  345.  
  346.  
  347. "FireEye": "Generic.mg.2c10d55726c85b49"
  348.  
  349.  
  350. "SentinelOne": "DFI - Malicious PE"
  351.  
  352.  
  353. "Webroot": "W32.Trojan.Gen"
  354.  
  355.  
  356. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  357.  
  358.  
  359. "Acronis": "suspicious"
  360.  
  361.  
  362. "AVG": "FileRepMalware"
  363.  
  364.  
  365. "Cybereason": "malicious.b26fb4"
  366.  
  367.  
  368. "CrowdStrike": "win/malicious_confidence_90% (W)"
  369.  
  370.  
  371. "Qihoo-360": "HEUR/QVM03.0.C883.Malware.Gen"
  372.  
  373.  
  374.  
  375.  
  376. "Description": "Creates a copy of itself",
  377. "Details":
  378.  
  379. "copy": "C:\\Users\\user\\AppData\\Roaming\\safessd\\Exeu_2c10d77928c87b499c949989143cdc9c.exe"
  380.  
  381.  
  382.  
  383.  
  384. "Description": "Attempts to disable Windows Defender",
  385. "Details":
  386.  
  387.  
  388. "Description": "Anomalous binary characteristics",
  389. "Details":
  390.  
  391. "anomaly": "Actual checksum does not match that reported in PE header"
  392.  
  393.  
  394.  
  395.  
  396.  
  397. * Started Service:
  398.  
  399. * Mutexes:
  400. "Global\\CLR_CASOFF_MUTEX",
  401. "Global\\838B6C9EB27932960"
  402.  
  403.  
  404. * Modified Files:
  405. "C:\\Users\\user\\AppData\\Roaming\\safessd\\Exeu_2c10d77928c87b499c949989143cdc9c.exe",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  407. "\\??\\PIPE\\srvsvc",
  408. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\3TPLDKNW2IFFVZ4ZVOQ1.temp",
  409. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f3284.TMP",
  410. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DWMZ4M6ZTQ8KOBTTSR1F.temp",
  411. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee0e9.TMP",
  412. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\IDJWF0XEOTWJDKAY1ENE.temp",
  413. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f50ba.TMP",
  414. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\DRONV8JK886EACDYWUZS.temp",
  415. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee3a8.TMP",
  416. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\H3KRL9TMAQVFDD6P7H4V.temp",
  417. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f53d7.TMP",
  418. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\ZIXX3IUWF1HU1JJOV19P.temp",
  419. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f6348.TMP",
  420. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\F0OJ79CUII4V09JE7VWI.temp",
  421. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee7ee.TMP",
  422. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\CHHH80AKM2TGYGVATE5V.temp",
  423. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeafb.TMP",
  424. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\RYAVOIG17EHG0ZLJVQBJ.temp",
  425. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeaec.TMP",
  426. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\TKKZ9MC1YTRUHKFXDVF2.temp",
  427. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eecef.TMP",
  428. "C:\\Users\\user\\AppData\\Roaming\\safessd\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  429. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1OV63HFD4A4RKRERY1AF.temp",
  430. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f7bf1.TMP",
  431. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\VZNQBH2ZDVUP3FADXAOK.temp",
  432. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac8a69.TMP",
  433. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\L4OLDOD5DFKEVMMO42YR.temp",
  434. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f82d6.TMP",
  435. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\O5U9KFP79KP2WCZAQF2M.temp",
  436. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ef953.TMP",
  437. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5JG9AHP76CJEA8RHPRV2.temp",
  438. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efaf9.TMP",
  439. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\AOBSRY1O1KTDQNYZBK35.temp",
  440. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efbe3.TMP",
  441. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\4ZDS4EFYWM5TNDK263NF.temp",
  442. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efe26.TMP",
  443. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\PPFW6HX6P3CKR35BTMIJ.temp",
  444. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac940d.TMP",
  445. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\W2OK0JBS85FU0SI9YQO9.temp",
  446. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f8ab6.TMP",
  447. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\SMNOV1E8UZ53JMHFPP3O.temp",
  448. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f00a6.TMP",
  449. "C:\\Windows\\sysnative\\Tasks\\Ms Dll libraries",
  450. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  451. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk"
  452.  
  453.  
  454. * Deleted Files:
  455. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f3284.TMP",
  456. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2232.10433312",
  457. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2232.10433328",
  458. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2232.10433328",
  459. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee0e9.TMP",
  460. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2624.10415437",
  461. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2624.10415453",
  462. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2624.10415453",
  463. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f50ba.TMP",
  464. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2304.10441531",
  465. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2304.10441531",
  466. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2304.10441531",
  467. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee3a8.TMP",
  468. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2556.10422906",
  469. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2556.10422906",
  470. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2556.10422906",
  471. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f53d7.TMP",
  472. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2924.10442312",
  473. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2924.10442312",
  474. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2924.10442312",
  475. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f6348.TMP",
  476. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2348.10446343",
  477. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2348.10446343",
  478. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2348.10446343",
  479. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ee7ee.TMP",
  480. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1056.10426828",
  481. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1056.10426828",
  482. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1056.10426828",
  483. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeafb.TMP",
  484. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1832.10429203",
  485. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1832.10429203",
  486. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1832.10429203",
  487. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eeaec.TMP",
  488. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2524.10429203",
  489. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2524.10429203",
  490. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2524.10429203",
  491. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9eecef.TMP",
  492. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2776.10429750",
  493. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2776.10429750",
  494. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2776.10429750",
  495. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f7bf1.TMP",
  496. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3676.10452562",
  497. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3676.10452578",
  498. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3676.10452578",
  499. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac8a69.TMP",
  500. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3804.11323312",
  501. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3804.11323312",
  502. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3804.11323328",
  503. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f82d6.TMP",
  504. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3984.10454359",
  505. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3984.10454359",
  506. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3984.10454375",
  507. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9ef953.TMP",
  508. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.4084.10435218",
  509. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.4084.10435218",
  510. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.4084.10435218",
  511. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efaf9.TMP",
  512. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3480.10434625",
  513. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3480.10434625",
  514. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3480.10434625",
  515. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efbe3.TMP",
  516. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3772.10435515",
  517. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3772.10435515",
  518. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3772.10435515",
  519. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9efe26.TMP",
  520. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.2080.10435093",
  521. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.2080.10435109",
  522. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2080.10435109",
  523. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RFac940d.TMP",
  524. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3380.11325843",
  525. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3380.11325859",
  526. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3380.11325859",
  527. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f8ab6.TMP",
  528. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3844.10456328",
  529. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3844.10456328",
  530. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3844.10456343",
  531. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF9f00a6.TMP",
  532. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.3456.10436203",
  533. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.3456.10436218",
  534. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.3456.10436218",
  535. "C:\\Windows\\Tasks\\Ms Dll libraries.job",
  536. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log"
  537.  
  538.  
  539. * Modified Registry Keys:
  540. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender",
  541. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\DisableAntiSpyware",
  542. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection",
  543. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring",
  544. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection",
  545. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable",
  546. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection",
  547. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  548. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Path",
  549. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Hash",
  550. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Id",
  551. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Ms Dll libraries\\Index",
  552. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Triggers",
  553. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\DynamicInfo"
  554.  
  555.  
  556. * Deleted Registry Keys:
  557. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job",
  558. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Ms Dll libraries.job.fp"
  559.  
  560.  
  561. * DNS Communications:
  562.  
  563. * Domains:
  564.  
  565. * Network Communication - ICMP:
  566.  
  567. * Network Communication - HTTP:
  568.  
  569. * Network Communication - SMTP:
  570.  
  571. * Network Communication - Hosts:
  572.  
  573. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!