Advertisement
VRad

#troldesh12-140918

Sep 15th, 2018
14,219
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 15.27 KB | None | 0 0
  1. #IOC #OptiData #VR #12&140918 #troldesh #ransom #FTP #SCR #consolidated list
  2.  
  3. email_subjects:(updated 13/09)
  4. -----------------------------
  5.  
  6. Платіжна інформація 9/12/2018
  7. інформація 6065341
  8. інформація 2194379
  9. інформація 2836783
  10. інформація 1438232
  11. ЗВIТ ПЛЮС
  12.  
  13. mail_servers: (updated 13/09)
  14. -----------------------------
  15. 72.52.210.40
  16. 66.60.130.30
  17. 212.54.57.99
  18. 212.54.57.98
  19. 212.54.57.96
  20. 194.79.65.168
  21.  
  22. email_accounts: (updated 15/09)
  23. -----------------------------
  24. yordo@optanet.hu
  25. xmax_@arcor.de
  26. xina17@iol.pt
  27. wilfried.schugt@arcor.de
  28. wilfried.goermar@arcor.de
  29. w.hansing@arcor.de
  30. vox@iol.pt
  31. vo-zi@arcor.de
  32. vitortei@iol.pt
  33. violetta8@iol.pt
  34. vincentschwiedeps@arcor.de
  35. varan@arcor.de
  36. vampira1977@arcor.de
  37. v.paap-kw@arcor.de
  38. umette@arcor.de
  39. tuffydina@arcor.de
  40. trevormoore@gfgrigg.co.uk
  41. torsten1173@arcor.de
  42. tom@hannahdavid.co.uk
  43. toluiz@iol.pt
  44. tobisperling@arcor.de
  45. tim@momotimo.co.uk
  46. tiff1pets@reliable-mail.com
  47. tidus@arcor.de
  48. tibe99@arcor.de
  49. thwagner@arcor.de
  50. thomasvogt1@arcor.de
  51. thomassassone@studiosassone.com
  52. thomas.croy@arcor.de
  53. thebergners@arcor.de
  54. tfcoelho@iol.pt
  55. teresa.barata@iol.pt
  56. tanoariacrispim@iol.pt
  57. tania.f.rodrigues@iol.pt
  58. t.rick@arcor.de
  59. stralaga@arcor.de
  60. stolen@ghettojam.net
  61. stkroeger@arcor.de
  62. stinakra@arcor.de
  63. stevesteel@arcor.de
  64. steve@stephenlloydphotography.co.uk
  65. steve.compton@ntlworld.com
  66. sternentreiber@arcor.de
  67. starmar@iol.pt
  68. spamfelix@arcor.de
  69. sokrates30000@arcor.de
  70. siriusgrey@iol.pt
  71. silversurger77@arcor.de
  72. silvano.merati@ebod.it
  73. silke.berg@arcor.de
  74. selina39@arcor.de
  75. sebastian.strobl@arcor.de
  76. satriana@arcor.de
  77. sara@woodsidestables.com
  78. sandmann.bonn@arcor.de
  79. samed.yilmaz@arcor.de
  80. sadoc@arcor.de
  81. ruimsloureiro@iol.pt
  82. ruim13@iol.pt
  83. rugolottosilvio@arnet.com.ar
  84. rud224@arcor.de
  85. ruckdo@arcor.de
  86. roylee@ntu.edu.tw
  87. rosenstolz-100@arcor.de
  88. ronnsen_g@arcor.de
  89. rolligerbaer@arcor.de
  90. rolf.kissel@arcor.de
  91. roland.steurer@arcor.de
  92. robiwahn@vodafone.de
  93. robert@templinforestry.com
  94. robert.kagan@arcor.de
  95. ritaportela@iol.pt
  96. ricksilva@iol.pt
  97. res@sanderosa.com
  98. rellacnc@arcor.de
  99. regan.electrical@ntlworld.com
  100. raven@skymail.ro
  101. rainer.garbas@arcor.de
  102. rainer.baum@arcor.de
  103. raimondkiess@arcor.de
  104. raffaele@artone.it
  105. r97943032@ntu.edu.tw
  106. r95b46015@ntu.edu.tw
  107. r94628205@ntu.edu.tw
  108. r94548037@ntu.edu.tw
  109. r92524050@ntu.edu.tw
  110. r91522714@ntu.edu.tw
  111. r88630005@ntu.edu.tw
  112. r02525009@ntu.edu.tw
  113. qpecota@surewest.net
  114. praxis-schroeder@arcor.de
  115. pprovidencia@iol.pt
  116. potorico@arcor.de
  117. pjami@nc-ts.com
  118. pintozeluis@iol.pt
  119. pietrascha@arcor.de
  120. pictures@v6e.co.uk
  121. phuting@lantic.net
  122. philippklemm@arcor.de
  123. philipboy@iol.pt
  124. pflaguna@iol.pt
  125. peterbartzsen@arcor.de
  126. pete@thebigchill.co.uk
  127. percas@iol.pt
  128. peppels53@arcor.de
  129. pedroluiscorreia@iol.pt
  130. pbecker1958@arcor.de
  131. paulo_moreira_79@iol.pt
  132. paulalucas@iol.pt
  133. paul@paulbrownsphotography.co.uk
  134. palax@arcor.de
  135. p00521702@ntu.edu.tw
  136. p-morell@stofanet.dk
  137. otheostismousikis@arcor.de
  138. osswald.frank@arcor.de
  139. opf03@arcor.de
  140. onkel-mike@arcor.de
  141. onapp@iol.pt
  142. oliviagrilo11@iol.pt
  143. oli-gerhard@arcor.de
  144. olga_rodrigues@iol.pt
  145. okamerlog@arcor.de
  146. oezdinc@arcor.de
  147. norer@arcor.de
  148. nol.melkert@quicknet.nl
  149. noah.crocoll@arcor.de
  150. nina_faria@iol.pt
  151. niklas76@arcor.de
  152. neoteo@iol.pt
  153. neke81@arcor.de
  154. ndsous@iol.pt
  155. nadaf@arcor.de
  156. n.lodder@arcor.de
  157. murdock3@arcor.de
  158. mudis@arcor.de
  159. motalver@iol.pt
  160. misti@mistivanzandt.com
  161. mickey@e1.ru
  162. michappe2@arcor.de
  163. metalion@iol.pt
  164. memnune1975@arcor.de
  165. max_tuga@iol.pt
  166. master_balduin@arcor.de
  167. martin-panusch@arcor.de
  168. markxy2@arcor.de
  169. marketing@maliziacompany.com
  170. mariomaltez@iol.pt
  171. mariobechtel@arcor.de
  172. mario.muehlbach@arcor.de
  173. margret.germann@arcor.de
  174. marcwonoadi@arcor.de
  175. marcocoimbraramos@iol.pt
  176. marco.dieterich@arcor.de
  177. marcgehrig@arcor.de
  178. manuelwollwinder@arcor.de
  179. manuelmonteiro1974@iol.pt
  180. manfred-kilzer@arcor.de
  181. maneabm@iol.pt
  182. maildodk@iol.pt
  183. madiel@arcor.de
  184. m.hauss-labouvie@arcor.de
  185. luzia_araujo@iol.pt
  186. lukas.grafl@bnet.at
  187. luisbastos@iol.pt
  188. luis10513@iol.pt
  189. louby_lou@ntlworld.com
  190. liliamarques@iol.pt
  191. lf012r2929@blueyonder.co.uk
  192. leonardomau@iol.pt
  193. lars.sylvia@arcor.de
  194. kuthja91@arcor.de
  195. krollikowsky@arcor.de
  196. knutwartenberg@arcor.de
  197. kingsaydin@arcor.de
  198. kholliday@freeuk.com
  199. kevin.varley@nprojx.co.uk
  200. kd-53@arcor.de
  201. katrin.bohls@arcor.de
  202. kasten.m@arcor.de
  203. karen@ultimateparty.co.uk
  204. kaierle@arcor.de
  205. kadiraga60@arcor.de
  206. j_a_s@iol.pt
  207. justkill@iol.pt
  208. jushin@arcor.de
  209. julian@mammothmusic.co.uk
  210. julian-friedrich@arcor.de
  211. juliamc@iol.pt
  212. jorgedealmeida@iol.pt
  213. jon.snow@oneweekmedia.co.uk
  214. jon.lale@researchpartners.co.uk
  215. john_pinto1998@iol.pt
  216. johannes.steinbrecher@arcor.de
  217. joernbuettner@arcor.de
  218. joergglissmann@arcor.de
  219. jochen.laur@arcor.de
  220. joaquim123@iol.pt
  221. joaonn13@iol.pt
  222. joao.pereira.lopes@iol.pt
  223. jmaia79@iol.pt
  224. jm3ze@iol.pt
  225. jill.robson2@ntlworld.com
  226. jcp76@iol.pt
  227. janinacaspers@arcor.de
  228. jane@yolo-events.co.uk
  229. james.naylor@huntor.co.uk
  230. jacqueline.page2@ntlworld.com
  231. jackson-_-five@arcor.de
  232. j.zynda@arcor.de
  233. j.morgan06@blueyonder.co.uk
  234. j.belem@iol.pt
  235. intermailand@arcor.de
  236. ingridh@canl.nc
  237. ingolf-elsner@arcor.de
  238. info@touchpaperdesign.co.uk
  239. info@solosicurezza.com
  240. info@nerocipria.it
  241. info@murraypaterson.co.uk
  242. info@jamesholmes.co.uk
  243. info@hotelvilladina.it
  244. info@fotoidea.com
  245. info@ck-mea.nl
  246. info@carrozzerialaini.it
  247. info@brentkastner.com
  248. info@blownawayweddings.co.uk
  249. info@arthurguesthouse.co.uk
  250. info@amalichedesigns.co.uk
  251. ines.zuege@arcor.de
  252. indyer@arcor.de
  253. icke22@arcor.de
  254. ian.p.hamilton@virgin.net
  255. hugo_china@iol.pt
  256. hpestana@iol.pt
  257. holmes@iol.pt
  258. hmmacedo@iol.pt
  259. hildegard.dittiger@arcor.de
  260. highjaqqer@arcor.de
  261. henrike.esgen@arcor.de
  262. heko6057a@arcor.de
  263. hectorhruiz@arnet.com.ar
  264. hcma01@ntu.edu.tw
  265. hardrein@arcor.de
  266. harald.lungwitz@arcor.de
  267. handydaten@arcor.de
  268. hagen.deike@arcor.de
  269. hadariel@arcor.de
  270. gueudorrl@arcor.de
  271. guenteraussmann@arcor.de
  272. gtdesk@iol.pt
  273. glendower@execulink.com
  274. ghall@ewaveconsulting.co.uk
  275. gerd.waldorf@arcor.de
  276. ge-47se@arcor.de
  277. gabrielcosta@iol.pt
  278. g.singh120@ntlworld.com
  279. freelyon@iol.pt
  280. fredbadou@disroot.org
  281. franz216@arcor.de
  282. frankoliversaul@arcor.de
  283. fpimentel@iol.pt
  284. foppaxl@arcor.de
  285. filipe.t@iol.pt
  286. filipe.m.rodrigues@iol.pt
  287. filipe.carvalho@arcor.de
  288. fam.buchmann@arcor.de
  289. fabianahrens@arcor.de
  290. fabian.schossau@arcor.de
  291. f.paul.pp@arcor.de
  292. exog@arcor.de
  293. eugene@wuget.co.uk
  294. eruysal5@arcor.de
  295. ereccius@arcor.de
  296. epamafia@iol.pt
  297. engelchen1959@alice.de
  298. engelbert-edinger@arcor.de
  299. elli.winter@arcor.de
  300. elkantino@arcor.de
  301. eassmus@arcor.de
  302. eadavid@arcor.de
  303. dvanbeek@arcor.de
  304. dubidubidam@arcor.de
  305. dragaoruiamorim@iol.pt
  306. downloadz@iol.pt
  307. dolcefraccica@arcor.de
  308. dodo-wark@arcor.de
  309. djpoeta@iol.pt
  310. djflexa@arcor.de
  311. dinhdu@arcor.de
  312. dimi.ch@arcor.de
  313. derwildenorden@arcor.de
  314. derglagla@arcor.de
  315. derek.cooper141@ntlworld.com
  316. denis.pielka@arcor.de
  317. dci@deeper-dci.com
  318. davide_ricardo@iol.pt
  319. david@palmerland.co.uk
  320. david@dh9design.co.uk
  321. danielkempgen@arcor.de
  322. d94527010@ntu.edu.tw
  323. d94124001@ntu.edu.tw
  324. d91121007@ntu.edu.tw
  325. d.wind@arcor.de
  326. d.miller@admprint-mail.co.uk
  327. c_ortiz@arcor.de
  328. c_m_s@iol.pt
  329. cytomic@arcor.de
  330. cthao@ntu.edu.tw
  331. contie@arcor.de
  332. cojahn@arcor.de
  333. coimpro@coimpro.it
  334. codigo_de_barras@iol.pt
  335. clora@arcor.de
  336. clemo.w@arcor.de
  337. clee@brownrecov.com
  338. claudia_ferreir@iol.pt
  339. cjonientz@arcor.de
  340. cico5@arcor.de
  341. christianfuhrberg@arcor.de
  342. christi@malonis.com
  343. chrissifuessel@arcor.de
  344. chixson@thinkingofme.com
  345. chenrj@ntu.edu.tw
  346. chairman@phoenixhc.co.uk
  347. catia.dias@iol.pt
  348. catarinafidalgo@iol.pt
  349. castro.julio@iol.pt
  350. cascovinha@iol.pt
  351. carvalhont@iol.pt
  352. carstenconstabel@arcor.de
  353. carpenocta@arcor.de
  354. caroline@consciousmanagement.co.uk
  355. carblast@arcor.de
  356. capsantos@iol.pt
  357. capelocoelho@iol.pt
  358. c.burbach@arcor.de
  359. buchholz27@arcor.de
  360. brharun@arcor.de
  361. bre90oplign@reliable-mail.com
  362. br3z3l@arcor.de
  363. botbot@arcor.de
  364. bopejo@arcor.de
  365. bogdan55@arcor.de
  366. bjdsimoes@iol.pt
  367. bernhardschild1@arcor.de
  368. berak1@arcor.de
  369. belmichel@arcor.de
  370. batyr4@arcor.de
  371. bastianbe@arcor.de
  372. baroudi@iol.pt
  373. badneo@arcor.de
  374. bacherohd@iol.pt
  375. b99401101@ntu.edu.tw
  376. b98502029@ntu.edu.tw
  377. b97101045@ntu.edu.tw
  378. b96501020@ntu.edu.tw
  379. b95612025@ntu.edu.tw
  380. b95302308@ntu.edu.tw
  381. b91401042@ntu.edu.tw
  382. b87607057@ntu.edu.tw
  383. b01208013@ntu.edu.tw
  384. b01207053@ntu.edu.tw
  385. b.weisskirchen@arcor.de
  386. ateichmann06@arcor.de
  387. arslanu@arcor.de
  388. apr044@arcor.de
  389. apaulacbrito@iol.pt
  390. apassadico@iol.pt
  391. anton8848@bahnhof.se
  392. angelo.c@iol.pt
  393. angelliu@ntu.edu.tw
  394. angelamurfitt@amfmltd.co.uk
  395. andy-lieb@arcor.de
  396. andraax@arcor.de
  397. anaruteribeiro@iol.pt
  398. anap2003@iol.pt
  399. anakar1@iol.pt
  400. anabela.jmspereira@iol.pt
  401. ampimenta@iol.pt
  402. amiri111@arcor.de
  403. alison@allstarcatering.co.uk
  404. albrandl@arcor.de
  405. albert_steffi@arcor.de
  406. afr-bhc@arcor.de
  407. adsa196@iol.pt
  408. Admin@sweettreatsinkeswick.co.uk
  409. acjjh@ntlworld.com
  410. acfry@gil.com.au
  411. accounts@lincolngifts.co.uk
  412. a.igor@arcor.de
  413.  
  414. link to ftp
  415. -----------
  416. f11p:\amair:gxIR!tg50Xwt@amair{.} com.au/public_html/administrator/components/com_admin/helpers/html/123-info001.zip
  417. f11p:\amair:gxIR!tg50Xwt@amair{.} com.au/public_html/administrator/components/com_contact/helpers/html/eoplata007.zip
  418. f11p:\bimbella:q2h1q8a8n5@ftp.bimbellabeef.com{.} au/public_html/mngd001.zip
  419. f11p:\dabaco:RqPid6!!!H0Iz5f@ftp.dabaco.com{.} au/public_html/administrator/components/com_admin/helpers/html/0297_docs_tre_88.zip
  420. f11p:\dabaco:RqPid6!!!H0Iz5f@ftp.dabaco{.} com.au/public_html/administrator/components/com_contenthistory/helpers/html/0297_docs_tre_88.zip
  421. f11p:\etrain:*!?qfP#^QgU%@e-train.com{.} au/public_html/eoplata007.zip
  422. f11p:\f189031:s3yn9bsk@cpfacilitation.com{.} au/webspace/httpdocs/wordpress/wp-content/plugins/contact-form-7/images/Prvd_docs.zip
  423. f11p:\f189031:s3yn9bsk@cpfacilitation.com{.} au/webspace/httpdocs/wordpress/wp-content/plugins/contact-form-7/images/docs_spwo_374.zip
  424. f11p:\f189031:s3yn9bsk@cpfacilitation{.} com.au/webspace/httpdocs/wordpress/wp-admin/images/docs_spwo_374.zip
  425. f11p:\freedomp:E8o1s8qpW5@freedompublishing{.} com.au/.cagefs/var/cache/php-opcache/d949132ff7e5a1b34f35758ccce8ff12/home/freedomp/public_html/eoplata007.zip
  426. f11p:\freedomp:E8o1s8qpW5@freedompublishing{.} com.au/.trash/HTML/eoplata007.zip
  427. f11p:\j0elb:d3al4@users.tpg.com{.} au/selattyncottages/images/docs_spwo_374.zip
  428. f11p:\makoblue:london92@www.makoblue{.} com.au/public_html/2018/administrator/components/com_joomdoc/libraries/joomdoc/html/123-info001.zip
  429. f11p:\mergit.com{.} au:a1d4nm143y@s46950.gridserver{.} com/domains/mergit.com{.} au/html/mergit/v00.01.13/tmp/Prvd_docs.zip
  430. f11p:\mergit{.} com.au:a1d4nm143y@s46950.gridserver{.} com/domains/mergit{.} com.au/html/mergit/v00.02.01/tmp/docs_spwo_374.zip
  431. f11p:\sbbccom/#?-bWZ(Z_v3;@ftp.sbbc.com{.} au/.cagefs/var/cache/php-opcache/d949132ff7e5a1b34f35758ccce8ff12/home/sbbccom/public_html/mngd001.zip
  432. f11p:\thefooda:tZu89(!pi[n6@ftp.thefoodplace{.} net/.htpasswds/public_html/02836200.zip
  433. f11p:\thestore:Soot777!@thestoreroomnsw.com{.} au/public_html/administrator/templates/khepri/html/123-info001.zip
  434. f11p:\thestore:Soot777!@thestoreroomnsw{.} com.au/public_html/0297_docs_tre_88.zip
  435. f11p:\thestore:Soot777!@thestoreroomnsw{.} com.au/public_html/administrator/templates/khepribackup/html/0297_docs_tre_88.zip
  436. f11p:\topuksto:zrhqh3j1ka4q19la@europa.servers.rbl-mer.misp.co{.} uk/mail/.Drafts/tmp/docs_spwo_374.zip
  437. f11p:\topuksto:zrhqh3j1ka4q19la@europa.servers.rbl-mer.misp.co{.} uk/mail/ukbargaincentral.com/steve.bartlett/.Sent/tmp/docs_spwo_374.zip
  438. f11p:\topuksto:zrhqh3j1ka4q19la@ftp.ukbargaincentral{.} com/mail/ukbargaincentral.com/steve.bartlett/.Junk/tmp/Prvd_docs.zip
  439. f11p:\topuksto:zrhqh3j1ka4q19la@ftp.ukbargaincentral{.} com/tmp/docs_spwo_374.zip
  440. f11p:\wontasti:85221064@ftp.wontastic{.} com/.htpasswds/public_html/0297_docs_tre_88.zip
  441. f11p:\wontasti:85221064@ftp.wontastic{.} com/.trash/kitchen/wp-content/plugins/jetpack/modules/minileven/images/docs_spwo_374.zip
  442. f11p:\wontasti:85221064@ftp.wontastic{.} com/.trash/kitchen/wp-content/plugins/meeting-scheduler-by-vcita/images/docs_spwo_374.zip
  443. f11p:\zvillanovaplaye:ATWaS1948@villanovaplayers{.} com/httpdocs/images/Prvd_docs.zip
  444.  
  445. ZIP Containers:
  446. -----------------------------
  447. SHA-256 aa819503e6fa943c7802a6fd1d14b918fd33cf9ad97fba7140cdd7742e5192bb
  448. File name Prvd_docs.zip
  449. File size 853.95 KB
  450.  
  451. SHA-256 8b9b32c0965a707f26aaa9d8c316bba46d850ef768ebd1d9f2449325a311e15c
  452. File name mngd001.zip
  453. File size 853.77 KB
  454.  
  455. SHA-256 a6275b8c4e9e87c9ee9091454ddbd6e6dc8ba3724325d544bb00b2f529e2f181
  456. File name 02836200.zip
  457. File size 853.84 KB
  458.  
  459.  
  460. Payloads:
  461. -----------------------------
  462. SHA-256 270cbd6b5c344b952eb23b3383b30c4b97dc3f5b3e7702c61bb08c19e7f0320a
  463. File name docs_spwo_374.scr
  464. File size 911 KB
  465.  
  466.  
  467. SHA-256 e7f43c2e20deb45a295eb7f3774c238e29a4a89e3d2487d9f852ada216052148
  468. File name 0297_docs_tre_88.scr
  469. File size 911 KB
  470.  
  471. SHA-256 0aaacae7ea064efd5964ac7833ebffa6d024f47b2c6ea98ea35a1cf91c8e6ebc
  472. File name docs_factur_91418.scr (EXE) !This program cannot be run in DOS mode.
  473. File size 902.5 KB
  474.  
  475. ransom_note
  476. ----------
  477. Вашu файлы были зашuфpoваны.
  478. Чтoбы раcшифроваmь uх, Вам нeoбxoдuмo oтпpавuть koд:
  479. 85F93484188BBACD2983|864|6|8
  480. на элекmpoнный адpeс VladimirScherbinin1991@gmail{.} com .
  481. http://cryptsen7fo43rr6.onion.to/
  482. http://cryptsen7fo43rr6.onion.cab/
  483.  
  484. servers
  485. -------
  486. 178.254.31.125 www.yj6noqyybrkxksujcc{.} com
  487. 185.73.220.8 www.irceqahj{.} com
  488. 194.109.206.212 www.7jyfbwm43{.} com
  489. 178.254.31.125 www.75nbnem2gnkbxi36u{.} com
  490. 185.73.220.8 www.3tk7ugirbvnsyai3kjb{.} com
  491. 104.16.16.96
  492. 104.16.17.96
  493. 104.16.20.96
  494. 104.18.34.131
  495. 128.31.0.39
  496. 171.25.193.9
  497. 172.104.85.43
  498. 208.83.223.34
  499. 62.138.7.171
  500. 89.163.225.145
  501.  
  502.  
  503. network_compromised
  504. -------------------
  505. docs_factur_91418.scr 3800 TCP 127.0.0.1 49593 127.0.0.1 49594 ESTABLISHED
  506. docs_factur_91418.scr 3800 TCP 127.0.0.1 49594 127.0.0.1 49593 ESTABLISHED
  507. docs_factur_91418.scr 3800 TCP 10.0.2.15 49595 194.109.206.212 443 ESTABLISHED
  508. docs_factur_91418.scr 3800 TCP 10.0.2.15 49596 171.25.193.9 80 ESTABLISHED
  509. docs_factur_91418.scr 3800 TCP 10.0.2.15 49597 185.73.220.8 443 ESTABLISHED
  510. docs_factur_91418.scr 3800 TCP 10.0.2.15 49598 178.254.31.125 443 ESTABLISHED
  511. docs_factur_91418.scr 3800 TCP 10.0.2.15 49599 51.158.70.41 9001 ESTABLISHED
  512.  
  513. file_system_activity
  514. -------------------
  515. C:\ProgramData\Windows\csrss.exe |created hidden folder
  516.  
  517. C:\Users\user\AppData\Local\Temp\6893A5D897\state.tmp
  518. -> New: C:\Users\user\AppData\Local\Temp\6893A5D897\state
  519. C:\Users\user\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp
  520. -> New: C:\Users\user\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus
  521. C:\Users\user\AppData\Local\Temp\6893A5D897\cached-certs.tmp
  522. -> New: C:\Users\user\AppData\Local\Temp\6893A5D897\cached-certs
  523. C:\Users\user\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus.tmp
  524. -> New: C:\Users\user\AppData\Local\Temp\6893A5D897\cached-microdesc-consensus
  525. C:\Users\user\AppData\Local\Temp\6893A5D897\state.tmp
  526. -> New: C:\Users\user\AppData\Local\Temp\6893A5D897\state
  527.  
  528. persist
  529. - - - -
  530. Client Server Runtime Subsystem c:\programdata\windows\csrss.exe 22.05.2017 2:53
  531.  
  532. key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem
  533. data: "C:\ProgramData\Windows\csrss.exe"
  534.  
  535. regkeyval: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\System32\Configuration\sh1
  536.  
  537. delete shadovcopies
  538. -------------------
  539. command: C:\Windows\system32\vssadmin.exe List Shadows
  540. command: C:\Windows\system32\vssadmin.exe Delete Shadows /All /Quiet
  541.  
  542. # # #
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement