API tools faq
paste
paladin316

Exes_31ab1bbfbe17d282a7f8079725024f2b_exe_2019-07-23_10_30.txt

paladin316
Jul 23rd, 2019
2,101
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.27 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_31ab1bbfbe17d282a7f8079725024f2b.exe"
  7. * File Size: 1221983
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "faf2ab2b47e637399545043206966fa00a9a258d0a9529e0a573bdfff236d156"
  10. * MD5: "31ab1bbfbe17d282a7f8079725024f2b"
  11. * SHA1: "5bf1fa4357ffc1db4df9dda67ffd933b4d7a77a6"
  12. * SHA512: "edc5bb651d25be8be4513326a3afe3f27d130ebfd00a7d03e5b7ee32bedb1353300a1cc8bd1d3eedbf1edfb26ca4a8b1398b6ed5b481c49d4cf3f584654a559d"
  13. * CRC32: "83A1DDDC"
  14. * SSDEEP: "24576:bNA3R5drXpd8Kr3yBtqjk9/nuFHGJYxGyiDbGAMGw0nQ:G5X4qEGU+xebGB4nQ"
  15.  
  16. * Process Execution:
  17. "Exes_31ab1bbfbe17d282a7f8079725024f2b.exe",
  18. "wscript.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hdf.vbs\"",
  23. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hdf.vbs "
  24.  
  25.  
  26. * Signatures Detected:
  27.  
  28. "Description": "Reads data out of its own binary image",
  29. "Details":
  30.  
  31. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00000000, length: 0x00000007"
  32.  
  33.  
  34. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00000000, length: 0x00002000"
  35.  
  36.  
  37. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00000007, length: 0x0012a558"
  38.  
  39.  
  40. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00001ff0, length: 0x00002000"
  41.  
  42.  
  43. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00003fe0, length: 0x00002000"
  44.  
  45.  
  46. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00005fd0, length: 0x00002000"
  47.  
  48.  
  49. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00007fc0, length: 0x00002000"
  50.  
  51.  
  52. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00009fb0, length: 0x00002000"
  53.  
  54.  
  55. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0000bfa0, length: 0x00002000"
  56.  
  57.  
  58. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0000df90, length: 0x00002000"
  59.  
  60.  
  61. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0000ff80, length: 0x00002000"
  62.  
  63.  
  64. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00011f70, length: 0x00002000"
  65.  
  66.  
  67. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00013f60, length: 0x00002000"
  68.  
  69.  
  70. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00015f50, length: 0x00002000"
  71.  
  72.  
  73. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00017f40, length: 0x00002000"
  74.  
  75.  
  76. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00019f30, length: 0x00002000"
  77.  
  78.  
  79. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0001bf20, length: 0x00002000"
  80.  
  81.  
  82. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0001df10, length: 0x00002000"
  83.  
  84.  
  85. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0001ff00, length: 0x00002000"
  86.  
  87.  
  88. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00021ef0, length: 0x00002000"
  89.  
  90.  
  91. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00023ee0, length: 0x00002000"
  92.  
  93.  
  94. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00025ed0, length: 0x00002000"
  95.  
  96.  
  97. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00027ec0, length: 0x00002000"
  98.  
  99.  
  100. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00029eb0, length: 0x00002000"
  101.  
  102.  
  103. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0002bea0, length: 0x00002000"
  104.  
  105.  
  106. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0002de90, length: 0x00002000"
  107.  
  108.  
  109. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0002fe80, length: 0x00002000"
  110.  
  111.  
  112. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00031e70, length: 0x00002000"
  113.  
  114.  
  115. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00033e60, length: 0x00002000"
  116.  
  117.  
  118. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00035e50, length: 0x00002000"
  119.  
  120.  
  121. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00037e40, length: 0x00002000"
  122.  
  123.  
  124. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00039e30, length: 0x00002000"
  125.  
  126.  
  127. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0003be20, length: 0x00002000"
  128.  
  129.  
  130. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0003de10, length: 0x00002000"
  131.  
  132.  
  133. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0003fe00, length: 0x00002000"
  134.  
  135.  
  136. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00041df0, length: 0x00002000"
  137.  
  138.  
  139. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00043de0, length: 0x00002000"
  140.  
  141.  
  142. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00045dd0, length: 0x00002000"
  143.  
  144.  
  145. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00047dc0, length: 0x00002000"
  146.  
  147.  
  148. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00049db0, length: 0x00002000"
  149.  
  150.  
  151. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0004bda0, length: 0x00002000"
  152.  
  153.  
  154. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0004dd90, length: 0x00002000"
  155.  
  156.  
  157. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0004fd80, length: 0x00002000"
  158.  
  159.  
  160. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00050a00, length: 0x00000031"
  161.  
  162.  
  163. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00050a19, length: 0x000d5b4f"
  164.  
  165.  
  166. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00126765, length: 0x00000028"
  167.  
  168.  
  169. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00126955, length: 0x00000028"
  170.  
  171.  
  172. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00126b46, length: 0x00000028"
  173.  
  174.  
  175. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00126d1e, length: 0x00000028"
  176.  
  177.  
  178. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00126f03, length: 0x00000028"
  179.  
  180.  
  181. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001270ce, length: 0x00000028"
  182.  
  183.  
  184. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00127300, length: 0x00000028"
  185.  
  186.  
  187. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001274d2, length: 0x00000028"
  188.  
  189.  
  190. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001276c5, length: 0x00000028"
  191.  
  192.  
  193. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001278c0, length: 0x00000028"
  194.  
  195.  
  196. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00127a9a, length: 0x00000028"
  197.  
  198.  
  199. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00127cc8, length: 0x00000029"
  200.  
  201.  
  202. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00127ec0, length: 0x00000028"
  203.  
  204.  
  205. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001280ad, length: 0x00000028"
  206.  
  207.  
  208. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0012828f, length: 0x00000028"
  209.  
  210.  
  211. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128459, length: 0x00000028"
  212.  
  213.  
  214. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128634, length: 0x00000028"
  215.  
  216.  
  217. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128807, length: 0x00000028"
  218.  
  219.  
  220. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001289de, length: 0x00000028"
  221.  
  222.  
  223. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128baf, length: 0x00000029"
  224.  
  225.  
  226. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128d92, length: 0x00000028"
  227.  
  228.  
  229. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00128f84, length: 0x00000028"
  230.  
  231.  
  232. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00129154, length: 0x00000028"
  233.  
  234.  
  235. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0012933c, length: 0x00000028"
  236.  
  237.  
  238. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00129521, length: 0x00000029"
  239.  
  240.  
  241. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001296ef, length: 0x00000027"
  242.  
  243.  
  244. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x001298dc, length: 0x00000028"
  245.  
  246.  
  247. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00129ac4, length: 0x00000028"
  248.  
  249.  
  250. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00129cae, length: 0x00000028"
  251.  
  252.  
  253. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x00129e7b, length: 0x00000028"
  254.  
  255.  
  256. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0012a072, length: 0x00000027"
  257.  
  258.  
  259. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0012a273, length: 0x00000028"
  260.  
  261.  
  262. "self_read": "process: Exes_31ab1bbfbe17d282a7f8079725024f2b.exe, pid: 1840, offset: 0x0012a4a4, length: 0x0000001b"
  263.  
  264.  
  265.  
  266.  
  267. "Description": "Creates a hidden or system file",
  268. "Details":
  269.  
  270. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\swi.exe"
  271.  
  272.  
  273.  
  274.  
  275. "Description": "File has been identified by 35 Antiviruses on VirusTotal as malicious",
  276. "Details":
  277.  
  278. "MicroWorld-eScan": "Trojan.GenericKD.32167338"
  279.  
  280.  
  281. "FireEye": "Generic.mg.31ab1bbfbe17d282"
  282.  
  283.  
  284. "McAfee": "Artemis!31AB1BBFBE17"
  285.  
  286.  
  287. "Alibaba": "Trojan:Win32/Propagate.a6ac1ec8"
  288.  
  289.  
  290. "K7GW": "Riskware ( 0040eff71 )"
  291.  
  292.  
  293. "K7AntiVirus": "Riskware ( 0040eff71 )"
  294.  
  295.  
  296. "Arcabit": "Trojan.Generic.D1EAD5AA"
  297.  
  298.  
  299. "Symantec": "Trojan.Gen.MBT"
  300.  
  301.  
  302. "APEX": "Malicious"
  303.  
  304.  
  305. "Avast": "Win32:Malware-gen"
  306.  
  307.  
  308. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  309.  
  310.  
  311. "Kaspersky": "Trojan.Win32.Propagate.mcl"
  312.  
  313.  
  314. "BitDefender": "Trojan.GenericKD.32167338"
  315.  
  316.  
  317. "AegisLab": "Trojan.Win32.Propagate.4!c"
  318.  
  319.  
  320. "Ad-Aware": "Trojan.GenericKD.32167338"
  321.  
  322.  
  323. "Emsisoft": "Trojan.GenericKD.32167338 (B)"
  324.  
  325.  
  326. "Invincea": "heuristic"
  327.  
  328.  
  329. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  330.  
  331.  
  332. "Sophos": "Mal/Generic-S"
  333.  
  334.  
  335. "Paloalto": "generic.ml"
  336.  
  337.  
  338. "Microsoft": "Trojan:Win32/Dynamer!rfn"
  339.  
  340.  
  341. "Endgame": "malicious (high confidence)"
  342.  
  343.  
  344. "ViRobot": "Trojan.Win32.Z.Inject.1221983"
  345.  
  346.  
  347. "ZoneAlarm": "Trojan.Win32.Propagate.mcl"
  348.  
  349.  
  350. "GData": "Trojan.GenericKD.32167338"
  351.  
  352.  
  353. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  354.  
  355.  
  356. "ALYac": "Trojan.GenericKD.32167338"
  357.  
  358.  
  359. "Zoner": "Probably RARAutorun"
  360.  
  361.  
  362. "ESET-NOD32": "Win32/Injector.Autoit.EDP"
  363.  
  364.  
  365. "TrendMicro-HouseCall": "TROJ_GEN.R049H0CGK19"
  366.  
  367.  
  368. "Ikarus": "Trojan.Win32.Injector"
  369.  
  370.  
  371. "AVG": "Win32:Malware-gen"
  372.  
  373.  
  374. "Cybereason": "malicious.357ffc"
  375.  
  376.  
  377. "CrowdStrike": "win/malicious_confidence_70% (W)"
  378.  
  379.  
  380. "Qihoo-360": "Win32/Trojan.916"
  381.  
  382.  
  383.  
  384.  
  385. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  386. "Details":
  387.  
  388. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:faf2ab2b47e637399545043206966fa00a9a258d0a9529e0a573bdfff236d156, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  389.  
  390.  
  391.  
  392.  
  393.  
  394. * Started Service:
  395.  
  396. * Mutexes:
  397. "DefaultTabtip-MainUI",
  398. "CicLoadWinStaWinSta0",
  399. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  400. "Local\\ZoneAttributeCacheCounterMutex",
  401. "Local\\ZonesCacheCounterMutex",
  402. "Local\\ZonesLockedCacheCounterMutex"
  403.  
  404.  
  405. * Modified Files:
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\__tmp_rar_sfx_access_check_32704000",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\bwx.dat",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\kqs=gbs",
  409. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hdf.vbs",
  410. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\swi.exe",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\fjt.docx",
  412. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\guw.xl",
  413. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\mxc.dat",
  414. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\axx.ppt",
  415. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\sgh.dat",
  416. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\vvh.bmp",
  417. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hnh.xl",
  418. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\lmg.ico",
  419. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\mxm.ico",
  420. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\cdv.docx",
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\eeh.icm",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\elt.jpg",
  423. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\dqk.xl",
  424. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\qwo.icm",
  425. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\fcg.bmp",
  426. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\skj.bmp",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\wis.icm",
  428. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\pgn.ico",
  429. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\spb.mp4",
  430. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hhi.mp4",
  431. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\plw.txt",
  432. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\mim.ppt",
  433. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\caa.bmp",
  434. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\avr.dat",
  435. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\lvs.dat",
  436. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\quv.pdf",
  437. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\gpm.bmp",
  438. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\tka.ico",
  439. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\tol.pdf",
  440. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\bsw.docx",
  441. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\wfc.dat",
  442. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\ovs.txt",
  443. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\njr.jpg",
  444. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\juf.mp4",
  445. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\xat.icm",
  446. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\etg.bmp",
  447. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\cti.dat",
  448. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\tif.docx",
  449. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\iet.mp3",
  450. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\hjc.mp3",
  451. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\spw.mp4",
  452. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\tmq.bmp",
  453. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\che.docx",
  454. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\puj.xl",
  455. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\bno.mp4",
  456. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\gvh.mp3",
  457. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\soi.pdf",
  458. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\oje.jpg",
  459. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\trp.xl",
  460. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\glo.pdf"
  461.  
  462.  
  463. * Deleted Files:
  464. "C:\\Users\\user\\AppData\\Local\\Temp\\28877348\\__tmp_rar_sfx_access_check_32704000"
  465.  
  466.  
  467. * Modified Registry Keys:
  468. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  469. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect"
  470.  
  471.  
  472. * Deleted Registry Keys:
  473. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  474. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  475. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  476. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  477.  
  478.  
  479. * DNS Communications:
  480.  
  481. * Domains:
  482.  
  483. * Network Communication - ICMP:
  484.  
  485. * Network Communication - HTTP:
  486.  
  487. * Network Communication - SMTP:
  488.  
  489. * Network Communication - Hosts:
  490.  
  491. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!