API tools faq
paste
paladin316

Exes_671c3de7d5f589b80b83b4c7fb38977b_exe_2019-07-23_09_30.txt

paladin316
Jul 23rd, 2019
2,106
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 41.64 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_671c3de7d5f589b80b83b4c7fb38977b.exe"
  7. * File Size: 1356559
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "eb2d3cade25c04322d59c521106ab9708e9dfe8af0b1eddbc66bf997652b86fa"
  10. * MD5: "671c3de7d5f589b80b83b4c7fb38977b"
  11. * SHA1: "41876c54470bc4190b9f679cdc39857cbb981d3a"
  12. * SHA512: "aa55371768f4a0800091ee3e5ac4789a0b7dd8b735fff053d066adfaf54a7955eeb40587df08d4c5a94012e9473b1605f0979d5974b42254797bb98348fce7fe"
  13. * CRC32: "F5332896"
  14. * SSDEEP: "24576:bNA3R5drXpd6G/B8HskGM0zrqFhYfs7UaFjn48ogzEOFhCylFHGJYxGyiDbGAMGU:G5X6IB8Hp+zrQhf7UaFj48jAOFhCylUS"
  15.  
  16. * Process Execution:
  17. "Exes_671c3de7d5f589b80b83b4c7fb38977b.exe",
  18. "wscript.exe",
  19. "iet.exe",
  20. "iet.exe",
  21. "wscript.exe",
  22. "iet.exe",
  23. "iet.exe",
  24. "wscript.exe",
  25. "iet.exe",
  26. "iet.exe",
  27. "wscript.exe",
  28. "iet.exe",
  29. "iet.exe",
  30. "wscript.exe",
  31. "iet.exe",
  32. "iet.exe",
  33. "wscript.exe",
  34. "iet.exe",
  35. "iet.exe",
  36. "wscript.exe",
  37. "iet.exe",
  38. "iet.exe",
  39. "wscript.exe",
  40. "iet.exe",
  41. "iet.exe",
  42. "wscript.exe",
  43. "iet.exe",
  44. "iet.exe",
  45. "wscript.exe",
  46. "iet.exe",
  47. "iet.exe",
  48. "wscript.exe",
  49. "iet.exe",
  50. "iet.exe",
  51. "RegSvcs.exe"
  52.  
  53.  
  54. * Executed Commands:
  55. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\boh.vbs\"",
  56. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\boh.vbs ",
  57. "\"C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe\" sqg=glx",
  58. "iet.exe sqg=glx",
  59. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\QHGJZ",
  60. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\run.vbs\"",
  61. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\run.vbs ",
  62. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FAZTS",
  63. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\PDSXE",
  64. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\OOMVZ",
  65. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\MMEHM",
  66. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\AHQUS",
  67. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\WDEMX",
  68. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FOFYQ",
  69. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\NJPFW",
  70. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\THBMI",
  71. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\JHWHR"
  72.  
  73.  
  74. * Signatures Detected:
  75.  
  76. "Description": "Possible date expiration check, exits too soon after checking local time",
  77. "Details":
  78.  
  79. "process": "iet.exe, PID 2772"
  80.  
  81.  
  82.  
  83.  
  84. "Description": "Creates RWX memory",
  85. "Details":
  86.  
  87.  
  88. "Description": "Detected script timer window indicative of sleep style evasion",
  89. "Details":
  90.  
  91. "Window": "WSH-Timer"
  92.  
  93.  
  94.  
  95.  
  96. "Description": "A process attempted to delay the analysis task.",
  97. "Details":
  98.  
  99. "Process": "wscript.exe tried to sleep 660 seconds, actually delayed analysis time by 0 seconds"
  100.  
  101.  
  102.  
  103.  
  104. "Description": "Expresses interest in specific running processes",
  105. "Details":
  106.  
  107. "process": "mscorsvw.exe"
  108.  
  109.  
  110. "process": "RegSvcs.exe"
  111.  
  112.  
  113.  
  114.  
  115. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  116. "Details":
  117.  
  118.  
  119. "Description": "Reads data out of its own binary image",
  120. "Details":
  121.  
  122. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00000000, length: 0x00000007"
  123.  
  124.  
  125. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00000000, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00000007, length: 0x0014b308"
  129.  
  130.  
  131. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00001ff0, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00003fe0, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00005fd0, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00007fc0, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00009fb0, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0000bfa0, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0000df90, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0000ff80, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00011f70, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00013f60, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00015f50, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00017f40, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00019f30, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0001bf20, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0001df10, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0001ff00, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00021ef0, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00023ee0, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00025ed0, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00027ec0, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00029eb0, length: 0x00002000"
  192.  
  193.  
  194. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0002bea0, length: 0x00002000"
  195.  
  196.  
  197. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0002de90, length: 0x00002000"
  198.  
  199.  
  200. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0002fe80, length: 0x00002000"
  201.  
  202.  
  203. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00031e70, length: 0x00002000"
  204.  
  205.  
  206. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00033e60, length: 0x00002000"
  207.  
  208.  
  209. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00035e50, length: 0x00002000"
  210.  
  211.  
  212. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00037e40, length: 0x00002000"
  213.  
  214.  
  215. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00039e30, length: 0x00002000"
  216.  
  217.  
  218. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0003be20, length: 0x00002000"
  219.  
  220.  
  221. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0003de10, length: 0x00002000"
  222.  
  223.  
  224. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0003fe00, length: 0x00002000"
  225.  
  226.  
  227. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00041df0, length: 0x00002000"
  228.  
  229.  
  230. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00043de0, length: 0x00002000"
  231.  
  232.  
  233. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00045dd0, length: 0x00002000"
  234.  
  235.  
  236. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00047dc0, length: 0x00002000"
  237.  
  238.  
  239. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00049db0, length: 0x00002000"
  240.  
  241.  
  242. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0004bda0, length: 0x00002000"
  243.  
  244.  
  245. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0004dd90, length: 0x00002000"
  246.  
  247.  
  248. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0004fd80, length: 0x00002000"
  249.  
  250.  
  251. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00050a00, length: 0x00000031"
  252.  
  253.  
  254. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00050a19, length: 0x000f753c"
  255.  
  256.  
  257. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148151, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148380, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148559, length: 0x00000028"
  264.  
  265.  
  266. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148741, length: 0x00000028"
  267.  
  268.  
  269. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148915, length: 0x00000028"
  270.  
  271.  
  272. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148b00, length: 0x00000028"
  273.  
  274.  
  275. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148d2f, length: 0x00000028"
  276.  
  277.  
  278. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00148f1e, length: 0x00000028"
  279.  
  280.  
  281. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149105, length: 0x00000028"
  282.  
  283.  
  284. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149313, length: 0x00000028"
  285.  
  286.  
  287. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x001494ea, length: 0x00000028"
  288.  
  289.  
  290. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149719, length: 0x00000028"
  291.  
  292.  
  293. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014992f, length: 0x00000028"
  294.  
  295.  
  296. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149b27, length: 0x00000028"
  297.  
  298.  
  299. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149d35, length: 0x00000028"
  300.  
  301.  
  302. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x00149f24, length: 0x00000028"
  303.  
  304.  
  305. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014a104, length: 0x00000028"
  306.  
  307.  
  308. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014a2ef, length: 0x00000028"
  309.  
  310.  
  311. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014a4ca, length: 0x00000028"
  312.  
  313.  
  314. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014a6c4, length: 0x00000028"
  315.  
  316.  
  317. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014a8dd, length: 0x00000028"
  318.  
  319.  
  320. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014aac0, length: 0x00000028"
  321.  
  322.  
  323. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014aca8, length: 0x00000029"
  324.  
  325.  
  326. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014ae8f, length: 0x00000028"
  327.  
  328.  
  329. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014b059, length: 0x00000028"
  330.  
  331.  
  332. "self_read": "process: Exes_671c3de7d5f589b80b83b4c7fb38977b.exe, pid: 1448, offset: 0x0014b254, length: 0x0000001b"
  333.  
  334.  
  335. "self_read": "process: wscript.exe, pid: 2720, offset: 0x00000000, length: 0x00000040"
  336.  
  337.  
  338. "self_read": "process: wscript.exe, pid: 2720, offset: 0x000000f0, length: 0x00000018"
  339.  
  340.  
  341. "self_read": "process: wscript.exe, pid: 2720, offset: 0x000001e8, length: 0x00000078"
  342.  
  343.  
  344. "self_read": "process: wscript.exe, pid: 2720, offset: 0x00018000, length: 0x00000020"
  345.  
  346.  
  347. "self_read": "process: wscript.exe, pid: 2720, offset: 0x00018058, length: 0x00000018"
  348.  
  349.  
  350. "self_read": "process: wscript.exe, pid: 2720, offset: 0x000181a8, length: 0x00000018"
  351.  
  352.  
  353. "self_read": "process: wscript.exe, pid: 2720, offset: 0x00018470, length: 0x00000010"
  354.  
  355.  
  356. "self_read": "process: wscript.exe, pid: 2720, offset: 0x00018640, length: 0x00000012"
  357.  
  358.  
  359. "self_read": "process: wscript.exe, pid: 1652, offset: 0x00000000, length: 0x00000040"
  360.  
  361.  
  362. "self_read": "process: wscript.exe, pid: 1652, offset: 0x000000f0, length: 0x00000018"
  363.  
  364.  
  365. "self_read": "process: wscript.exe, pid: 1652, offset: 0x000001e8, length: 0x00000078"
  366.  
  367.  
  368. "self_read": "process: wscript.exe, pid: 1652, offset: 0x00018000, length: 0x00000020"
  369.  
  370.  
  371. "self_read": "process: wscript.exe, pid: 1652, offset: 0x00018058, length: 0x00000018"
  372.  
  373.  
  374. "self_read": "process: wscript.exe, pid: 1652, offset: 0x000181a8, length: 0x00000018"
  375.  
  376.  
  377. "self_read": "process: wscript.exe, pid: 1652, offset: 0x00018470, length: 0x00000010"
  378.  
  379.  
  380. "self_read": "process: wscript.exe, pid: 1652, offset: 0x00018640, length: 0x00000012"
  381.  
  382.  
  383. "self_read": "process: wscript.exe, pid: 980, offset: 0x00000000, length: 0x00000040"
  384.  
  385.  
  386. "self_read": "process: wscript.exe, pid: 980, offset: 0x000000f0, length: 0x00000018"
  387.  
  388.  
  389. "self_read": "process: wscript.exe, pid: 980, offset: 0x000001e8, length: 0x00000078"
  390.  
  391.  
  392. "self_read": "process: wscript.exe, pid: 980, offset: 0x00018000, length: 0x00000020"
  393.  
  394.  
  395. "self_read": "process: wscript.exe, pid: 980, offset: 0x00018058, length: 0x00000018"
  396.  
  397.  
  398. "self_read": "process: wscript.exe, pid: 980, offset: 0x000181a8, length: 0x00000018"
  399.  
  400.  
  401. "self_read": "process: wscript.exe, pid: 980, offset: 0x00018470, length: 0x00000010"
  402.  
  403.  
  404. "self_read": "process: wscript.exe, pid: 980, offset: 0x00018640, length: 0x00000012"
  405.  
  406.  
  407. "self_read": "process: wscript.exe, pid: 2172, offset: 0x00000000, length: 0x00000040"
  408.  
  409.  
  410. "self_read": "process: wscript.exe, pid: 2172, offset: 0x000000f0, length: 0x00000018"
  411.  
  412.  
  413. "self_read": "process: wscript.exe, pid: 2172, offset: 0x000001e8, length: 0x00000078"
  414.  
  415.  
  416. "self_read": "process: wscript.exe, pid: 2172, offset: 0x00018000, length: 0x00000020"
  417.  
  418.  
  419. "self_read": "process: wscript.exe, pid: 2172, offset: 0x00018058, length: 0x00000018"
  420.  
  421.  
  422. "self_read": "process: wscript.exe, pid: 2172, offset: 0x000181a8, length: 0x00000018"
  423.  
  424.  
  425. "self_read": "process: wscript.exe, pid: 2172, offset: 0x00018470, length: 0x00000010"
  426.  
  427.  
  428. "self_read": "process: wscript.exe, pid: 2172, offset: 0x00018640, length: 0x00000012"
  429.  
  430.  
  431. "self_read": "process: wscript.exe, pid: 716, offset: 0x00000000, length: 0x00000040"
  432.  
  433.  
  434. "self_read": "process: wscript.exe, pid: 716, offset: 0x000000f0, length: 0x00000018"
  435.  
  436.  
  437. "self_read": "process: wscript.exe, pid: 716, offset: 0x000001e8, length: 0x00000078"
  438.  
  439.  
  440. "self_read": "process: wscript.exe, pid: 716, offset: 0x00018000, length: 0x00000020"
  441.  
  442.  
  443. "self_read": "process: wscript.exe, pid: 716, offset: 0x00018058, length: 0x00000018"
  444.  
  445.  
  446. "self_read": "process: wscript.exe, pid: 716, offset: 0x000181a8, length: 0x00000018"
  447.  
  448.  
  449. "self_read": "process: wscript.exe, pid: 716, offset: 0x00018470, length: 0x00000010"
  450.  
  451.  
  452. "self_read": "process: wscript.exe, pid: 716, offset: 0x00018640, length: 0x00000012"
  453.  
  454.  
  455. "self_read": "process: wscript.exe, pid: 2476, offset: 0x00000000, length: 0x00000040"
  456.  
  457.  
  458. "self_read": "process: wscript.exe, pid: 2476, offset: 0x000000f0, length: 0x00000018"
  459.  
  460.  
  461. "self_read": "process: wscript.exe, pid: 2476, offset: 0x000001e8, length: 0x00000078"
  462.  
  463.  
  464. "self_read": "process: wscript.exe, pid: 2476, offset: 0x00018000, length: 0x00000020"
  465.  
  466.  
  467. "self_read": "process: wscript.exe, pid: 2476, offset: 0x00018058, length: 0x00000018"
  468.  
  469.  
  470. "self_read": "process: wscript.exe, pid: 2476, offset: 0x000181a8, length: 0x00000018"
  471.  
  472.  
  473. "self_read": "process: wscript.exe, pid: 2476, offset: 0x00018470, length: 0x00000010"
  474.  
  475.  
  476. "self_read": "process: wscript.exe, pid: 2476, offset: 0x00018640, length: 0x00000012"
  477.  
  478.  
  479. "self_read": "process: wscript.exe, pid: 1444, offset: 0x00000000, length: 0x00000040"
  480.  
  481.  
  482. "self_read": "process: wscript.exe, pid: 1444, offset: 0x000000f0, length: 0x00000018"
  483.  
  484.  
  485. "self_read": "process: wscript.exe, pid: 1444, offset: 0x000001e8, length: 0x00000078"
  486.  
  487.  
  488. "self_read": "process: wscript.exe, pid: 1444, offset: 0x00018000, length: 0x00000020"
  489.  
  490.  
  491. "self_read": "process: wscript.exe, pid: 1444, offset: 0x00018058, length: 0x00000018"
  492.  
  493.  
  494. "self_read": "process: wscript.exe, pid: 1444, offset: 0x000181a8, length: 0x00000018"
  495.  
  496.  
  497. "self_read": "process: wscript.exe, pid: 1444, offset: 0x00018470, length: 0x00000010"
  498.  
  499.  
  500. "self_read": "process: wscript.exe, pid: 1444, offset: 0x00018640, length: 0x00000012"
  501.  
  502.  
  503. "self_read": "process: wscript.exe, pid: 932, offset: 0x00000000, length: 0x00000040"
  504.  
  505.  
  506. "self_read": "process: wscript.exe, pid: 932, offset: 0x000000f0, length: 0x00000018"
  507.  
  508.  
  509. "self_read": "process: wscript.exe, pid: 932, offset: 0x000001e8, length: 0x00000078"
  510.  
  511.  
  512. "self_read": "process: wscript.exe, pid: 932, offset: 0x00018000, length: 0x00000020"
  513.  
  514.  
  515. "self_read": "process: wscript.exe, pid: 932, offset: 0x00018058, length: 0x00000018"
  516.  
  517.  
  518. "self_read": "process: wscript.exe, pid: 932, offset: 0x000181a8, length: 0x00000018"
  519.  
  520.  
  521. "self_read": "process: wscript.exe, pid: 932, offset: 0x00018470, length: 0x00000010"
  522.  
  523.  
  524. "self_read": "process: wscript.exe, pid: 932, offset: 0x00018640, length: 0x00000012"
  525.  
  526.  
  527. "self_read": "process: wscript.exe, pid: 2280, offset: 0x00000000, length: 0x00000040"
  528.  
  529.  
  530. "self_read": "process: wscript.exe, pid: 2280, offset: 0x000000f0, length: 0x00000018"
  531.  
  532.  
  533. "self_read": "process: wscript.exe, pid: 2280, offset: 0x000001e8, length: 0x00000078"
  534.  
  535.  
  536. "self_read": "process: wscript.exe, pid: 2280, offset: 0x00018000, length: 0x00000020"
  537.  
  538.  
  539. "self_read": "process: wscript.exe, pid: 2280, offset: 0x00018058, length: 0x00000018"
  540.  
  541.  
  542. "self_read": "process: wscript.exe, pid: 2280, offset: 0x000181a8, length: 0x00000018"
  543.  
  544.  
  545. "self_read": "process: wscript.exe, pid: 2280, offset: 0x00018470, length: 0x00000010"
  546.  
  547.  
  548. "self_read": "process: wscript.exe, pid: 2280, offset: 0x00018640, length: 0x00000012"
  549.  
  550.  
  551. "self_read": "process: wscript.exe, pid: 960, offset: 0x00000000, length: 0x00000040"
  552.  
  553.  
  554. "self_read": "process: wscript.exe, pid: 960, offset: 0x000000f0, length: 0x00000018"
  555.  
  556.  
  557. "self_read": "process: wscript.exe, pid: 960, offset: 0x000001e8, length: 0x00000078"
  558.  
  559.  
  560. "self_read": "process: wscript.exe, pid: 960, offset: 0x00018000, length: 0x00000020"
  561.  
  562.  
  563. "self_read": "process: wscript.exe, pid: 960, offset: 0x00018058, length: 0x00000018"
  564.  
  565.  
  566. "self_read": "process: wscript.exe, pid: 960, offset: 0x000181a8, length: 0x00000018"
  567.  
  568.  
  569. "self_read": "process: wscript.exe, pid: 960, offset: 0x00018470, length: 0x00000010"
  570.  
  571.  
  572. "self_read": "process: wscript.exe, pid: 960, offset: 0x00018640, length: 0x00000012"
  573.  
  574.  
  575. "self_read": "process: wscript.exe, pid: 2608, offset: 0x00000000, length: 0x00000040"
  576.  
  577.  
  578. "self_read": "process: wscript.exe, pid: 2608, offset: 0x000000f0, length: 0x00000018"
  579.  
  580.  
  581. "self_read": "process: wscript.exe, pid: 2608, offset: 0x000001e8, length: 0x00000078"
  582.  
  583.  
  584. "self_read": "process: wscript.exe, pid: 2608, offset: 0x00018000, length: 0x00000020"
  585.  
  586.  
  587. "self_read": "process: wscript.exe, pid: 2608, offset: 0x00018058, length: 0x00000018"
  588.  
  589.  
  590. "self_read": "process: wscript.exe, pid: 2608, offset: 0x000181a8, length: 0x00000018"
  591.  
  592.  
  593. "self_read": "process: wscript.exe, pid: 2608, offset: 0x00018470, length: 0x00000010"
  594.  
  595.  
  596. "self_read": "process: wscript.exe, pid: 2608, offset: 0x00018640, length: 0x00000012"
  597.  
  598.  
  599.  
  600.  
  601. "Description": "Drops a binary and executes it",
  602. "Details":
  603.  
  604. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe"
  605.  
  606.  
  607.  
  608.  
  609. "Description": "Executed a process and injected code into it, probably while unpacking",
  610. "Details":
  611.  
  612. "Injection": "iet.exe(2436) -> RegSvcs.exe(2128)"
  613.  
  614.  
  615.  
  616.  
  617. "Description": "Creates a hidden or system file",
  618. "Details":
  619.  
  620. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe"
  621.  
  622.  
  623. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\aav.icm"
  624.  
  625.  
  626. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\bkd.pdf"
  627.  
  628.  
  629. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\boh.vbs"
  630.  
  631.  
  632. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\bvd.bmp"
  633.  
  634.  
  635. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\cal.jpg"
  636.  
  637.  
  638. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\coo.docx"
  639.  
  640.  
  641. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dao.xl"
  642.  
  643.  
  644. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\drt.dat"
  645.  
  646.  
  647. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dvl.txt"
  648.  
  649.  
  650. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dxb.ppt"
  651.  
  652.  
  653. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ebj.jpg"
  654.  
  655.  
  656. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\eoi.xl"
  657.  
  658.  
  659. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\epp.bmp"
  660.  
  661.  
  662. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\etb.ppt"
  663.  
  664.  
  665. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ewl.icm"
  666.  
  667.  
  668. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\fbp.ico"
  669.  
  670.  
  671. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\gkd.mp3"
  672.  
  673.  
  674. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\gog.mp4"
  675.  
  676.  
  677. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\hdc.mp4"
  678.  
  679.  
  680. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\hne.mp4"
  681.  
  682.  
  683. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\kgw.docx"
  684.  
  685.  
  686. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\kuv.icm"
  687.  
  688.  
  689. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\mai.dat"
  690.  
  691.  
  692. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\nmf.icm"
  693.  
  694.  
  695. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\nvp.bmp"
  696.  
  697.  
  698. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ocg.ico"
  699.  
  700.  
  701. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\omj.icm"
  702.  
  703.  
  704. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ovd.icm"
  705.  
  706.  
  707. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\pki.mp4"
  708.  
  709.  
  710. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\pra.jpg"
  711.  
  712.  
  713. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\qgh.pdf"
  714.  
  715.  
  716. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\qmo.dat"
  717.  
  718.  
  719. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\rtx.pdf"
  720.  
  721.  
  722. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\sbh.dat"
  723.  
  724.  
  725. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\snu.docx"
  726.  
  727.  
  728. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\sqg=glx"
  729.  
  730.  
  731. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ssf.dat"
  732.  
  733.  
  734. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\tdu.dat"
  735.  
  736.  
  737. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\uvr.docx"
  738.  
  739.  
  740. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\vxk.txt"
  741.  
  742.  
  743. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wgm.icm"
  744.  
  745.  
  746. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wir.dat"
  747.  
  748.  
  749. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wkw.pdf"
  750.  
  751.  
  752. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wvd.bmp"
  753.  
  754.  
  755. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\xbu.bmp"
  756.  
  757.  
  758. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\xvu.pdf"
  759.  
  760.  
  761. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663"
  762.  
  763.  
  764. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ini"
  765.  
  766.  
  767. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\run.vbs"
  768.  
  769.  
  770.  
  771.  
  772. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  773. "Details":
  774.  
  775. "MicroWorld-eScan": "Trojan.GenericKD.41475500"
  776.  
  777.  
  778. "FireEye": "Generic.mg.671c3de7d5f589b8"
  779.  
  780.  
  781. "McAfee": "Artemis!671C3DE7D5F5"
  782.  
  783.  
  784. "K7AntiVirus": "Riskware ( 0040eff71 )"
  785.  
  786.  
  787. "Alibaba": "Trojan:Win32/Autoit.5f86fffd"
  788.  
  789.  
  790. "K7GW": "Riskware ( 0040eff71 )"
  791.  
  792.  
  793. "Cybereason": "malicious.4470bc"
  794.  
  795.  
  796. "TrendMicro": "TROJ_GEN.R020C0WGI19"
  797.  
  798.  
  799. "Symantec": "Trojan.Gen.MBT"
  800.  
  801.  
  802. "APEX": "Malicious"
  803.  
  804.  
  805. "Avast": "Win32:Malware-gen"
  806.  
  807.  
  808. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  809.  
  810.  
  811. "Kaspersky": "Trojan.Win32.Autoit.abzua"
  812.  
  813.  
  814. "BitDefender": "Trojan.GenericKD.41475500"
  815.  
  816.  
  817. "Tencent": "Win32.Trojan.Autoit.Auto"
  818.  
  819.  
  820. "Ad-Aware": "Trojan.GenericKD.41475500"
  821.  
  822.  
  823. "Emsisoft": "Trojan.GenericKD.41475500 (B)"
  824.  
  825.  
  826. "F-Secure": "Trojan.TR/Autoit.yxyhm"
  827.  
  828.  
  829. "Invincea": "heuristic"
  830.  
  831.  
  832. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  833.  
  834.  
  835. "Sophos": "Mal/Generic-S"
  836.  
  837.  
  838. "Avira": "TR/Autoit.yxyhm"
  839.  
  840.  
  841. "MAX": "malware (ai score=84)"
  842.  
  843.  
  844. "Microsoft": "Trojan:Win32/Bluteal!rfn"
  845.  
  846.  
  847. "Endgame": "malicious (high confidence)"
  848.  
  849.  
  850. "ZoneAlarm": "Trojan.Win32.Autoit.abzua"
  851.  
  852.  
  853. "GData": "Trojan.GenericKD.41475500"
  854.  
  855.  
  856. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  857.  
  858.  
  859. "ALYac": "Trojan.GenericKD.41475500"
  860.  
  861.  
  862. "Zoner": "Probably RARAutorun"
  863.  
  864.  
  865. "ESET-NOD32": "Win32/Injector.Autoit.EDE"
  866.  
  867.  
  868. "TrendMicro-HouseCall": "TROJ_GEN.R020C0WGI19"
  869.  
  870.  
  871. "Ikarus": "Trojan.Win32.Injector"
  872.  
  873.  
  874. "Fortinet": "AutoIt/Injector.EDE!tr"
  875.  
  876.  
  877. "AVG": "Win32:Malware-gen"
  878.  
  879.  
  880. "CrowdStrike": "win/malicious_confidence_80% (W)"
  881.  
  882.  
  883. "Qihoo-360": "HEUR/QVM06.3.999D.Malware.Gen"
  884.  
  885.  
  886.  
  887.  
  888. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  889. "Details":
  890.  
  891. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:eb2d3cade25c04322d59c521106ab9708e9dfe8af0b1eddbc66bf997652b86fa, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  892.  
  893.  
  894.  
  895.  
  896.  
  897. * Started Service:
  898.  
  899. * Mutexes:
  900. "DefaultTabtip-MainUI",
  901. "CicLoadWinStaWinSta0",
  902. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  903. "Local\\ZoneAttributeCacheCounterMutex",
  904. "Local\\ZonesCacheCounterMutex",
  905. "Local\\ZonesLockedCacheCounterMutex"
  906.  
  907.  
  908. * Modified Files:
  909. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\__tmp_rar_sfx_access_check_3904296",
  910. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wgm.icm",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\sqg=glx",
  912. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\boh.vbs",
  913. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\iet.exe",
  914. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\pki.mp4",
  915. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dao.xl",
  916. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wir.dat",
  917. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\epp.bmp",
  918. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\kgw.docx",
  919. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dxb.ppt",
  920. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\coo.docx",
  921. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\rtx.pdf",
  922. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\eoi.xl",
  923. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\fbp.ico",
  924. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\xvu.pdf",
  925. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\vxk.txt",
  926. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ewl.icm",
  927. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\sbh.dat",
  928. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\uvr.docx",
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\gog.mp4",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\qmo.dat",
  931. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\kuv.icm",
  932. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ovd.icm",
  933. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\hdc.mp4",
  934. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\dvl.txt",
  935. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\etb.ppt",
  936. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ssf.dat",
  937. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\cal.jpg",
  938. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\xbu.bmp",
  939. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\gkd.mp3",
  940. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wkw.pdf",
  941. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\nvp.bmp",
  942. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\wvd.bmp",
  943. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\mai.dat",
  944. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ebj.jpg",
  945. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\pra.jpg",
  946. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ocg.ico",
  947. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\bkd.pdf",
  948. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\bvd.bmp",
  949. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\omj.icm",
  950. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\drt.dat",
  951. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\aav.icm",
  952. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\hne.mp4",
  953. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\nmf.icm",
  954. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\snu.docx",
  955. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\tdu.dat",
  956. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\qgh.pdf",
  957. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\QHGJZ",
  958. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\ini",
  959. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\run.vbs",
  960. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FAZTS",
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\PDSXE",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\OOMVZ",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\MMEHM",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\AHQUS",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\WDEMX",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FOFYQ",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\NJPFW",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\THBMI",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\JHWHR"
  970.  
  971.  
  972. * Deleted Files:
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\__tmp_rar_sfx_access_check_3904296",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\QHGJZ",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FAZTS",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\PDSXE",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\OOMVZ",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\MMEHM",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\AHQUS",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\WDEMX",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\FOFYQ",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\NJPFW",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\THBMI",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\42225663\\JHWHR"
  985.  
  986.  
  987. * Modified Registry Keys:
  988. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  989. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  990. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  991. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  992. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  993. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vbs\\OpenWithProgids\\VBSFile"
  994.  
  995.  
  996. * Deleted Registry Keys:
  997. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  998. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  999. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1000. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
  1001.  
  1002.  
  1003. * DNS Communications:
  1004.  
  1005. * Domains:
  1006.  
  1007. * Network Communication - ICMP:
  1008.  
  1009. * Network Communication - HTTP:
  1010.  
  1011. * Network Communication - SMTP:
  1012.  
  1013. * Network Communication - Hosts:
  1014.  
  1015. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!