128 lines
2.4 KiB
Plaintext
128 lines
2.4 KiB
Plaintext
-----BEGIN RSA PRIVATE KEY-----Trojan:Win64/AbuseCommMain.KG
|
|
18abe3218da414ffe887ea63eee8015840d37e607b4a558e8ddeccbc7835726b
|
|
18abe3218da414ffe887ea63eee8015840d37e607b4a558e8ddeccbc7835726b
|
|
\tox\18abe3218da414ffe887ea63eee8015840d37e607b4a558e8ddeccbc7835726b.hstrTrojan:Win64/AbuseCommMain.KG!sms
|
|
Trojan:Win64/AbuseCommBack.KG
|
|
;ea1
|
|
18abe3218da414ffe887ea63eee8015840d37e607b4a558e8ddeccbc7835726b
|
|
tableid18abe3218da414ffe887ea63eee8015840d37e607b4a558e8ddeccbc7835726bidTrojan:Win64/AbuseCommBack.KG!sms
|
|
Trojan:Win64/AbuseCommMain.KH
|
|
0e72456dfc641d0f0043debd2f43775500a4e04ce497dec6d96b63f45d2def3c
|
|
0e72456dfc641d0f0043debd2f43775500a4e04ce497dec6d96b63f45d2def3c
|
|
\tox\0e72456dfc641d0f0043debd2f43775500a4e04ce497dec6d96b63f45d2def3c.hstrTrojan:Win64/AbuseCommMain.KH!sms
|
|
Trojan:Win64/AbuseCommBack.KH
|
|
0e72456dfc641d0f0043debd2f43775500a4e04ce497dec6d96b63f45d2def3c
|
|
lljknoikzqq_~s|]
|
|
ixkgpovmjpkindez{u}xn
|
|
}gzbnillvujnu[iuqmvkrfxy
|
|
ewlsfurlShmoqg|h
|
|
pu~jhsKtm]en
|
|
kwlzk
|
|
kpllsrclgm\_u|zq
|
|
k`rlwlnjx~unougoquo
|
|
rrrlhwo~l}~grSxswjijwlvavrpilfn
|
|
wv~feiqrzr}
|
|
bsiud|_qkenxXiys|r`uln
|
|
l`ykvx
|
|
pj]ulxskpoobmgu}|bwqcvoo
|
|
{t`iumiypnqpqwou^uzsskl\Xq
|
|
f^k|lrxqrrovo[jlppzjpmohw]pp
|
|
elyotjwqesmn
|
|
fneulmil}nxsuo
|
|
--
|
|
BEGIN RSA PRIVATE KEYB
|
|
:Search File Using ExtensionS
|
|
Trojan:O97M/EncDoc.RR!MTB
|
|
`"target="https://forms.pabbly.com/form/share/
|
|
"targetmode="external"/>
|
|
s:Yk
|
|
("appdata")
|
|
&"\microsoft\windows\startmenu\programs\startup\kefe.bat"
|
|
="qgvjag8gb2zmdqpzxmnoxnreyv5zxmtecyavy3jly
|
|
B)Exclusion:Revobfoos
|
|
#ATTR_0000409b
|
|
SCPT:O97M/EncDoc.RRAL!MTB
|
|
gi]a
|
|
Y=#ATTR_0000409c
|
|
#ATTR_0000409d
|
|
SCPT:O97M/EncDoc.RR_0109!MTB
|
|
aAdwin.RJ!MTB
|
|
#ATTR_0000409e
|
|
VirTool:PowerShell/Impez.A!MTB
|
|
#ATTR_0000409f
|
|
SCRIPT:PowerShell/GPPAutologon.A2
|
|
#ATTR_000040a0
|
|
SCRIPT:SambaCry_pipe
|
|
#ATTR_000040a1
|
|
#ATTR_000040a2
|
|
SCRIPT:PsInvoke.B
|
|
#ATTR_000040a3
|
|
SCRIPT:PsInteropser.A
|
|
#ATTR_000040a4
|
|
#ATTR_000040a5
|
|
SCRIPT:PowerShell/Impez.A1
|
|
--
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
MIIEpQIBAAKCAQEAyksIb+yLYHfrgDQu
|
|
SELECT * FROM Win32_BaseBoardcmd.exe /C ipconaeiCertsFF.dat
|
|
CertsOP.dat
|
|
!Eigivef
|
|
!Fracarawa.A
|
|
.}SIG:Fracarawa.A1
|
|
HSTR:Fracarawa.A1
|
|
!AutInject.CC
|
|
!AutInject.CD
|
|
FIcs
|
|
1.`*
|
|
FIcs
|
|
FIcs
|
|
1.g*
|
|
Wnf
|
|
WDSC
|
|
FIcs
|
|
1.m&
|
|
FIcs
|
|
1.d*
|
|
Sect
|
|
oVjc
|
|
FIcs
|
|
1.e*
|
|
FIcs
|
|
FIcs
|
|
1.K(
|
|
Sect
|
|
oVjc
|
|
FIcs
|
|
--
|
|
-----BEGIN RSA PRIVATE KEY-----
|
|
-----BEGIN DSA PRIVATE KEY-----
|
|
L$(H
|
|
l$ L
|
|
L$@H
|
|
[]_^A\A]A^A_
|
|
D$0H
|
|
L$(H
|
|
D$0H1
|
|
AVVWSH
|
|
([_^A^
|
|
VWSH
|
|
[_^
|
|
O8Hc
|
|
D$0I
|
|
L$ L
|
|
D$@H1
|
|
VWSH
|
|
D$XH
|
|
D$XH1
|
|
`[_^
|
|
IPH9
|
|
D$0H
|
|
D$ M
|
|
D$0H1
|
|
AVVWSH
|
|
([_^A^
|
|
([^I
|
|
D$0H
|
|
L$(H
|
|
L$(H
|