API tools faq
paste
paladin316

Loki_3342d78b10ebc6da04e3892c33c56f02_exe_2019-07-27_00_30.txt

paladin316
Jul 26th, 2019
2,197
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 27.09 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Loki_3342d78b10ebc6da04e3892c33c56f02.exe"
  7. * File Size: 877222
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "46614cb4866327a606a24953ec425c2222ca9627ab1a1347b1a34562c6e137d8"
  10. * MD5: "3342d78b10ebc6da04e3892c33c56f02"
  11. * SHA1: "bf075fe152d0593c4a51363cecbc245f05bc7f83"
  12. * SHA512: "f2e8ed460abea3a282f4644811a062582bb91dd134b4da11c1bf21dc99e6e976122e9797e39ff47bfefe4b137322894ec45f57f22ce4b487f88f5cb2f7daada1"
  13. * CRC32: "62641058"
  14. * SSDEEP: "24576:0k6+c2dm2AaCLFv24cHw3jbraJMXxQg2Xf0F9S33qVikn3:0bHfQ3Hw3jYyAX8F9oKikn3"
  15.  
  16. * Process Execution:
  17. "Loki_3342d78b10ebc6da04e3892c33c56f02.exe",
  18. "dfpmwtjge.exe",
  19. "dfpmwtjge.exe",
  20. "wscript.exe",
  21. "services.exe",
  22. "lsass.exe",
  23. "taskhost.exe",
  24. "svchost.exe",
  25. "WerFault.exe",
  26. "wermgr.exe",
  27. "sc.exe",
  28. "svchost.exe"
  29.  
  30.  
  31. * Executed Commands:
  32. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwtjge.exe ",
  33. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtMw.vbs\"",
  34. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtMw.vbs ",
  35. "C:\\Windows\\system32\\lsass.exe",
  36. "taskhost.exe $(Arg0)",
  37. "C:\\Windows\\system32\\sc.exe start w32time task_started",
  38. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  39. "C:\\Windows\\system32\\svchost.exe -k LocalService",
  40. "C:\\Windows\\system32\\WerFault.exe -u -p 2080 -s 288",
  41. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\""
  42.  
  43.  
  44. * Signatures Detected:
  45.  
  46. "Description": "At least one process apparently crashed during execution",
  47. "Details":
  48.  
  49.  
  50. "Description": "Creates RWX memory",
  51. "Details":
  52.  
  53.  
  54. "Description": "Detected script timer window indicative of sleep style evasion",
  55. "Details":
  56.  
  57. "Window": "WSH-Timer"
  58.  
  59.  
  60.  
  61.  
  62. "Description": "A process attempted to delay the analysis task.",
  63. "Details":
  64.  
  65. "Process": "dfpmwtjge.exe tried to sleep 985 seconds, actually delayed analysis time by 0 seconds"
  66.  
  67.  
  68.  
  69.  
  70. "Description": "Reads data out of its own binary image",
  71. "Details":
  72.  
  73. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00000000, length: 0x00000007"
  74.  
  75.  
  76. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00000000, length: 0x00002000"
  77.  
  78.  
  79. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00000007, length: 0x000d629f"
  80.  
  81.  
  82. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00001ff0, length: 0x00002000"
  83.  
  84.  
  85. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00003fe0, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00005fd0, length: 0x00002000"
  89.  
  90.  
  91. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00007fc0, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00009fb0, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0000bfa0, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0000df90, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0000ff80, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00011f70, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00013f60, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00015f50, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00017f40, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00019f30, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0001bf20, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0001df10, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0001ff00, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00021ef0, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00023ee0, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00025ed0, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00027ec0, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00029eb0, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0002bea0, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0002de90, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0002fe80, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00031e70, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00033e60, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00035e50, length: 0x00002000"
  161.  
  162.  
  163. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00037e40, length: 0x00002000"
  164.  
  165.  
  166. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00039e30, length: 0x00002000"
  167.  
  168.  
  169. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0003be20, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0003de10, length: 0x00002000"
  173.  
  174.  
  175. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x0003fe00, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00041df0, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00043de0, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00045dd0, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00047dc0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00049800, length: 0x00000031"
  191.  
  192.  
  193. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x00049819, length: 0x0008ca14"
  194.  
  195.  
  196. "self_read": "process: Loki_3342d78b10ebc6da04e3892c33c56f02.exe, pid: 1764, offset: 0x000d629e, length: 0x00000008"
  197.  
  198.  
  199. "self_read": "process: dfpmwtjge.exe, pid: 1832, offset: 0x00000000, length: 0x00071800"
  200.  
  201.  
  202. "self_read": "process: wscript.exe, pid: 1712, offset: 0x00000000, length: 0x00000040"
  203.  
  204.  
  205. "self_read": "process: wscript.exe, pid: 1712, offset: 0x000000f0, length: 0x00000018"
  206.  
  207.  
  208. "self_read": "process: wscript.exe, pid: 1712, offset: 0x000001e8, length: 0x00000078"
  209.  
  210.  
  211. "self_read": "process: wscript.exe, pid: 1712, offset: 0x00018000, length: 0x00000020"
  212.  
  213.  
  214. "self_read": "process: wscript.exe, pid: 1712, offset: 0x00018058, length: 0x00000018"
  215.  
  216.  
  217. "self_read": "process: wscript.exe, pid: 1712, offset: 0x000181a8, length: 0x00000018"
  218.  
  219.  
  220. "self_read": "process: wscript.exe, pid: 1712, offset: 0x00018470, length: 0x00000010"
  221.  
  222.  
  223. "self_read": "process: wscript.exe, pid: 1712, offset: 0x00018640, length: 0x00000012"
  224.  
  225.  
  226.  
  227.  
  228. "Description": "A process created a hidden window",
  229. "Details":
  230.  
  231. "Process": "dfpmwtjge.exe -> C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtMw.vbs"
  232.  
  233.  
  234.  
  235.  
  236. "Description": "Executed a process and injected code into it, probably while unpacking",
  237. "Details":
  238.  
  239. "Injection": "dfpmwtjge.exe(1832) -> dfpmwtjge.exe(1364)"
  240.  
  241.  
  242.  
  243.  
  244. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  245. "Details":
  246.  
  247. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 11513202 times"
  248.  
  249.  
  250.  
  251.  
  252. "Description": "Steals private information from local Internet browsers",
  253. "Details":
  254.  
  255. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  256.  
  257.  
  258.  
  259.  
  260. "Description": "Installs itself for autorun at Windows startup",
  261. "Details":
  262.  
  263. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\dfpmwt"
  264.  
  265.  
  266. "data": "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtnak.vbs"
  267.  
  268.  
  269.  
  270.  
  271. "Description": "Creates a hidden or system file",
  272. "Details":
  273.  
  274. "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
  275.  
  276.  
  277. "file": "C:\\Users\\user\\AppData\\Roaming\\474604"
  278.  
  279.  
  280.  
  281.  
  282. "Description": "File has been identified by 28 Antiviruses on VirusTotal as malicious",
  283. "Details":
  284.  
  285. "MicroWorld-eScan": "Trojan.GenericKD.32185034"
  286.  
  287.  
  288. "FireEye": "Generic.mg.3342d78b10ebc6da"
  289.  
  290.  
  291. "Arcabit": "Trojan.Generic.D1EB1ACA"
  292.  
  293.  
  294. "Invincea": "heuristic"
  295.  
  296.  
  297. "Symantec": "Trojan Horse"
  298.  
  299.  
  300. "APEX": "Malicious"
  301.  
  302.  
  303. "Avast": "Win32:Malware-gen"
  304.  
  305.  
  306. "Kaspersky": "Backdoor.Win32.Androm.sxoj"
  307.  
  308.  
  309. "BitDefender": "Trojan.GenericKD.32185034"
  310.  
  311.  
  312. "F-Secure": "Trojan.TR/Injector.mljwq"
  313.  
  314.  
  315. "DrWeb": "Trojan.PWS.Siggen2.24251"
  316.  
  317.  
  318. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.cc"
  319.  
  320.  
  321. "Emsisoft": "Trojan.GenericKD.32185034 (B)"
  322.  
  323.  
  324. "Paloalto": "generic.ml"
  325.  
  326.  
  327. "Jiangmin": "Trojan.Generic.dkxgc"
  328.  
  329.  
  330. "Avira": "TR/Injector.mljwq"
  331.  
  332.  
  333. "Microsoft": "Trojan:Win32/Azorult.DS!MTB"
  334.  
  335.  
  336. "Endgame": "malicious (high confidence)"
  337.  
  338.  
  339. "ZoneAlarm": "Backdoor.Win32.Androm.sxoj"
  340.  
  341.  
  342. "GData": "Trojan.GenericKD.32185034"
  343.  
  344.  
  345. "McAfee": "Artemis!3342D78B10EB"
  346.  
  347.  
  348. "ESET-NOD32": "a variant of Generik.BUQMHBG"
  349.  
  350.  
  351. "Ikarus": "Trojan.Win32.Azorult"
  352.  
  353.  
  354. "MaxSecure": "Win.MxResIcn.Heur.Gen"
  355.  
  356.  
  357. "AVG": "Win32:Malware-gen"
  358.  
  359.  
  360. "Panda": "Trj/CI.A"
  361.  
  362.  
  363. "CrowdStrike": "win/malicious_confidence_60% (W)"
  364.  
  365.  
  366. "Qihoo-360": "HEUR/QVM06.3.C163.Malware.Gen"
  367.  
  368.  
  369.  
  370.  
  371. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  372. "Details":
  373.  
  374.  
  375. "Description": "Harvests credentials from local FTP client softwares",
  376. "Details":
  377.  
  378. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
  379.  
  380.  
  381. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  382.  
  383.  
  384. "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
  385.  
  386.  
  387. "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
  388.  
  389.  
  390. "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
  391.  
  392.  
  393. "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
  394.  
  395.  
  396. "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
  397.  
  398.  
  399. "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
  400.  
  401.  
  402. "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
  403.  
  404.  
  405. "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
  406.  
  407.  
  408.  
  409.  
  410. "Description": "Harvests information related to installed instant messenger clients",
  411. "Details":
  412.  
  413. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  414.  
  415.  
  416.  
  417.  
  418. "Description": "Harvests information related to installed mail clients",
  419. "Details":
  420.  
  421. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  422.  
  423.  
  424. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
  425.  
  426.  
  427. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  428.  
  429.  
  430. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  431.  
  432.  
  433. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
  434.  
  435.  
  436. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
  437.  
  438.  
  439. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  440.  
  441.  
  442. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  443.  
  444.  
  445. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  446.  
  447.  
  448. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
  449.  
  450.  
  451. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
  452.  
  453.  
  454. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  455.  
  456.  
  457. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  458.  
  459.  
  460. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  461.  
  462.  
  463. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
  464.  
  465.  
  466. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  467.  
  468.  
  469. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
  470.  
  471.  
  472. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
  473.  
  474.  
  475. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
  476.  
  477.  
  478. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
  479.  
  480.  
  481. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  482.  
  483.  
  484. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  485.  
  486.  
  487. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  488.  
  489.  
  490. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  491.  
  492.  
  493. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
  494.  
  495.  
  496. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  497.  
  498.  
  499. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  500.  
  501.  
  502. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
  503.  
  504.  
  505. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
  506.  
  507.  
  508. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  509.  
  510.  
  511. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  512.  
  513.  
  514. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  515.  
  516.  
  517. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  518.  
  519.  
  520. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  521.  
  522.  
  523. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
  524.  
  525.  
  526.  
  527.  
  528. "Description": "Collects information to fingerprint the system",
  529. "Details":
  530.  
  531.  
  532.  
  533. * Started Service:
  534. "VaultSvc",
  535. "WerSvc",
  536. "W32Time"
  537.  
  538.  
  539. * Mutexes:
  540. "DefaultTabtip-MainUI",
  541. "CicLoadWinStaWinSta0",
  542. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  543. "Local\\ZoneAttributeCacheCounterMutex",
  544. "Local\\ZonesCacheCounterMutex",
  545. "Local\\ZonesLockedCacheCounterMutex",
  546. "6EFA73A4746045B65DEE781E",
  547. "Local\\WERReportingForProcess2080",
  548. "Global\\\\xe5\\x88\\x90\\xc2\\x8d",
  549. "Global\\\\xed\\x95\\xb0\\x14",
  550. "WERUI_BEX64-eb71ef964c95de5826f5dbf6417783430b96dd1"
  551.  
  552.  
  553. * Modified Files:
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_25422312",
  555. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwtjge.exe",
  556. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwt.bmp",
  557. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwt.ocx",
  558. "C:\\Users\\user\\AppData\\Roaming\\dfpmwtdfpmwt\\dfpmwteyp.exe",
  559. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwteyp.exe",
  560. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtMw.vbs",
  561. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwt.bmp",
  562. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtdoh.vbs",
  563. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtnak.vbs",
  564. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  565. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
  566. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  567. "C:\\Windows\\sysnative\\LogFiles\\Scm\\7bbc503c-5977-4798-a4ae-61483a7e030d",
  568. "C:\\Windows\\sysnative\\LogFiles\\Scm\\0efb1c2e-8bcc-468c-aa07-37b1f761840f",
  569. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE0A.tmp.appcompat.txt",
  570. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1F3.tmp.WERInternalMetadata.xml",
  571. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB223.tmp.hdmp",
  572. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD6E.tmp.mdmp",
  573. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\WERAE0A.tmp.appcompat.txt",
  574. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\WERB1F3.tmp.WERInternalMetadata.xml",
  575. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\WERB223.tmp.hdmp",
  576. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\WERBD6E.tmp.mdmp",
  577. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\Report.wer",
  578. "\\??\\PIPE\\lsarpc",
  579. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\Report.wer.tmp"
  580.  
  581.  
  582. * Deleted Files:
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_25422312",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwt.ocx",
  585. "C:\\Users\\user\\AppData\\Local\\dfpmwt\\dfpmwtMw.vbs",
  586. "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\dfpmwtjge.exe",
  588. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE0A.tmp",
  589. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERAE0A.tmp.appcompat.txt",
  590. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1F3.tmp",
  591. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB1F3.tmp.WERInternalMetadata.xml",
  592. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB223.tmp",
  593. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERB223.tmp.hdmp",
  594. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD6E.tmp",
  595. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERBD6E.tmp.mdmp",
  596. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_eb71ef964c95de5826f5dbf6417783430b96dd1_cab_0915be0a\\Report.wer.tmp"
  597.  
  598.  
  599. * Modified Registry Keys:
  600. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  601. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  602. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\dfpmwt",
  603. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  604. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\Type",
  605. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  606. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
  607. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\W32Time\\TimeProviders\\NtpClient\\SpecialPollTimeRemaining"
  608.  
  609.  
  610. * Deleted Registry Keys:
  611. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  612. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  613. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  614. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  615.  
  616.  
  617. * DNS Communications:
  618.  
  619. "type": "A",
  620. "request": "erxst.info",
  621. "answers":
  622.  
  623.  
  624.  
  625. * Domains:
  626.  
  627. "ip": "",
  628. "domain": "erxst.info"
  629.  
  630.  
  631.  
  632. * Network Communication - ICMP:
  633.  
  634. * Network Communication - HTTP:
  635.  
  636. * Network Communication - SMTP:
  637.  
  638. * Network Communication - Hosts:
  639.  
  640. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!