mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-07 02:25:19 +00:00
1975 lines
43 KiB
Plaintext
1975 lines
43 KiB
Plaintext
#
|
|
# LOKI File Name Characteristics
|
|
# This file contains regex definitions and a description
|
|
#
|
|
# APPLICATION ------------------------------------------------------------------
|
|
#
|
|
# Every line is treated as REGEX case sensitive.
|
|
# Every line includes a description that gives information about the file name
|
|
# based IOC
|
|
#
|
|
# FORMAT -----------------------------------------------------------------------
|
|
#
|
|
# # COMMENT
|
|
# REGEX;SCORE
|
|
#
|
|
# EXAMPLES ---------------------------------------------------------------------
|
|
#
|
|
# # Various examples from APT case X
|
|
# \\svcsstat\.exe;70
|
|
# \\(server|servisces|smrr|srrm|svchost|svhost|svshost|taskmrg)\.exe$;50
|
|
# ProgramData\\Mail\\MailAg\\;80
|
|
# (Anwendungsdaten|Application Data|APPDATA)\\sydmain\.dll;80
|
|
# (TEMP|Temp)\\[^\\]+\.(xmd|yls)$;80
|
|
# (LOCAL SETTINGS\\Temp|Local Settings\\Temp|Local\\Temp)\\(word\.exe|winword\.exe)[^\.];80
|
|
#
|
|
|
|
# Ncat Example
|
|
# bin\\nc\.exe;80
|
|
|
|
# Regin
|
|
\\usbclass\.sys;80
|
|
\\adpu160\.sys;80
|
|
\\msrdc64\.dat;80
|
|
\\msdcsvc\.dat;80
|
|
\\config\\SystemAudit\.Evt;80
|
|
\\config\\SecurityAudit\.Evt;80
|
|
\\config\\SystemLog\.evt;80
|
|
\\config\\ApplicationLog\.evt;80
|
|
\\ime\\imesc5\\dicts\\pintlgbs\.imd;80
|
|
\\ime\\imesc5\\dicts\\pintlgbp\.imd;80
|
|
ystem32\\winhttpc\.dll;80
|
|
ystem32\\wshnetc\.dll;80
|
|
\\SysWow64\\wshnetc\.dll;80
|
|
ystem32\\svcstat\.exe;80
|
|
ystem32\\svcsstat\.exe;80
|
|
IME\\IMESC5\\DICTS\\PINTLGBP\.IMD;80
|
|
ystem32\\wsharp\.dll;80
|
|
ystem32\\wshnetc\.dll;80
|
|
pchealth\\helpctr\\Database\\cdata\.dat;80
|
|
pchealth\\helpctr\\Database\\cdata\.edb;80
|
|
Windows\\Panther\\setup\.etl\.000;80
|
|
ystem32\\wbem\\repository\\INDEX2\.DATA;80
|
|
ystem32\\wbem\\repository\\OBJECTS2\.DATA;80
|
|
ystem32\\dnscache\.dat;80
|
|
ystem32\\mregnx\.dat;80
|
|
ystem32\\displn32\.dat;80
|
|
ystem32\\dmdskwk\.dat;80
|
|
ystem32\\nvwrsnu\.dat;80
|
|
ystem32\\tapiscfg\.dat;80
|
|
ystem32\\pciclass\.sys;80
|
|
|
|
# Five Eyes
|
|
\\20120\.dll;80
|
|
\\20121\.dll;80
|
|
\\20123\.sys;80
|
|
|
|
# Skeleton Key File Names
|
|
\\msuta64\.dll;80
|
|
\\ole64\.dll;80
|
|
|
|
# IXESHE APT Malware
|
|
\\winhlps\.exe;80
|
|
\\acrotry\.exe;80
|
|
|
|
# PlugX
|
|
(TEMP|TMP|Temp)\\DW20\.dll;80
|
|
(TEMP|TMP|Temp)\\DW20\.dll;80
|
|
(TEMP|TMP|Temp)\\dl_[0-9]{2}\.exe;80
|
|
(TEMP|TMP|Temp)\\dl_[0-9]{2}\.txt;80
|
|
(Mailing|Shipment).*Label\.exe;80
|
|
|
|
# Mandiant APT
|
|
\\Temp\\~df~;80
|
|
\\Temp\\~hf~;80
|
|
\\Temp\\~[a-z][a-z]~;80
|
|
\\start menu\\programs\\startup\\adobe_sl.exe;80
|
|
Temp\\Updatasched\.exe;80
|
|
\\adobere\.exe;80
|
|
|
|
# Mandiant APT - SHELLDC.DLL (BACKDOOR)
|
|
\\Temp\\svchost\.exe;80
|
|
\\shelldc\.dll;80
|
|
\\recyle64\.dll;80
|
|
\\ws_18\.dll;80
|
|
|
|
# Mandiant APT - LIGHTDART (FAMILY)
|
|
\\ret\.log;80
|
|
\\1\.rar;80
|
|
\\qy\.htm;80
|
|
\\shsat\.exe;80
|
|
\\imxgy\.exe;80
|
|
|
|
# Kaspersky Carbanak APT Malware Hash http://goo.gl/0Nhax2
|
|
(application data|AppData|Anwendungsdaten)\\mozilla\\[^\\]+\.bin;80
|
|
\\System32\\com\\svchost\.exe;80
|
|
\\ProgramData\\mozilla\\[^\\]+\.bin;80
|
|
\\(Windows|WinXP)\\paexec;80
|
|
SysWOW64\\com\\svchost\.exe;80
|
|
|
|
# Equation Group Malware http://goo.gl/d5ujEH
|
|
ystem32\\ee\.dll;80
|
|
# Equation Related File Name http://pastebin.com/QvZNtuQW
|
|
ystem32\\msregstr\.exe;80
|
|
ystem32\\khlp894u\.dll;80
|
|
\\__c__\.lnk;80
|
|
temp\\msupdate\.exe;80
|
|
\\fanny\.bmp;80
|
|
WINDOWS\\mlan\.exe;80
|
|
Windows\\mlan\.exe;80
|
|
|
|
# Former Suspicious File Signatures ###########################################
|
|
# They get a lower score by default
|
|
|
|
# ThreatExpert Statistics
|
|
\\winsvc\.exe$;45
|
|
\\blaah\.exe;45
|
|
\\ldr\.exe$;45
|
|
\\t\.exe$;45
|
|
\\user0\.exe;45
|
|
\\mxplay_installer\.exe;45
|
|
\\pak\-[0-9]{3,}.exe$;45
|
|
\\rundll\.exe$;45
|
|
\\windowsservice\\starter\.exe$;45
|
|
\\wrar[0-9a-z]+\\.exe$;45
|
|
\\av[0-9]+\.exe$;45
|
|
\\eixplorer\.exe;45
|
|
\\win\.exe$;45
|
|
\\cleanup\.exe$;45
|
|
\\winsystem\.exe;45
|
|
Fonts\\[\w]+\.exe$;45
|
|
\\(temp|tmp)\\server\.exe;45
|
|
\\interxpoler\.exe;45
|
|
\\networkservice\.exe;45
|
|
\\favorites\.exe;45
|
|
\\microsoft\.exe$;45
|
|
\\adobe\.exe$;45
|
|
\\cncdown\.exe$;45
|
|
\\ntcom\.dll$;45
|
|
\\nthead\.dll$;45
|
|
\\services32\.exe;45
|
|
\\recycled\.exe;45
|
|
\\sofware.exe;45
|
|
\\explorer[0-9]\.exe;45
|
|
\\criptor\.exe;45
|
|
\\crypt3r\.exe;45
|
|
\\temp\\copy\.exe;45
|
|
\\cuda\.exe;45
|
|
|
|
# Typical Malware Name
|
|
[\s]{7,}\.(exe|com|dll|bat|scr|vbs);45
|
|
\\[0-9]\.(exe|dll)$;45
|
|
\\[a-zA-Z]\.exe$;45
|
|
\.(doc|docx|pdf|txt)\.(exe|bat|com|scr|vbs)$;45
|
|
\\\.tmp$;45
|
|
(temp|tmp)\\[a-z]\.(zip|exe|txt)$;45
|
|
(temp|tmp)\\[a-z]\.rar;45
|
|
\\32\.exe;45
|
|
\\64\.exe;45
|
|
\\d\.exe;45
|
|
\\s\.exe;45
|
|
\\ss\.exe;45
|
|
\\sss\.exe;45
|
|
|
|
# Malware locations
|
|
AppData\\[\w]+\.exe;45
|
|
[Tt]emp\\[\w]{1,2}\.(exe|com|scr);45
|
|
[Cc]:\\[\w]{1,2}\.(exe|com|scr);45
|
|
|
|
# Symantec Waterbug Attack http://goo.gl/9Tlk90
|
|
\\tcpdump32c\.exe;45
|
|
\\typecli\.exe;45
|
|
\\msc32\.exe;45
|
|
\\dxsnd32x\.exe;45
|
|
\\msnetsrv\.exe;45
|
|
\\mswme32\.exe;45
|
|
\\msnetserv\.exe;45
|
|
\\msnet32\.exe;45
|
|
\\rpcsrv\.exe;45
|
|
\\charmap32\.exe;45
|
|
\\mqsvc32\.exe;45
|
|
\\msrss\.exe;45
|
|
\\dc1\.exe;45
|
|
\\svcmgr\.exe;45
|
|
\\msx32\.exe;45
|
|
\.XOR$;45
|
|
|
|
# Suspected Anthem Deep Panda APT
|
|
\\lot1\.tmp;45
|
|
|
|
# Trojan Characteristics
|
|
\\EXPL0RER\.exe;55
|
|
\\srv32\.exe;55
|
|
\\csrnss\.exe;55
|
|
\\0\.exe;55
|
|
\\ntldm\.exe;55
|
|
\\xxxc\.bat;55
|
|
\\winkept\.exe;55
|
|
Temp\\iexplore\.exe;55
|
|
\\hidserv\.exe;55
|
|
[Cc]:\\Inetpub\.lnk;55
|
|
\\zggjmyd\.exe;55
|
|
ystem32\\2bed\.exe;55
|
|
360\\sendlog\.txt;55
|
|
Windows\\[0-9a-z]+.flv;55
|
|
ystem32\\[0-9a-z]+.flv;55
|
|
\\downloaded[0-9]+\.exe;55
|
|
\\New\sFolder[^\\]+\.exe;55
|
|
\\myloveever\.exe;55
|
|
\\killer\.exe;55
|
|
\\mspool\.DLL;55
|
|
\\superproxy\.exe;55
|
|
\\zoufoo\.exe;55
|
|
\\omesuperv\.exe;50
|
|
ystem32\\dpisca\.exe;45
|
|
ystem32\\razorp\.exe;45
|
|
\\aaaaaaaa\.exe;55
|
|
\\d1\.tmp\.dll;55
|
|
\\fotos\.exe;55
|
|
\\new\.exe;60
|
|
\\image\.exe;60
|
|
\\movie\.exe;60
|
|
\\files\.exe;55
|
|
\\fun\.exe;60
|
|
\\freepdf\.exe;60
|
|
\\iexplorei\.exe;80
|
|
\\imagens\.exe;60
|
|
\\lost\.dir\.exe;70
|
|
\\new_folder\.exe;70
|
|
\\picture\.exe;65
|
|
\\play me\.exe;65
|
|
\\ppts\.exe;65
|
|
\\recycler\.exe;65
|
|
\\share_apps\.exe;65
|
|
[^s]\\video\.exe;65
|
|
\\whatsapp\.exe;65
|
|
\\xx\.exe;65
|
|
\\keygen1\.exe;65
|
|
\\meta\.exe;50
|
|
\\tmp\.exe;60
|
|
\\userfiles\.exe;65
|
|
\\nuevo\.exe;65
|
|
\\photo\.exe;65
|
|
\\pdf\.exe;65
|
|
\\_thumbs\.exe;65
|
|
\\music\.exe;65
|
|
\\picture\.exe;65
|
|
\\music\.exe;65
|
|
\\movie\.exe;65
|
|
\\skypee\.exe;65
|
|
|
|
# Rombertik / CarbonGrabber http://goo.gl/SGcS2H
|
|
\\fgf\.vbs;65
|
|
\\rsr\\yfoye\.bat;75
|
|
\\rsr\\yfoye\.exe;75
|
|
|
|
# Mimikatz Output
|
|
\.kirbi$;70
|
|
|
|
# Kraken / Laziok Bot https://goo.gl/5jvv9q
|
|
System\\Oracle\\smss\.exe;80
|
|
|
|
# CryptoWall http://goo.gl/psjCCc
|
|
\\HELP_DECRYPT\.URL;60
|
|
|
|
# Hawkeye Keylogger https://goo.gl/th5q2v
|
|
\\HawkEye_Keylogger_;70
|
|
|
|
# Kaspersky RAT Report https://goo.gl/th5q2v
|
|
\\AppData\\Roaming\\Microsoft\\[^\\]{1,32}\.(exe|doc|zip);50
|
|
\\AudioEndpointBuilder\.exe;60
|
|
\\BrokerInfrastructure\.exe;60
|
|
\\WindowsUpdate\.exe;50
|
|
|
|
# APT28 https://goo.gl/6Xiayq
|
|
Microsoft\\MediaPlayer\\updatewindws\.exe;100
|
|
\\updatewindws\.exe;70
|
|
\\netui\.dll;50
|
|
\\edg6EF885E2\.tmp;60
|
|
\\AppData\\Local\\conhost\.dll;70
|
|
\\Application Data\\conhost\.dll;70
|
|
\\Application Data\\svchost\.exe;70
|
|
\\Application Data\\conhost\.dll;70
|
|
\\AppData\\Local\\svchost\.exe;70
|
|
\\AppData\\Local\\conhost\.dll;70
|
|
|
|
# Fidelis Threat Advisory http://goo.gl/ZjJyti
|
|
\\9i86vdi3l1zi1v\\;60
|
|
\\cvaniocol\.cmd;60
|
|
\\flrsqgyy\.DVZ;60
|
|
\\ibdyambl\.vbs;60
|
|
\\ouhlolswfixh$;60
|
|
\\slie\.RJD$;60
|
|
\\znimialt\.exe;60
|
|
(Temp|Tmp|TEMP)\\cedt370r\(3\)\.exe;60
|
|
(Temp|Tmp|TEMP)\\penguin\.exe;60
|
|
\\Microsoft\\Windows\\hknswc\.exe;60
|
|
\\Microsoft\\Windows\\AppMgnt\.exe;60
|
|
\\PolicyManager$;60
|
|
\\FILE_127\.127\.ppt;60
|
|
\\FILE_127\.127\.ppsx;60
|
|
(Temp|Tmp|TEMP)\\destsx\.inf;50
|
|
(Temp|Tmp|TEMP)\\Alsa\\doub\.tmp;60
|
|
(Temp|Tmp|TEMP)\\muysf\\ipbuy.exe;70
|
|
\\Order Details\.xls\.pps;60
|
|
|
|
# Sofacy - Malware http://goo.gl/OtmPzq
|
|
\\svchost\.exe\.exe;70
|
|
|
|
# Winexesvc - Remote Execution Service - often used by Pentesters and Hackers
|
|
Windows\\winexesvc\.exe;70
|
|
|
|
# Wild Neutron File Names https://goo.gl/Qew6dT
|
|
AppData\\Roaming\\FlashUtil\.exe;60
|
|
AppData\\Roaming\\Acer\\LiveUpdater\.exe;60
|
|
AppData\\Roaming\\Realtek\\RtlUpd\.exe;60
|
|
ProgramData\\Realtek\\RtlUpd\.exe;60
|
|
AppData\\Roaming\\sqlite3\.dll;60
|
|
Windows\\winsession\.dll;60
|
|
AppData\\appdata\\local\\temp\\teamviewer\\version9\\update\.exe;60
|
|
Windows\\temp\\_dbg\.tmp;60
|
|
Windows\\temp\\ok\.tmp;60
|
|
indows\\temp\\debug\.txt;60
|
|
indows\\syswow64\\mshtaex\.exe;60
|
|
\\System32\\mshtaex\.exe;60
|
|
\\System32\\wdigestEx\.dll;60
|
|
\\System32\\dpcore16t\.dll;60
|
|
\\System32\\iastor32\.exe;60
|
|
\\System32\\mspool\.dll;60
|
|
\\System32\\msvcse\.exe;60
|
|
\\System32\\mspool\.exe;60
|
|
C:\\Program Files (x86)\\LNVSuite\\LnrAuth\.dll;60
|
|
C:\\Program Files (x86)\\LNVSuite\\LnrAuthSvc\.dll;60
|
|
C:\\Program Files (x86)\\LNVSuite\\LnrUpdt\.exe;60
|
|
C:\\Program Files (x86)\\LNVSuite\\LnrUpdtP\.exe;60
|
|
|
|
# F-Secure Wonknu APT Backdoor:W32/Wonknu.A https://goo.gl/JjVikT
|
|
\\programdata\\kav\.exe;85
|
|
\\Java_Down\.exe;80
|
|
|
|
# Phishing Wave Dez 2015
|
|
\\p0o6543f\.exe;85
|
|
|
|
# Sofacy group report Dec 2015 - https://goo.gl/WSvEM8
|
|
AppData\\Local\\Microsoft\\Windows\\msdeltemp\.dll;80
|
|
\\msdeltemp\.dll;50
|
|
\\tf394kv\.dll;75
|
|
AppData\\dllhost\.exe;80
|
|
AppData\\sechost\.exe;80
|
|
Temp\\dllhost\.exe;80
|
|
Temp\\sechost\.exe;80
|
|
AppData\\chkdbg.log;60
|
|
AppData\\svchost\.exe;80
|
|
Temp\\svchost\.exe;80
|
|
AppData\\conhost\.dll;80
|
|
Temp\\conhost\.dll;80
|
|
|
|
# FireEye Report admin@338 https://goo.gl/JAlw3s
|
|
\\upload\.rar;70
|
|
|
|
# Microsoft Intelligence Report http://goo.gl/jcS0lO
|
|
\\SupUpNvidia\.exe;80
|
|
\\svchosl\.exe;80
|
|
\\svehost\.exe;80
|
|
\\run_x64\.exe;55
|
|
\\run_x86\.exe;55
|
|
\\advstorshell\.exe;65
|
|
\\runrun\.exe;60
|
|
\\MicrosoftSup\.dll;70
|
|
|
|
# Inocnation Report - Fidelis Cybersecurity https://goo.gl/HA82xf
|
|
Temp\\Center[0-9]{6,11}\.dat;65
|
|
AppData\\adobe\\adobe\.dat;65
|
|
|
|
# Hexacorn Blog Entry - Homomorphic abuse http://goo.gl/1UGJVn
|
|
\\5hrome\.exe;45
|
|
\\a_chrome\.exe;45
|
|
\\cchrome\.exe;45
|
|
\\chorom\.exe;45
|
|
\\chr0me\.exe;45
|
|
\\chro2me\.exe;45
|
|
\\chrom\.exe;45
|
|
\\-chrome\.exe;45
|
|
\\chrome1\.exe;45
|
|
\\chrome10\.exe;45
|
|
\\chrome3\.exe;45
|
|
\\chrome32\.exe;45
|
|
\\chrome9\.exe;45
|
|
\\chromede\.exe;45
|
|
\\chromee\.exe;45
|
|
\\chromeez\.exe;45
|
|
\\chromei\.exe;45
|
|
\\chromes\.exe;45
|
|
\\chromix\.exe;45
|
|
\\chromme\.exe;45
|
|
\\chrommm\.exe;45
|
|
\\chromre\.exe;45
|
|
\\chromse\.exe;45
|
|
\\chromyy\.exe;45
|
|
\\chroom\.exe;45
|
|
\\chroome\.exe;45
|
|
\\chroum\.exe;45
|
|
\\crhome\.exe;45
|
|
\\nichrome\.exe;45
|
|
\\_cerss\.exe;45
|
|
\\_csrss\.exe;45
|
|
\\carss\.exe;45
|
|
\\ccrs\.exe;45
|
|
\\cress\.exe;45
|
|
\\crrss\.exe;45
|
|
\\crss\.exe;45
|
|
\\crsss\.exe;45
|
|
\\csrcs\.exe;45
|
|
\\csres\.exe;45
|
|
\\csriss\.exe;45
|
|
\\csrlt\.exe;45
|
|
\\csrms\.exe;45
|
|
\\csrmss\.exe;45
|
|
\\csrrss\.exe;45
|
|
\\csrs\.exe;45
|
|
\\csrsc\.exe;45
|
|
\\csrse\.exe;45
|
|
\\csrsess\.exe;45
|
|
\\csrsk\.exe;45
|
|
\\csrsl\.exe;45
|
|
\\csrsrv\.exe;45
|
|
\\csrss_1\.exe;45
|
|
\\csrss_2\.exe;45
|
|
\\csrss_8\.exe;45
|
|
\\csrss_9\.exe;45
|
|
\\csrss32\.exe;45
|
|
\\csrssa\.exe;45
|
|
\\csrssc\.exe;45
|
|
\\csrsses\.exe;45
|
|
\\csrssr\.exe;45
|
|
\\csrsss\.exe;45
|
|
\\csrssw\.exe;45
|
|
\\csrssys\.exe;45
|
|
\\csrst\.exe;45
|
|
\\csrsvc\.exe;45
|
|
\\csrsvr\.exe;45
|
|
\\csrsx\.exe;45
|
|
\\csrtss\.exe;45
|
|
\\csrus\.exe;45
|
|
\\csrvs\.exe;45
|
|
\\cssrs\.exe;45
|
|
\\cssrsa\.exe;45
|
|
\\cssrsr\.exe;45
|
|
\\cssrss\.exe;45
|
|
\\cvrss\.exe;45
|
|
\\scrss\.exe;45
|
|
\\0iexplorer\.exe;45
|
|
\\12iexplore\.exe;45
|
|
\\2ciexplore\.exe;45
|
|
\\2fexplorer\.exe;45
|
|
\\5explore\.exe;45
|
|
\\5xplorer\.exe;45
|
|
\\_iexplors\.exe;45
|
|
\\dexplorer\.exe;45
|
|
\\dxplore\.exe;45
|
|
\\e1xplorer\.exe;45
|
|
\\eexplorer\.exe;45
|
|
\\eexxplorer\.exe;45
|
|
\\eksplorer\.exe;45
|
|
\\ep1orer\.exe;45
|
|
\\esplorer\.exe;45
|
|
\\exeplorer\.exe;45
|
|
\\exlorer\.exe;45
|
|
\\exoplorer\.exe;45
|
|
\\exp10rer\.exe;45
|
|
\\exp1or\.exe;45
|
|
\\exp1ore\.exe;45
|
|
\\exp1orer\.exe;45
|
|
\\exp1ror\.exe;45
|
|
\\exp20re\.exe;45
|
|
\\expiorer\.exe;45
|
|
\\expioror\.exe;45
|
|
\\expl0rer\.exe;45
|
|
\\explarar\.exe;45
|
|
\\explarer\.exe;45
|
|
\\expleror\.exe;45
|
|
\\exploe\.exe;45
|
|
\\exploer\.exe;45
|
|
\\exploere\.exe;45
|
|
\\exploerer\.exe;45
|
|
\\exploiter\.exe;45
|
|
\\exploner\.exe;45
|
|
\\explope\.exe;45
|
|
\\explor\.exe;45
|
|
\\explora\.exe;45
|
|
\\explore\.exe;45
|
|
\\explored\.exe;45
|
|
\\exploree\.exe;45
|
|
\\exploreee\.exe;45
|
|
\\exploreff\.exe;45
|
|
\\explorei\.exe;45
|
|
\\explorep\.exe;45
|
|
\\explorer1\.exe;45
|
|
\\explorer32\.exe;45
|
|
\\explorer64\.exe;45
|
|
\\explorer66\.exe;45
|
|
\\explorer_\.exe;45
|
|
\\explorere\.exe;45
|
|
\\explorerf\.exe;45
|
|
\\explorerr\.exe;45
|
|
\\explorerrr\.exe;45
|
|
\\explorers\.exe;45
|
|
\\explorerv\.exe;45
|
|
\\explorerxx\.exe;45
|
|
\\explorerz\.exe;45
|
|
\\explores\.exe;45
|
|
\\exploret\.exe;45
|
|
\\explorew\.exe;45
|
|
\\exploror\.exe;45
|
|
\\explorr\.exe;45
|
|
\\explorre\.exe;45
|
|
\\explorrer\.exe;45
|
|
\\explorxp\.exe;45
|
|
\\explre3r\.exe;45
|
|
\\explrer\.exe;45
|
|
\\explroer\.exe;45
|
|
\\expoler\.exe;45
|
|
\\expolorer\.exe;45
|
|
\\exporer\.exe;45
|
|
\\exprer\.exe;45
|
|
\\exprlore\.exe;45
|
|
\\exproler\.exe;45
|
|
\\exqlorer\.exe;45
|
|
\\exsplorer\.exe;45
|
|
\\exxplorer\.exe;45
|
|
\\ieioplore\.exe;45
|
|
\\ieplore\.exe;45
|
|
\\ieplorer\.exe;45
|
|
\\iexeplore\.exe;45
|
|
\\iexlorer\.exe;45
|
|
\\iexlplore\.exe;45
|
|
\\iexp1ore\.exe;45
|
|
\\iexp1orer\.exe;45
|
|
\\iexpiore\.exe;45
|
|
\\iexpl0ra\.exe;45
|
|
\\iexpl0re\.exe;45
|
|
\\iexplare\.exe;45
|
|
\\iexplarer\.exe;45
|
|
\\iexplere\.exe;45
|
|
\\iexpllzore\.exe;45
|
|
\\iexplo\.exe;45
|
|
\\iexploer\.exe;45
|
|
\\iexploore\.exe;45
|
|
\\iexplope\.exe;45
|
|
\\iexplor\.exe;45
|
|
\\iexplore32\.exe;45
|
|
\\iexplorea\.exe;45
|
|
\\iexplorei\.exe;45
|
|
\\iexplorer\.exe;45
|
|
\\iexplorer0\.exe;45
|
|
\\iexplorer2\.exe;45
|
|
\\iexplorer7\.exe;45
|
|
\\iexplorers\.exe;45
|
|
\\iexplores\.exe;45
|
|
\\iexploresx\.exe;45
|
|
\\iexploror\.exe;45
|
|
\\iexplorrer\.exe;45
|
|
\\iexplors\.exe;45
|
|
\\iexplory\.exe;45
|
|
\\iexplorz\.exe;45
|
|
\\iexpore\.exe;45
|
|
\\iiexplore\.exe;45
|
|
\\iiexplorer\.exe;45
|
|
\\inexplore\.exe;45
|
|
\\inexplorer\.exe;45
|
|
\\intexplore\.exe;45
|
|
\\ixplorer\.exe;45
|
|
\\lexpiore\.exe;45
|
|
\\lexpl1re\.exe;45
|
|
\\lexpl2re\.exe;45
|
|
\\lexpl3re\.exe;45
|
|
\\lexpl4re\.exe;45
|
|
\\lexpl5re\.exe;45
|
|
\\lexpl6re\.exe;45
|
|
\\lexpl7re\.exe;45
|
|
\\lexpl8re\.exe;45
|
|
\\lexpl9re\.exe;45
|
|
\\lexplare\.exe;45
|
|
\\lexplbre\.exe;45
|
|
\\lexplcre\.exe;45
|
|
\\lexpldre\.exe;45
|
|
\\lexplere\.exe;45
|
|
\\lexplfre\.exe;45
|
|
\\lexplgre\.exe;45
|
|
\\lexplhre\.exe;45
|
|
\\lexplire\.exe;45
|
|
\\lexpljre\.exe;45
|
|
\\lexplkre\.exe;45
|
|
\\lexpllre\.exe;45
|
|
\\lexplmre\.exe;45
|
|
\\lexplnre\.exe;45
|
|
\\lexplore\.exe;45
|
|
\\lexplore_\.exe;45
|
|
\\lexplorer\.exe;45
|
|
\\lexplors\.exe;45
|
|
\\lexplpre\.exe;45
|
|
\\lexplqre\.exe;45
|
|
\\lexplrre\.exe;45
|
|
\\lexplsre\.exe;45
|
|
\\lexpltre\.exe;45
|
|
\\lexplure\.exe;45
|
|
\\lexplvre\.exe;45
|
|
\\lexplwre\.exe;45
|
|
\\lexplxre\.exe;45
|
|
\\lexplyre\.exe;45
|
|
\\lexplzre\.exe;45
|
|
\\msexplorer\.exe;45
|
|
\\netplore\.exe;45
|
|
\\plorer\.exe;45
|
|
\\vbexplorer\.exe;45
|
|
\\wexplorer\.exe;45
|
|
\\winexplore\.exe;45
|
|
\\xeplorer\.exe;45
|
|
\\xplore\.exe;45
|
|
\\xplorer\.exe;45
|
|
\\yyexplorer\\\.exe;45
|
|
\\5cfirefox\.exe;45
|
|
\\5irefox\.exe;45
|
|
\\f1ref0x\.exe;45
|
|
\\fire10fox\.exe;45
|
|
\\firef0x\.exe;45
|
|
\\firefly\.exe;45
|
|
\\firefo\.exe;45
|
|
\\firefox_\.exe;45
|
|
\\firefox2\.exe;45
|
|
\\firefox32\.exe;45
|
|
\\firefoxe\.exe;45
|
|
\\firefoxx\.exe;45
|
|
\\firfox\.exe;45
|
|
\\irefox\.exe;45
|
|
\\refox\.exe;45
|
|
\\wireox\.exe;45
|
|
\\jav3\.exe;45
|
|
\\java32\.exe;45
|
|
\\javaa\.exe;45
|
|
\\javaaa\.exe;45
|
|
\\javaap\.exe;45
|
|
\\javacp\.exe;45
|
|
\\javag\.exe;45
|
|
\\javaii\.exe;45
|
|
\\javapw\.exe;45
|
|
\\javar\.exe;45
|
|
\\javare\.exe;45
|
|
\\javas\.exe;45
|
|
\\javas5\.exe;45
|
|
\\javasc\.exe;45
|
|
\\javase\.exe;45
|
|
\\javaup\.exe;45
|
|
\\javavm\.exe;45
|
|
\\javawz\.exe;45
|
|
\\javax\.exe;45
|
|
\\javo\.exe;45
|
|
\\javz\\\.exe;45
|
|
\\1sass\.exe;45
|
|
\\iass\.exe;45
|
|
\\isaas\.exe;45
|
|
\\isas\.exe;45
|
|
\\isass\.exe;45
|
|
\\issass\.exe;45
|
|
\\laass\.exe;45
|
|
\\lamss\.exe;45
|
|
\\larss\.exe;45
|
|
\\lass\.exe;45
|
|
\\lassa\.exe;45
|
|
\\lasse\.exe;45
|
|
\\lasss\.exe;45
|
|
\\lcass\.exe;45
|
|
\\leass\.exe;45
|
|
\\lhssass\.exe;45
|
|
\\lrass\.exe;45
|
|
\\lrsss\.exe;45
|
|
\\lsa32\.exe;45
|
|
\\lsac\.exe;45
|
|
\\lsacs\.exe;45
|
|
\\lsaess\.exe;45
|
|
\\lsaoss\.exe;45
|
|
\\lsas\.exe;45
|
|
\\lsasa\.exe;45
|
|
\\lsasas\.exe;45
|
|
\\lsascs\.exe;45
|
|
\\lsase\.exe;45
|
|
\\lsasi\.exe;45
|
|
\\lsasm\.exe;45
|
|
\\lsaso\.exe;45
|
|
\\lsasrv\.exe;45
|
|
\\lsass3\.exe;45
|
|
\\lsass32\.exe;45
|
|
\\lsass47\.exe;45
|
|
\\lsassi\.exe;45
|
|
\\lsassn\.exe;45
|
|
\\lsasss\.exe;45
|
|
\\lsassv\.exe;45
|
|
\\lsassx\.exe;45
|
|
\\lsassys\.exe;45
|
|
\\lsats\.exe;45
|
|
\\lsmass\.exe;45
|
|
\\lsrss\.exe;45
|
|
\\lssas\.exe;45
|
|
\\lssass\.exe;45
|
|
\\msass\.exe;45
|
|
\\nsrss\.exe;45
|
|
\\salss\.exe;45
|
|
\\_sachost\.exe;45
|
|
\\_svch0st\.exe;45
|
|
\\_svchost\.exe;45
|
|
\\00svchost\.exe;45
|
|
\\0svchost\.exe;45
|
|
\\achost\.exe;45
|
|
\\chost\.exe;45
|
|
\\cvhost\.exe;45
|
|
\\cvshost\.exe;45
|
|
\\isvchosty\.exe;45
|
|
\\lsvchost\.exe;45
|
|
\\mscchost\.exe;45
|
|
\\msvchost\.exe;45
|
|
\\ntsvchost\.exe;45
|
|
\\rdchost\.exe;45
|
|
\\s_host\.exe;45
|
|
\\sach0st\.exe;45
|
|
\\sachost\.exe;45
|
|
\\sachostc\.exe;45
|
|
\\sachostp\.exe;45
|
|
\\sachostp\.exe;45
|
|
\\sachosts\.exe;45
|
|
\\sachosts\.exe;45
|
|
\\sachostw\.exe;45
|
|
\\sachostw\.exe;45
|
|
\\sachostx\.exe;45
|
|
\\sathost\.exe;45
|
|
\\sbhost\.exe;45
|
|
\\scanost\.exe;45
|
|
\\scchost\.exe;45
|
|
\\scchost\.exe;45
|
|
\\scchost2\.exe;45
|
|
\\scchostc\.exe;45
|
|
\\scchostc\.exe;45
|
|
\\scghost\.exe;45
|
|
\\schost\.exe;45
|
|
\\schost\.exe;45
|
|
\\schostc\.exe;45
|
|
\\schosts\.exe;45
|
|
\\schovst\.exe;45
|
|
\\schvost\.exe;45
|
|
\\scvchost\.exe;45
|
|
\\scvchusts\.exe;45
|
|
\\scvh0st\.exe;45
|
|
\\scvh0st\.exe;45
|
|
\\scvhost\.exe;45
|
|
\\scvhost\.exe;45
|
|
\\scvhosv\.exe;45
|
|
\\scvost\.exe;45
|
|
\\scvvhost\.exe;45
|
|
\\sdchost\.exe;45
|
|
\\sdhost\.exe;45
|
|
\\serhost\.exe;45
|
|
\\servehost\.exe;45
|
|
\\sethost\.exe;45
|
|
\\sevchos\.exe;45
|
|
\\sevhost\.exe;45
|
|
\\shchost\.exe;45
|
|
\\shhost\.exe;45
|
|
\\shost\.exe;45
|
|
\\shvchost\.exe;45
|
|
\\shvhost\.exe;45
|
|
\\sichost\.exe;45
|
|
\\slchost\.exe;45
|
|
\\slihost\.exe;45
|
|
\\smsvchost\.exe;45
|
|
\\snahost\.exe;45
|
|
\\snhost\.exe;45
|
|
\\snphost\.exe;45
|
|
\\snvhost\.exe;45
|
|
\\sochost\.exe;45
|
|
\\sochvst\.exe;45
|
|
\\soohost\.exe;45
|
|
\\spchost\.exe;45
|
|
\\sqlhost\.exe;45
|
|
\\srchost\.exe;45
|
|
\\srshost\.exe;45
|
|
\\srvchost\.exe;45
|
|
\\srvchost\.exe;45
|
|
\\srvhost\.exe;45
|
|
\\sschost\.exe;45
|
|
\\sshost\.exe;45
|
|
\\ssvch0st\.exe;45
|
|
\\ssvchost\.exe;45
|
|
\\ssvchost\.exe;45
|
|
\\ssvichosst\.exe;45
|
|
\\st#host\.exe;45
|
|
\\stdhost\.exe;45
|
|
\\suchost\.exe;45
|
|
\\suchost\.exe;45
|
|
\\suchostp\.exe;45
|
|
\\suchostp\.exe;45
|
|
\\suchosts\.exe;45
|
|
\\suchosts\.exe;45
|
|
\\sv_host\.exe;45
|
|
\\sv±hest\.exe;45
|
|
\\sv0hoat\.exe;45
|
|
\\sv1host\.exe;45
|
|
\\svahost\.exe;45
|
|
\\svahost\.exe;45
|
|
\\svcbost\.exe;45
|
|
\\svcchost\.exe;45
|
|
\\svcchost\.exe;45
|
|
\\svcehost\.exe;45
|
|
\\svcehost\.exe;45
|
|
\\svcgest\.exe;45
|
|
\\svcgh0st\.exe;45
|
|
\\svcgoost\.exe;45
|
|
\\svch0sat\.exe;45
|
|
\\svch0sbt\.exe;45
|
|
\\svch0set\.exe;45
|
|
\\svch0sft\.exe;45
|
|
\\svch0slt\.exe;45
|
|
\\svch0smt\.exe;45
|
|
\\svch0st\.exe;45
|
|
\\svch0st\.exe;45
|
|
\\svch0st_\.exe;45
|
|
\\svch0sts\.exe;45
|
|
\\svch7t\.exe;45
|
|
\\svchaot\.exe;45
|
|
\\svchast\.exe;45
|
|
\\svchast\.exe;45
|
|
\\svchcst\.exe;45
|
|
\\svchcst\.exe;45
|
|
\\svchest\.exe;45
|
|
\\svchest\.exe;45
|
|
\\svchhost\.exe;45
|
|
\\svchîst\.exe;45
|
|
\\svchkost\.exe;45
|
|
\\svcho\.exe;45
|
|
\\svchobst\.exe;45
|
|
\\svchoct\.exe;45
|
|
\\svcholts\.exe;45
|
|
\\svchon32\.exe;45
|
|
\\svchoost\.exe;45
|
|
\\svchoot\.exe;45
|
|
\\svchort\.exe;45
|
|
\\svchos\.exe;45
|
|
\\svchos12\.exe;45
|
|
\\svchosd\.exe;45
|
|
\\svchosf\.exe;45
|
|
\\svchosf\.exe;45
|
|
\\svchosi\.exe;45
|
|
\\svchosl\.exe;45
|
|
\\svchoso\.exe;45
|
|
\\svchosr\.exe;45
|
|
\\svchoss\.exe;45
|
|
\\svchosst\.exe;45
|
|
\\svchöst\.exe;45
|
|
\\svchost_\.exe;45
|
|
\\svchost_cz\.exe;45
|
|
\\svchost”\.exe;45
|
|
\\svchost0\.exe;45
|
|
\\svchost1\.exe;45
|
|
\\svchost10\.exe;45
|
|
\\svchost16\.exe;45
|
|
\\svchost2\.exe;45
|
|
\\svchost2\.exe;45
|
|
\\svchost3\.exe;45
|
|
\\svchost3\.exe;45
|
|
\\svchost31\.exe;45
|
|
\\svchost32\.exe;45
|
|
\\svchost32\.exe;45
|
|
\\svchost4\.exe;45
|
|
\\svchost5\.exe;45
|
|
\\svchost6\.exe;45
|
|
\\svchost64\.exe;45
|
|
\\svchost64\.exe;45
|
|
\\svchosta\.exe;45
|
|
\\svchostbb\.exe;45
|
|
\\svchostbd\.exe;45
|
|
\\svchostbn\.exe;45
|
|
\\svchostc\.exe;45
|
|
\\svchostc32\.exe;45
|
|
\\svchostcx\.exe;45
|
|
\\svchostd\.exe;45
|
|
\\svchostdll\.exe;45
|
|
\\svchoste\.exe;45
|
|
\\svchosted\.exe;45
|
|
\\svchosti\.exe;45
|
|
\\svchosting\.exe;45
|
|
\\svchostit\.exe;45
|
|
\\svchostl\.exe;45
|
|
\\svchostms\.exe;45
|
|
\\svchosto\.exe;45
|
|
\\svchostr\.exe;45
|
|
\\svchostre\.exe;45
|
|
\\svchosts\.exe;45
|
|
\\svchosts\.exe;45
|
|
\\svchosts32\.exe;45
|
|
\\svchostsr\.exe;45
|
|
\\svchostss\.exe;45
|
|
\\svchostt\.exe;45
|
|
\\svchostt\.exe;45
|
|
\\svchostþ\.exe;45
|
|
\\svchostun\.exe;45
|
|
\\svchostv\.exe;45
|
|
\\svchostv\.exe;45
|
|
\\svchostxi\.exe;45
|
|
\\svchostxi\.exe;45
|
|
\\svchostxxx\.exe;45
|
|
\\svchostz\.exe;45
|
|
\\svchosv\.exe;45
|
|
\\svchosy\.exe;45
|
|
\\svchot\.exe;45
|
|
\\svchoto\.exe;45
|
|
\\svchots\.exe;45
|
|
\\svchots\.exe;45
|
|
\\svchott\.exe;45
|
|
\\svchowb\.exe;45
|
|
\\svchowt\.exe;45
|
|
\\svchoxt\.exe;45
|
|
\\svchoxt\.exe;45
|
|
\\svchpst\.exe;45
|
|
\\svchpst\.exe;45
|
|
\\svchqs\.exe;45
|
|
\\svchqst\.exe;45
|
|
\\svchs0t\.exe;45
|
|
\\svchsot\.exe;45
|
|
\\svchsot\.exe;45
|
|
\\svchsst\.exe;45
|
|
\\svchssts\.exe;45
|
|
\\svchst\.exe;45
|
|
\\svchste\.exe;45
|
|
\\svchsts\.exe;45
|
|
\\svchtst\.exe;45
|
|
\\svchust\.exe;45
|
|
\\svchusts\.exe;45
|
|
\\svcinit\.exe;45
|
|
\\svcjhost\.exe;45
|
|
\\svclost\.exe;45
|
|
\\svcmost\.exe;45
|
|
\\svcnost\.exe;45
|
|
\\svcnost\.exe;45
|
|
\\svcohst\.exe;45
|
|
\\svcomst\.exe;45
|
|
\\svcoost\.exe;45
|
|
\\svcost\.exe;45
|
|
\\svcpos\.exe;45
|
|
\\svcroot\.exe;45
|
|
\\svcroot\.exe;45
|
|
\\svcshtost\.exe;45
|
|
\\svcsoft\.exe;45
|
|
\\svcsost\.exe;45
|
|
\\svcst\.exe;45
|
|
\\svctos\.exe;45
|
|
\\svcxhost\.exe;45
|
|
\\svdhost\.exe;45
|
|
\\svdhost\.exe;45
|
|
\\svdnost\.exe;45
|
|
\\svehost\.exe;45
|
|
\\svehost\.exe;45
|
|
\\svgchost\.exe;45
|
|
\\svggost\.exe;45
|
|
\\svghost\.exe;45
|
|
\\svghost\.exe;45
|
|
\\svghosts\.exe;45
|
|
\\svh0st\.exe;45
|
|
\\svhcost\.exe;45
|
|
\\svhest\.exe;45
|
|
\\svhoct\.exe;45
|
|
\\svhosit\.exe;45
|
|
\\svhosr\.exe;45
|
|
\\svhosst\.exe;45
|
|
\\svhost\.exe;45
|
|
\\svhost\.exe;45
|
|
\\svhost1\.exe;45
|
|
\\svhost2\.exe;45
|
|
\\svhostc\.exe;45
|
|
\\svhoste\.exe;45
|
|
\\svhostr\.exe;45
|
|
\\svhosts\.exe;45
|
|
\\svhostt\.exe;45
|
|
\\svhostu\.exe;45
|
|
\\svhot\.exe;45
|
|
\\svhst\.exe;45
|
|
\\svhust\.exe;45
|
|
\\svichosst\.exe;45
|
|
\\svichost\.exe;45
|
|
\\svlhost\.exe;45
|
|
\\svnchost\.exe;45
|
|
\\svnhost\.exe;45
|
|
\\svohcst\.exe;45
|
|
\\svohcst\.exe;45
|
|
\\svohost\.exe;45
|
|
\\svohost\.exe;45
|
|
\\svohst\.exe;45
|
|
\\svost\.exe;45
|
|
\\svphost\.exe;45
|
|
\\svphost\.exe;45
|
|
\\svphostu\.exe;45
|
|
\\svphostu\.exe;45
|
|
\\svrhost\.exe;45
|
|
\\svrhost\.exe;45
|
|
\\svschost\.exe;45
|
|
\\svschost\.exe;45
|
|
\\svschosta\.exe;45
|
|
\\svsh0st\.exe;45
|
|
\\svsh0st\.exe;45
|
|
\\svshoct\.exe;45
|
|
\\svshost\.exe;45
|
|
\\svshosti\.exe;45
|
|
\\svshosts\.exe;45
|
|
\\svshot\.exe;45
|
|
\\svuhost\.exe;45
|
|
\\svvchcst\.exe;45
|
|
\\svvchost\.exe;45
|
|
\\svvghost\.exe;45
|
|
\\svvhost\.exe;45
|
|
\\svvhost\.exe;45
|
|
\\svvhosti\.exe;45
|
|
\\svwhost\.exe;45
|
|
\\svxhos\.exe;45
|
|
\\svxhost\.exe;45
|
|
\\swchost\.exe;45
|
|
\\swchost\.exe;45
|
|
\\swdhost\.exe;45
|
|
\\swhost\.exe;45
|
|
\\swhost\.exe;45
|
|
\\sxhost\.exe;45
|
|
\\sxhost\.exe;45
|
|
\\sychost\.exe;45
|
|
\\synchost\.exe;45
|
|
\\synchost\.exe;45
|
|
\\synhost\.exe;45
|
|
\\syschost\.exe;45
|
|
\\syschost\.exe;45
|
|
\\syshost\.exe;45
|
|
\\syshost\.exe;45
|
|
\\szchostc\.exe;45
|
|
\\szchostc\.exe;45
|
|
\\tsvchost\.exe;45
|
|
\\usvchost\.exe;45
|
|
\\uvchost\.exe;45
|
|
\\vcchost\.exe;45
|
|
\\vchost\.exe;45
|
|
\\vhchost\.exe;45
|
|
\\vhost\.exe;45
|
|
\\vschost\.exe;45
|
|
\\vsschost\.exe;45
|
|
\\vxhost\.exe;45
|
|
\\wsvchost\.exe;45
|
|
\\wvchosd\.exe;45
|
|
\\xvshost\.exe;45
|
|
\\zvchost\.exe;45
|
|
\\mswin\.exe;45
|
|
\\win_\.exe;45
|
|
\\win_5\.exe;45
|
|
\\win00\.exe;45
|
|
\\win01\.exe;45
|
|
\\win07\.exe;45
|
|
\\win08\.exe;45
|
|
\\win09\.exe;45
|
|
\\win1\.exe;45
|
|
\\win10\.exe;45
|
|
\\win11\.exe;45
|
|
\\win16\.exe;45
|
|
\\win2\.exe;45
|
|
\\win22\.exe;45
|
|
\\win23\.exe;45
|
|
\\win3\.exe;45
|
|
\\win30\.exe;45
|
|
\\win32\.exe;45
|
|
\\win39\.exe;45
|
|
\\win4\.exe;45
|
|
\\win42\.exe;45
|
|
\\win44\.exe;45
|
|
\\win45\.exe;45
|
|
\\win5\.exe;45
|
|
\\win54\.exe;45
|
|
\\win55\.exe;45
|
|
\\win62\.exe;45
|
|
\\win64\.exe;45
|
|
\\win7\.exe;45
|
|
\\win76\.exe;45
|
|
\\win77\.exe;45
|
|
\\win8\.exe;45
|
|
\\win91\.exe;45
|
|
\\win96\.exe;45
|
|
\\win98\.exe;45
|
|
\\win9x\.exe;45
|
|
\\wina\.exe;45
|
|
\\winad\.exe;45
|
|
\\winar\.exe;45
|
|
\\winav\.exe;45
|
|
\\winb\.exe;45
|
|
\\winc\.exe;45
|
|
\\wince\.exe;45
|
|
\\wind3\.exe;45
|
|
\\windf\.exe;45
|
|
\\windm\.exe;45
|
|
\\winds\.exe;45
|
|
\\wine\.exe;45
|
|
\\winet\.exe;45
|
|
\\winex\.exe;45
|
|
\\winfc\.exe;45
|
|
\\wingb\.exe;45
|
|
\\wings\.exe;45
|
|
\\wingt\.exe;45
|
|
\\winhd\.exe;45
|
|
\\winhv\.exe;45
|
|
\\wini\.exe;45
|
|
\\winit\.exe;45
|
|
\\wink\.exe;45
|
|
\\winkl\.exe;45
|
|
\\winl\.exe;45
|
|
\\winlc\.exe;45
|
|
\\winma\.exe;45
|
|
\\winmm\.exe;45
|
|
\\winmn\.exe;45
|
|
\\winmx\.exe;45
|
|
\\winn\.exe;45
|
|
\\winn1\.exe;45
|
|
\\winns\.exe;45
|
|
\\winnt\.exe;45
|
|
\\winny\.exe;45
|
|
\\winog\.exe;45
|
|
\\winok\.exe;45
|
|
\\winos\.exe;45
|
|
\\winow\.exe;45
|
|
\\winp9\.exe;45
|
|
\\winpc\.exe;45
|
|
\\winr\.exe;45
|
|
\\winra\.exe;45
|
|
\\winrm\.exe;45
|
|
\\winrr\.exe;45
|
|
\\wins7\.exe;45
|
|
\\winsh\.exe;45
|
|
\\winsp\.exe;45
|
|
\\winss\.exe;45
|
|
\\winst\.exe;45
|
|
\\wint\.exe;45
|
|
\\winu\.exe;45
|
|
\\winud\.exe;45
|
|
\\winup\.exe;45
|
|
\\winvc\.exe;45
|
|
\\winvr\.exe;45
|
|
\\winw\.exe;45
|
|
\\winwl\.exe;45
|
|
\\winwn\.exe;45
|
|
\\winws\.exe;45
|
|
\\winx\.exe;45
|
|
\\winxp\.exe;45
|
|
\\winxv\.exe;45
|
|
\\winz\\\.exe;45
|
|
\\_winlogon\.exe;45
|
|
\\inlogon\.exe;45
|
|
\\nlogon\.exe;45
|
|
\\wgalogon\.exe;45
|
|
\\wimlogom\.exe;45
|
|
\\win_logn\.exe;45
|
|
\\win1ogo\.exe;45
|
|
\\win1ogon\.exe;45
|
|
\\win1ogons\.exe;45
|
|
\\windlogon\.exe;45
|
|
\\winiogon\.exe;45
|
|
\\winl0g0n\.exe;45
|
|
\\winl0gin\.exe;45
|
|
\\winlgon\.exe;45
|
|
\\winligon\.exe;45
|
|
\\winlngon\.exe;45
|
|
\\winlog\.exe;45
|
|
\\winlog056\.exe;45
|
|
\\winlog0n\.exe;45
|
|
\\winlog1\.exe;45
|
|
\\winlogan\.exe;45
|
|
\\winloge\.exe;45
|
|
\\winlogen\.exe;45
|
|
\\winloger\.exe;45
|
|
\\winlogin\.exe;45
|
|
\\winlogins\.exe;45
|
|
\\winlogn\.exe;45
|
|
\\winlogo\.exe;45
|
|
\\winlogom\.exe;45
|
|
\\winlogoms\.exe;45
|
|
\\winlogon1\.exe;45
|
|
\\winlogon3\.exe;45
|
|
\\winlogon32\.exe;45
|
|
\\winlogon6\.exe;45
|
|
\\winlogon86\.exe;45
|
|
\\winlogone\.exe;45
|
|
\\winlogonl\.exe;45
|
|
\\winlogonn\.exe;45
|
|
\\winlogonpc\.exe;45
|
|
\\winlogonr\.exe;45
|
|
\\winlogons\.exe;45
|
|
\\winlogor\.exe;45
|
|
\\winlogr\.exe;45
|
|
\\winlogs\.exe;45
|
|
\\winlogun\.exe;45
|
|
\\winlongon\.exe;45
|
|
\\winlugan\.exe;45
|
|
\\winslogin\.exe;45
|
|
\\wnilogon\.exe;45
|
|
\\wnlgon\.exe;45
|
|
\\wnlogin\.exe;45
|
|
|
|
# Typical Malware Names
|
|
\\ex[p]?[l1]orer[a-z0-9]{1,3}\.exe;60
|
|
\\ex[p]?[^l]orer;60
|
|
\\ex[p]?l[^o]rer;60
|
|
\\iexp[1l]ore[a-z0-9]{1,3}\.exe;60
|
|
\\iexp[^l]ore;60
|
|
\\iexpl[^o]re;60
|
|
\\l[^s]?ass\.exe;55
|
|
\\lsa[^s]?s\.exe;55
|
|
\\l[s]?ass[a-z0-9]\.exe;65
|
|
\\sv[^c]host\.exe;55
|
|
\\svch[^o]st\.exe;45
|
|
\\svc[a-z]host\.exe;45
|
|
\\svch0s;60
|
|
\\svchost[a-z0-9]{1,3}\.exe;55
|
|
\\win[0-9_]{0,3}\.exe;55
|
|
\\win1ogo;45
|
|
\\win[^l]ogon\.exe;55
|
|
\\winl[^o]gon\.exe;55
|
|
\\winlog[^o]n\.exe;55
|
|
\\winlogon[0-9_a-z]{1,3}\.exe;55
|
|
|
|
# FireEye Irongate
|
|
\\bla\.exe;80
|
|
\\update_no_pipe\.exe;80
|
|
\\scada\.exe;50
|
|
\\Step7ConMgr\.dll;70
|
|
\\scomma scxrt2\.ini;80
|
|
\\scxrt2\.ini;80
|
|
|
|
# Sofacy APT http://goo.gl/YXb8ZX
|
|
[Cc]:\\ProgramData\\iprpp\.dll;100
|
|
AppData\\Roaming\\amdcache\.dll;100
|
|
|
|
# Sofacy APT http://goo.gl/mzAa97
|
|
AppData\\Roaming\\btecache\.dll;90
|
|
|
|
# Many malware samples - including StarCruft
|
|
\\scvhosts\.exe;70
|
|
|
|
# Kaspersky Report https://goo.gl/iWUz63
|
|
\\[Ss]ystem32\\scclient\.exe;80
|
|
|
|
# Suspicious Location
|
|
[Cc]:\\[Ww]indows\\[Ss]ecurity\\[A-Za-z0-9]{1,10}\.(exe|dll);80
|
|
|
|
# Skeleton Key https://goo.gl/sc6Lqq
|
|
\\msuta64\.dll;80
|
|
\\ole64\.dll;80
|
|
\\olex64\.dll;80
|
|
\\HookDC\.dll;80
|
|
\\HookDC64\.dll;80
|
|
|
|
# Project Sauron https://goo.gl/eFoP4A
|
|
\\Temp\\kavupdate\.exe;80
|
|
\\Temp\\kvupd\.exe;80
|
|
\\Temp\\klnupd\.exe;80
|
|
\\[Ss]ystem32\\rpchlpr\.exe;80
|
|
\\[Ss]ystem32\\symnet32\.dll;80
|
|
\\[Ss]ystem32\\rdiskman\.dll;80
|
|
\\[Ss]ystem32\\rseceng\.dll;80
|
|
\\[Ss]ystem32\\msprtssp\.dll;80
|
|
\\[Ss]ystem32\\ncompc\.dll;80
|
|
\\[Ss]ystem32\\rdeskm\.dll;80
|
|
\\[Ss]ystem32\\dpsf\.dll;80
|
|
\\[Ss]ystem32\\nsecf\.dll;80
|
|
\\[Ss]ystem32\\rdesk\.dll;80
|
|
\\[Ss]ystem32\\dpsloc\.dll;80
|
|
\\[Ss]ystem32\\ddeskm\.dll;80
|
|
\\[Ss]ystem32\\rdisksup\.dll;80
|
|
\\[Ss]ystem32\\rcompf\.dll;80
|
|
\\[Ss]ystem32\\ncompsup\.dll;80
|
|
\\[Ss]ystem32\\rdiskf\.dll;80
|
|
\\[Ss]ystem32\\iseceng\.dll;80
|
|
\\[Ss]ystem32\\msasspc\.dll;80
|
|
\\[Ss]ystem32\\wpsloc\.dll;80
|
|
\\[Ss]ystem32\\wpackpwf\.dll;80
|
|
\\[Ss]ystem32\\rcnfm\.dll;80
|
|
\\[Ss]ystem32\\hptcpprnt\.dll;80
|
|
\\[Ss]ystem32\\rdeskf\.dll;80
|
|
\\[Ss]ystem32\\ncnfloc\.dll;80
|
|
\\[Ss]ystem32\\msaosspc\.dll;80
|
|
\\[Ss]ystem32\\ndiskloc\.dll;80
|
|
\\[Ss]ystem32\\mperfcl\.dll;80
|
|
\\[Ss]ystem32\\polsec\.dll;80
|
|
\\[Ss]ystem32\\sxsmgrkbd\.dll;80
|
|
\\[Ss]ystem32\\cfgbaseprt\.dll;80
|
|
\\[Ss]ystem32\\seccertapi\.dll;80
|
|
\\[Ss]ystem32\\krbsec\.dll;80
|
|
\\[Ss]ystem32\\prnpapi\.dll;80
|
|
\\[Ss]ystem32\\ndisk\.dll;80
|
|
\\[Ss]ystem32\\ndisksup\.dll;80
|
|
\\[Ss]ystem32\\rdiskloc\.dll;80
|
|
\\[Ss]ystem32\\pngmon\.dll;80
|
|
\\[Ss]ystem32\\kavsec64\.dll;80
|
|
\\[Ss]ystem32\\wlseccomm\.dll;80
|
|
\\[Ss]ystem32\\rcnfsys\.dll;80
|
|
\\[Ss]ystem32\\wpackshim\.dll;80
|
|
\\[Ss]ystem32\\ncnfsys\.dll;80
|
|
\\[Ss]ystem32\\sxsapifeed\.dll;80
|
|
\\[Ss]ystem32\\wmupdsvc\.dll;80
|
|
\\[Ss]ystem32\\dpsf\.dll;80
|
|
\\[Ss]ystem32\\compc\.dll;80
|
|
\\[Ss]ystem32\\rdiskf\.dll;80
|
|
\\[Ss]ystem32\\compman\.dll;80
|
|
\\[Ss]ystem32\\cnfsys\.dll;80
|
|
\\[Ss]ystem32\\isecf\.dll;80
|
|
\\[Ss]ystem32\\klsec\.dll;80
|
|
\\[Ss]ystem32\\nagent\.exe;80
|
|
\\[Ss]ystem32\\rpsf\.dll;80
|
|
\\[Ss]ystem32\\tv_prntx64\.dll;80
|
|
\\[Ss]ystem32\\wdesksys\.dll;80
|
|
\\[Ss]ystem32\\dsecc\.dll;80
|
|
\\[Ss]ystem32\\dcompf\.dll;80
|
|
\\[Ss]ystem32\\dsecman\.dll;80
|
|
\\[Ss]ystem32\\isecc\.dll;80
|
|
\\[Ss]ystem32\\rcompc\.dll;80
|
|
\\[Ss]ystem32\\rcnfloc\.dll;80
|
|
\\[Ss]ystem32\\rdisk\.dll;80
|
|
\\[Ss]ystem32\\dcompman\.dll;80
|
|
\\[Ss]ystem32\\npsloc\.dll;80
|
|
\\[Ss]ystem32\\nsecc\.dll;80
|
|
\\[Ss]ystem32\\wcprts32\.dll;80
|
|
\\[Ss]ystem32\\rpsloc\.dll;80
|
|
\\[Ss]ystem32\\rsecman\.dll;80
|
|
\\[Ss]ystem32\\mstimed\.dll;80
|
|
\\[Ss]ystem32\\dcompsup\.dll;80
|
|
\\[Ss]ystem32\\compsup\.dll;80
|
|
\\[Ss]ystem32\\ncompman\.dll;80
|
|
\\[Ss]ystem32\\rsecloc\.dll;80
|
|
\\[Ss]ystem32\\rdeskman\.dll;80
|
|
\\[Ss]ystem32\\mfc64d\.dll;80
|
|
\\[Ss]ystem32\\sceclid\.dll;80
|
|
\\[Ss]ystem32\\ddesksys\.dll;80
|
|
\\[Ss]ystem32\\isecman\.dll;80
|
|
\\[Ss]ystem32\\scsvc32\.exe;80
|
|
\\[Ss]ystem32\\polcfg\.dll;80
|
|
\\[Ss]ystem32\\cnfloc\.dll;80
|
|
\\[Ss]ystem32\\nseci\.dll;80
|
|
\\[Ss]ystem32\\eapproxycrypt\.dll;80
|
|
|
|
# Cisco JBoss Webshell Names https://goo.gl/drkm6k - modified list
|
|
\\AfAMeA1\\index\.jsp
|
|
\\CluJaNuL\\cmd\.jsp
|
|
\\CoCkZ\\index\.jsp
|
|
\\ConsoleHelp\\default\.jsp
|
|
\\DOGBKuoz\\rMbnbnsH\.jsp
|
|
\\DonGz\\index\.jsp
|
|
\\WebServiceImpl\\axis2-web\\index\.jsp
|
|
\\XSAEjslo\\pHXLDsUP\.jsp
|
|
\\XimhGLGO\\rjsJKakD\.jsp
|
|
\\a\\a\.jsp
|
|
\\a\\pwn\.jsp
|
|
\\aa\\pwn\.jsp
|
|
\\admin\\index\.jsp
|
|
\\admin\\login\.jsp
|
|
\\ajlobUYO\\fMhYrZgm\.jsp
|
|
\\amserver\\UI\\Login\.jsp
|
|
\\apache-tomcat\\index\.jsp
|
|
\\axis2-web\\index\.jsp
|
|
\\axis2\\axis2-web\\index\.jsp
|
|
\\backoffice\\servlet\\AboutDestiny_files\\Login\.jsp
|
|
\\backoffice\\servlet\\AboutDestiny_files\\admin\\login\.jsp
|
|
\\backoffice\\servlet\\AboutDestiny_files\\axis2-web\\index\.jsp
|
|
\\backoffice\\servlet\\AboutDestiny_files\\index\.jsp
|
|
\\backoffice\\servlet\\Login\.jsp
|
|
\\backoffice\\servlet\\admin\\login\.jsp
|
|
\\backoffice\\servlet\\axis2-web\\index\.jsp
|
|
\\backoffice\\servlet\\index\.jsp
|
|
\\bb\\update\.jsp
|
|
\\bharath\\index\.jsp
|
|
\\brightmail\\index\.jsp
|
|
\\browser\\Browser\.jsp
|
|
\\browser\\browser\\browser\.jsp
|
|
\\browser\\shell\.jsp
|
|
\\browser[0-9]{2,3}\\browser\.jsp
|
|
\\bynazi\\cmd\.jsp
|
|
\\car\\cmdpost\.jsp
|
|
\\ccc\\index\.jsp
|
|
\\cgi-bin\\Login\.jsp
|
|
\\cgi-bin\\admin\\login\.jsp
|
|
\\cgi-bin\\axis2-web\\index\.jsp
|
|
\\cgi-bin\\index\.jsp
|
|
\\cmd[0-9]{,3}\\cmd\.jsp
|
|
\\cmdcmd\\cmdcmd\.jsp
|
|
\\cmdjsp\\cmdjsp\.jsp
|
|
\\coleman\\index\.jsp
|
|
\\com\\cmd\.jsp
|
|
\\com\\com\.jsp
|
|
\\common\\admin\\login\.jsp
|
|
\\common\\axis2-web\\index\.jsp
|
|
\\common\\common\.jsp
|
|
\\common\\reportsystemcondition\.jsp
|
|
\\common\\servlet\\axis2-web\\index\.jsp
|
|
\\common\\servlet\\handleedithomeheaderform\.do
|
|
\\common\\servlet\\handleedithomelinkform\.do
|
|
\\console\\faces\\jsp\\login\\BeginLogin\.jsp
|
|
\\console\\jsp_info\.jsp
|
|
\\console\\login\\LoginForm\.jsp
|
|
\\cyanhf\\index\.jsp
|
|
\\d\\index\.jsp
|
|
\\damao\\index\.jsp
|
|
\\dbhrathtmp\\index\.jsp
|
|
\\dbth\\index\.jsp
|
|
\\deploy\\wGBmaOVe\.war\\GeRRAXwv\.jsp
|
|
\\deploymentmanager\\index\.jsp
|
|
\\destiny\\config\.jsp
|
|
\\destiny\\index\.jsp
|
|
\\district\\servlet\\Login\.jsp
|
|
\\district\\servlet\\admin\\login\.jsp
|
|
\\district\\servlet\\axis2-web\\index\.jsp
|
|
\\district\\servlet\\index\.jsp
|
|
\\docs\\funcspecs\\1\.jsp
|
|
\\docs\\funcspecs\\2\.jsp
|
|
\\docs\\funcspecs\\3\.jsp
|
|
\\docs\\funcspecs\\4\.jsp
|
|
\\docs\\funcspecs\\5\.jsp
|
|
\\dswsbobje\\axis2-web\\index\.jsp
|
|
\\dta\\index\.jsp
|
|
\\e\\e\.jsp
|
|
\\e\\index\.jsp
|
|
\\e\\shell\.jsp
|
|
\\eee\\eee\.jsp
|
|
\\eg\\smd\.jsp
|
|
\\egd\\smd\.jsp
|
|
\\egdus\\smd\.jsp
|
|
\\eggs\\smd\.jsp
|
|
\\esc\\esc\\ss\.jsp
|
|
\\exam\\config\.jsp
|
|
\\example\\config\.jsp
|
|
\\example\\index\.jsp
|
|
\\examples\\jsp\\snp\\snoop\.jsp
|
|
\\examples\\jsp\\source\.jsp
|
|
\\foo\.jsp
|
|
\\foo2\\foo\.jsp
|
|
\\fs\\shell\.jsp
|
|
\\gU7gIJat\\yTvIbSJs\.jsp
|
|
\\ggicmp\\ggicmp\.jsp
|
|
\\ggikarus\\ggikarus\.jsp
|
|
\\ggikey\\ggikey\.jsp
|
|
\\gwadmin-console\\login\.jsp
|
|
\\gzecmd\\zecmd\.jsp
|
|
\\he\\index\.jsp
|
|
\\hhh\\hhh\.jsp
|
|
\\icmp\\icmp\.jsp
|
|
\\iddqd\\iddqd\.jsp
|
|
\\idssvc\\idssvc\.jsp
|
|
\\iesvc\\iesvc\.jsp
|
|
\\iframeportlet\\iframeportlet\.jsp
|
|
\\ihijri\\ihijri\.jsp
|
|
\\ii\\ii\.jsp
|
|
\\ijtfcengzr\\ijtfcengzr\.jsp
|
|
\\ikarus\\ikarus\.jsp
|
|
\\ikgMrKaJ\\ikgMrKaJ\.jsp
|
|
\\ikguide\\ikguide\.jsp
|
|
\\ikhatma\\ikhatma\.jsp
|
|
\\ilbFwGWq\\ilbFwGWq\.jsp
|
|
\\imEaY5ja\\imEaY5ja\.jsp
|
|
\\images\\Login\.jsp
|
|
\\images\\admin\\login\.jsp
|
|
\\images\\axis2-web\\index\.jsp
|
|
\\images\\en\\buttons\\large\\Login\.jsp
|
|
\\images\\en\\buttons\\large\\admin\\login\.jsp
|
|
\\images\\en\\buttons\\large\\axis2-web\\index\.jsp
|
|
\\images\\en\\buttons\\large\\index\.jsp
|
|
\\images\\en\\buttons\\small\\Login\.jsp
|
|
\\images\\en\\buttons\\small\\admin\\login\.jsp
|
|
\\images\\en\\buttons\\small\\axis2-web\\index\.jsp
|
|
\\images\\en\\buttons\\small\\index\.jsp
|
|
\\images\\en\\icons\\general\\Login\.jsp
|
|
\\images\\en\\icons\\general\\admin\\login\.jsp
|
|
\\images\\en\\icons\\general\\axis2-web\\index\.jsp
|
|
\\images\\en\\icons\\general\\index\.jsp
|
|
\\images\\icons\\general\\Login\.jsp
|
|
\\images\\icons\\general\\admin\\login\.jsp
|
|
\\images\\icons\\general\\axis2-web\\index\.jsp
|
|
\\images\\icons\\general\\index\.jsp
|
|
\\images\\index\.jsp
|
|
\\imcws\\axis2-web\\index\.jsp
|
|
\\inaseibu\\inaseibu\.jsp
|
|
\\index\.jsp
|
|
\\ingvcduwzt\\ingvcduwzt\.jsp
|
|
\\inmlvphsyu\\inmlvphsyu\.jsp
|
|
\\intruvert\\jsp\\admin\\Login\.jsp
|
|
\\invoke\\index\.jsp
|
|
\\invokemanage\\invokerinfos\.jsp
|
|
\\invoker\\1\.jsp
|
|
\\invokermngrt\\aa\.jsp
|
|
\\ioviyam\\ioviyam\.jsp
|
|
\\is\\cmd\.jsp
|
|
\\is\\index\.jsp
|
|
\\j60ss\\index\.jsp
|
|
\\jJ0wLC9\\jJ0wLC9\.jsp
|
|
\\jKeying\\jKeying\.jsp
|
|
\\jRktoaev\\jRktoaev\.jsp
|
|
\\javadev\\cmd\.jsp
|
|
\\jbossass\\index\.jsp
|
|
\\jbossass\\jbossass\.jsp
|
|
\\jbossaxx\\jbossaxx\.jsp
|
|
\\jbossdoc\\jbossdoc\.jsp
|
|
\\jbossdox\\jbossdox\.jsp
|
|
\\jbosses\\jbosses\.jsp
|
|
\\jbossinvoker\\jbossinvoker\.jsp
|
|
\\jbossis\\jbossis\.jsp
|
|
\\jbossos\\jbossos\.jsp
|
|
\\jbot\\jbot\.jsp
|
|
\\jdev\\cmd\.jsp
|
|
\\jdev2\\cmd\.jsp
|
|
\\jdev3\\cmd\.jsp
|
|
\\jedi-theme\\jedi-theme\.jsp
|
|
\\jj\\jj\.jsp
|
|
\\jmx-admin\\1\.jsp
|
|
\\jmx-admin\\2\.jsp
|
|
\\jmx-management\\sysup\.jsp
|
|
\\jobss-ebmyae\\jobss-ebmyae\.jsp
|
|
\\jobss-kqgmyg\\jobss-kqgmyg\.jsp
|
|
\\jobss-rjkonr\\jobss-rjkonr\.jsp
|
|
\\jobss-utdqkz\\jobss-utdqkz\.jsp
|
|
\\jrm1arJ\\jrm1arJ\.jsp
|
|
\\jsp\\PreLogin\.jsp
|
|
\\jsp\\index\.jsp
|
|
\\jspshell\\index\.jsp
|
|
\\kakou\\kakou\.jsp
|
|
\\knet\\knet\.jsp
|
|
\\kohls\\kohls\.jsp
|
|
\\kort-theme\\kort-theme\.jsp
|
|
\\kpzalrmhjt\\kpzalrmhjt\.jsp
|
|
\\kqgfyojlmw\\kqgfyojlmw\.jsp
|
|
\\kqrecOhV\\kqrecOhV\.jsp
|
|
\\krweQEfC\\krweQEfC\.jsp
|
|
\\lnnpp\\lnnpp\.jsp
|
|
\\login\.jsp
|
|
\\console\\console\.jsp
|
|
\\console\\index\.jsp
|
|
\\ls\\cmd\.jsp
|
|
\\ls\\ls\.jsp
|
|
\\ly\\ly\.jsp
|
|
\\m\\schdC\.jsp
|
|
\\man\\3\.jsp
|
|
\\manager\\113\.jsp
|
|
\\manager\\fix\.jsp
|
|
\\manager\\http\.jsp
|
|
\\manager\\mybrowser\.jsp
|
|
\\manager\\poster\.jsp
|
|
\\manager\\ujap\.jsp
|
|
\\manager\\upup\.jsp
|
|
\\mecmd\\mecmd\.jsp
|
|
\\med\\med\.jsp
|
|
\\mela\\mela\.jsp
|
|
\\mgr\\lnx\.jsp
|
|
\\momo\\no\.jsp
|
|
\\msndbjgpaw\\msndbjgpaw\.jsp
|
|
\\msquare\\msquare\.jsp
|
|
\\namecard\\namecard\.jsp
|
|
\\namlah\\namlah\.jsp
|
|
\\netflow\\jspui\\NetworkSnapShot\.jsp
|
|
\\neweb_cs\\neweb_cs\.jsp
|
|
\\newgensso\\newgensso\.jsp
|
|
\\nhgsab\\nhgsab\.jsp
|
|
\\niet[0-9]{8,9}\.jsp
|
|
\\no\\no\.jsp
|
|
\\nop\\index\.jsp
|
|
\\nop\\nop\.jsp
|
|
\\nsilog\\nsilog\.jsp
|
|
\\ntpu\\ntpu\.jsp
|
|
\\ntuh\\ntuh\.jsp
|
|
\\nyco\\nyco\.jsp
|
|
\\ooxx\\ooxx\.jsp
|
|
\\opensso\\UI\\Login\.jsp
|
|
\\ori\\pwn\.jsp
|
|
\\os\\smd\.jsp
|
|
\\oss\\smd\.jsp
|
|
\\pass\\index\.jsp
|
|
\\payload\\payload\.jsp
|
|
\\pjjxh\\pjjxh\.jsp
|
|
\\psconsole\\faces\\common\\ProductVersion\.jsp
|
|
\\pw\\pw\.jsp
|
|
\\pwn\\pwn\.jsp
|
|
\\pwnd\\pwnd\.jsp
|
|
\\qqq\\qqq\.jsp
|
|
\\qwer\\index\.jsp
|
|
\\qwer\\qwer\.jsp
|
|
\\qyjxh\\qyjxh\.jsp
|
|
\\radlink\\radlink\.jsp
|
|
\\rdsan\\rdsan\.jsp
|
|
\\rgcb\\index\.jsp
|
|
\\rhspc\\rhspc\.jsp
|
|
\\roller-ui\\index\.jsp
|
|
\\roller\\index\.jsp
|
|
\\rs\\Browser\.jsp
|
|
\\console\\rshell\.jsp
|
|
\\rshell\\rshell\.jsp
|
|
\\rshell169\\rshell\.jsp
|
|
\\rshell197\\rshell\.jsp
|
|
\\rshell94\\rshell\.jsp
|
|
\\s\\s\.jsp
|
|
\\safe2\\index\.jsp
|
|
\\scripts\\Login\.jsp
|
|
\\scripts\\admin\\login\.jsp
|
|
\\scripts\\axis2-web\\index\.jsp
|
|
\\servar\\servar\.jsp
|
|
\\server\\server\.jsp
|
|
\\sh3ll\\sh3ll\.jsp
|
|
\\shel\\shel\.jsp
|
|
\\shell\\shell\.jsp
|
|
\\shell[0-9]{1,3}\\shell\.jsp
|
|
\\shellinvokee\\shellinvokee\.jsp
|
|
\\shellinvoker\\index\.jsp
|
|
\\shellinvoker\\shellinvoker\.jsp
|
|
\\shellinvokxy\\shellinvokxy\.jsp
|
|
\\sicerweb\\sicerweb\.jsp
|
|
\\sicguadalajara\\sicguadalajara\.jsp
|
|
\\simplelinkportlet\\simplelinkportlet\.jsp
|
|
\\sjinad\\index\.jsp
|
|
\\smgodyfatv\\smgodyfatv\.jsp
|
|
\\smjwcyadot\\smjwcyadot\.jsp
|
|
\\smrnqgdfbx\\smrnqgdfbx\.jsp
|
|
\\sns\\index\.jsp
|
|
\\sohzfdxgcy\\sohzfdxgcy\.jsp
|
|
\\sonyjukeboxmdb\\sonyjukeboxmdb\.jsp
|
|
\\sonyxmlchartfeed\\sonyxmlchartfeed\.jsp
|
|
\\spy195\\spy\.jsp
|
|
\\spy274\\spy\.jsp
|
|
\\ssvcss\\index\.jsp
|
|
\\sw-style\\sw-style\.jsp
|
|
\\swynhoff\\swynhoff\.jsp
|
|
\\syjxh\\syjxh\.jsp
|
|
\\sync\\sync\.jsp
|
|
\\sysaid\\Login\.jsp
|
|
\\system1\.jsp
|
|
\\system2\.jsp
|
|
\\system3\.jsp
|
|
\\t2stj60ss\\t2stj60ss\.jsp
|
|
\\test\\2\.jsp
|
|
\\test\\test\.jsp
|
|
\\testo\\testo\.jsp
|
|
\\tiger2\\index\.jsp
|
|
\\tmui\\login\.jsp
|
|
\\tyrinnjefferies\\tyrinnjefferies\.jsp
|
|
\\upload5warn\\css\.jsp
|
|
\\validadorDocumento\\validadorDocumento\.jsp
|
|
\\wado\\wado\.jsp
|
|
\\wdjxh\\wdjxh\.jsp
|
|
\\wincfg\\wincfg\.jsp
|
|
\\wizard\\wizard\.jsp
|
|
\\wky\\wky\.jsp
|
|
\\wlweb\\wlweb\.jsp
|
|
\\wmHbixOS\\wmHbixOS\.jsp
|
|
\\wooyun\\wooyun\.jsp
|
|
\\ws\\axis2-web\\index\.jsp
|
|
\\wstats\\wstats\.jsp
|
|
\\x\\pwn\.jsp
|
|
\\x\\w\.jsp
|
|
\\x\\x\.jsp
|
|
\\xfsix\\xfsix\.jsp
|
|
\\xpoolm\\xpoolm\.jsp
|
|
\\xpoolm10\\xpoolm10\.jsp
|
|
\\xx\\index\.jsp
|
|
\\xx\\xx\.jsp
|
|
\\xxoo\\xxoo\.jsp
|
|
\\xxx\\xxx\.jsp
|
|
\\xxxxyyyy\\xxxxyyyy\.jsp
|
|
\\xxxyyy\\xxxyyy\.jsp
|
|
\\yinyi\\yinyi\.jsp
|
|
\\ysbao\\ysbao\.jsp
|
|
\\zbqwx\\zbqwx\.jsp
|
|
\\zcmd\\zcmd\.jsp
|
|
\\zecd\\zecd\.jsp
|
|
\\zecmd\\osl\.jsp
|
|
\\zecmd\\zecmd\.jsp
|
|
\\zeekill\\zeekill\.jsp
|
|
\\zere\\zere\.jsp
|
|
\\zere\\zion\.jsp
|
|
\\zfcgreg\\zfcgreg\.jsp
|
|
\\zfsqapp\\zfsqapp\.jsp
|
|
\\zion\\zion\.jsp
|
|
\\zjjxh\\zjjxh\.jsp
|
|
\\zjxh\\zjxh\.jsp
|
|
\\zmeu\\zmeu\.jsp
|
|
\\zzmeu\\zzmeu\.jsp
|
|
\\jexinv3\\jexinv3\.jsp
|
|
\\jexws\\jexws\.jsp
|
|
\\jexws3\\jexws3\.jsp
|
|
\\invoker\\jbosscons\.jsp
|
|
|
|
# APT29 Report PaloAlto
|
|
AppData\\Adobe\\qpbqrx\.dat;80
|
|
|
|
# Webshells
|
|
\\antak\.aspx;70
|
|
|
|
# Buckeye APT
|
|
\\eof\.exe;100
|
|
|
|
# Suspicious EXE DLL in Non-Executable directory
|
|
\\(images|img|js|fonts|css|swf|templates|themes|log|error_docs)\\[^\\]{,20}\.(exe|dll)$;60
|
|
\\(wp-admin|wp-content|wp-includes)\\[^\\]{,20}\.(exe|dll);60
|
|
|
|
# APT29 Post-Election Acitivty https://goo.gl/4nyX1e
|
|
\\RWP_16-038_Norris\.ZIP;80
|
|
\\37486\.ZIP;60
|
|
\\message0236\.ZIP;80
|
|
\\Roaming\\Apple\\gwV46iIc\.idx;80
|
|
\\Roaming\\HP\\fywhx\.dll;80
|
|
\\Roaming\\Dell\\impku\.dat;80
|
|
\\Roaming\\Apple\\hqwhbr\.lck;80
|
|
|
|
# Shamoon 2.0 https://goo.gl/khxVGq
|
|
ystem32\\ntssrvr32\.exe;80
|
|
ystem32\\ntssrvr64\.exe;80
|
|
\\ntssrvr32\.bat;80
|
|
ystem32\\gpget\.exe;80
|
|
ystem32\\drdisk\.sys;80
|
|
\\key8854321\.pub;80
|
|
ystem32\\netinit\.exe;80
|
|
\\inf\\usbvideo324\.pnf;70
|
|
\\Windows\\System32\\caclsrv\.exe;65
|
|
\\Windows\\System32\\certutl\.exe;65
|
|
\\Windows\\System32\\clean\.exe;65
|
|
\\Windows\\System32\\ctrl\.exe;65
|
|
\\Windows\\System32\\dfrag\.exe;65
|
|
\\Windows\\System32\\dnslookup\.exe;65
|
|
\\Windows\\System32\\dvdquery\.exe;65
|
|
\\Windows\\System32\\event\.exe;65
|
|
\\Windows\\System32\\extract\.exe;65
|
|
\\Windows\\System32\\findfile\.exe;65
|
|
\\Windows\\System32\\fsutl\.exe;65
|
|
\\Windows\\System32\\gpget\.exe;65
|
|
\\Windows\\System32\\iissrv\.exe;65
|
|
\\Windows\\System32\\ipsecure\.exe;65
|
|
\\Windows\\System32\\msinit\.exe;65
|
|
\\Windows\\System32\\netx\.exe;65
|
|
\\Windows\\System32\\ntdsutl\.exe;65
|
|
\\Windows\\System32\\ntfrsutil\.exe;65
|
|
\\Windows\\System32\\ntnw\.exe;65
|
|
\\Windows\\System32\\power\.exe;65
|
|
\\Windows\\System32\\rdsadmin\.exe;65
|
|
\\Windows\\System32\\regsys\.exe;65
|
|
\\Windows\\System32\\routeman\.exe;65
|
|
\\Windows\\System32\\rrasrv\.exe;65
|
|
\\Windows\\System32\\sacses\.exe;65
|
|
\\Windows\\System32\\sfmsc\.exe;65
|
|
\\Windows\\System32\\sigver\.exe;65
|
|
\\Windows\\System32\\smbinit\.exe;65
|
|
\\Windows\\System32\\wcscript\.exe;65
|
|
ystem32\\Drivers\\drdisk.sys;70
|
|
|
|
# GoldenEye Ransomware Naming Scheme
|
|
Temp\\rad[A-F0-9]{5}\.exe;70
|
|
|
|
# Shadow Broker File Listing Dec 2016
|
|
\\bs\.ratload;80
|
|
\\catflap$;80
|
|
\\catflap_;80
|
|
\\charm_razor;80
|
|
\\charm_penguin;80
|
|
\\charm_hammer;80
|
|
\\alwayspcap\.pl;80
|
|
\\curse(bingo|bongo|chicken|clash|devo|fire|flower|gismo|happy|hole)\.;60
|
|
\\dampcrowd\.;80
|
|
\\dewdrop__;80
|
|
\\Dubmoat_;80
|
|
\\Dubmoat\-;80
|
|
\\ebbisland;60
|
|
\\ebbnew_linux;60
|
|
\\ebbshave\.;80
|
|
\\eggbasket$;80
|
|
\\elatedmonkey\.;80
|
|
\\electricslide;80
|
|
\\toffeehammer;80
|
|
\\elgingamble;80
|
|
\\endlessdonut;80
|
|
\\enemyrun\.;80
|
|
\\environcollision;80
|
|
\\envoytomato;80
|
|
\\expoxyresin;80
|
|
\\esna\.py$;80
|
|
\\estopmoonlit;80
|
|
\\evolvingstrategy;80
|
|
\\ewok$;80
|
|
\\x86\-linux\-exactchange;80
|
|
\\x86_x64\-linux\-exactchange;80
|
|
\\exp\.x$;60
|
|
\\exp\.s$;60
|
|
\\exze$;60
|
|
\\ghost_x86;80
|
|
\\ghost_sparc;80
|
|
\\ftshell\.;50
|
|
\\jackpop\.;60
|
|
\\magicjack_;60
|
|
\\orleansstride;80
|
|
\\orleans_stride;80
|
|
\\porkserver\.;80
|
|
\\porksclient\.;80
|
|
\\seconddate;60
|
|
\\skimcountry;80
|
|
\\slyheretic;80
|
|
\\stoicsurgeon;80
|
|
\\strifeworld;80
|
|
\\implant;40
|
|
\\suctionchar;60
|
|
\\Suctionchar;80
|
|
\\vs\.attack;80
|
|
\\ys\.ratload;80
|
|
|
|
# Kaspersky StoneDrill Report
|
|
\\[Ww]indows\\[Tt]emp\\key[0-9]{6,8}\.pub;70
|
|
\\caclsrv\.exe;60
|
|
\\dvdquery\.exe;60
|
|
\\msinit\.exe;60
|
|
\\wcscript\.exe;60
|
|
\\certutl\.exe;60
|
|
\\event\.exe;60
|
|
\\ntfrsutil\.exe;60
|
|
\\routeman\.exe;60
|
|
\\ntnw\.exe;60
|
|
\\clean\.exe;60
|
|
\\findfile\.exe;60
|
|
\\ntdsutl\.exe;60
|
|
\\rrasrv\.exe;60
|
|
\\netx\.exe;60
|
|
\\ctrl\.exe;60
|
|
\\gpget\.exe;60
|
|
\\power\.exe;60
|
|
\\sacses\.exe;60
|
|
\\fsutl\.exe;60
|
|
\\dfrag\.exe;60
|
|
\\ipsecure\.exe;60
|
|
\\rdsadmin\.exe;60
|
|
\\sfmsc\.exe;60
|
|
\\dnslookup\.exe;60
|
|
\\iissrv\.exe;60
|
|
\\regsys.\exe ;60
|
|
\\smbinit\.exe;60
|
|
|
|
# Unicdoe Left-to-Right Override Trick https://goo.gl/cHnBqP
|
|
fdp\.exe;60
|
|
|
|
# APT 29 Activity https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
|
|
\\googleService\.exe;80
|
|
\\Program Files\(x86\)\\Google\\GoogleUpdate\.exe;80
|
|
\\Program Files\(x86\)\\Google\\start\.ps1;80
|
|
\\Program Files\(x86\)\\Google\\install\.bat;80
|
|
|
|
# Typical Malware Names
|
|
\\svchos1\.exe;60
|
|
\\Program Files\(x86\)\\Google\\[^\\]{1,20}\.(exe|ps1);80
|
|
\\Windows\\inf\\[^\\]{1,20}\.(exe|ps1);60
|
|
|
|
# Cloud Hopper Indicator - https://goo.gl/OkB63q
|
|
\\mPclient\.dll;90
|
|
\\mfeann\.data;90
|
|
\\vba32arch\.dll;90
|
|
\\SFCNS\.dat;90
|
|
\\schf\.its;90
|
|
\\logmeinsystrays\.dat;90
|
|
\\secretsdump\.exe;90
|
|
\\psexe\.exe;90
|
|
\\NetSess\.exe;90
|
|
\\detect\.vbs;90
|
|
\\rund11\.exe;90
|
|
\\nbt\.exe;90
|
|
\\atexec\.exe;90
|
|
\\LogMeInSystrays\.dat;90
|
|
\\[0-9]{1,20}\.plg;90
|
|
\\NvSmart\.hlp;90
|
|
\\AppData\\Local\\Temp\\winsyslog\\msseces\.exe;90
|
|
\\AppData\\Local\\Temp\\winsyslog\\msseces\.asm;90
|
|
\\AppData\\Local\\Temp\\winsyslog\\mPclient\.dll ;90
|
|
\\Vba32ar\.cab\.dat;90
|
|
\\gfdnippwwg;90
|
|
\\Windows Data AntiVirus;90
|
|
\\t\.vbs\.cfg;90
|
|
\\furnish\.dat;90
|
|
\\ProgramData\\SxS\\[^\\]{1,20}\.(exe|dll|dat);90
|
|
\\wpf-etw\.dat;90
|
|
\\microsoft\.workflow\.compiler\.dat;90
|
|
|
|
# Cloud Hopper Indicator - Rare Software - Check for False Positives https://goo.gl/OkB63q
|
|
\\gothic\.dat;60
|
|
\\shortcutfixer\.exe;60
|
|
\\k7sysmon\.exe;60
|
|
\\pokerstarsbr\.exe;60
|
|
\\t\.vbs;60
|
|
\\tcping\.exe;60
|
|
\\K7sysmn1\.dll;60
|
|
|
|
# Cloud Hopper - Annex B Extraction https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
|
|
\\AppData\\Local\\Temp\\handkerchief\.dat;80
|
|
\\Temp\\obedience\.exe;80
|
|
\\AppData\\Local\\Temp\\starburn\.dll;80
|
|
\\RedLeaves\.exe;75
|
|
\\PerfLogs\\[^\\]{1,20}\.(exe|dll|vbs|ps1);60
|
|
\\Recovery\\[^\\]{1,20}\.(exe|dll|vbs|ps1);60
|
|
\\wmi\.dll\.bak;80
|
|
\\rund1132\.exe;80
|
|
\\consl64\.exe;60
|
|
|
|
# Lazarus Group https://securelist.com/blog/sas/77908/lazarus-under-the-hood/
|
|
\\Windows\\Web\\Wallpaper\\[^\.]{1,25}\.(exe|dll|vbs|ps1);70
|
|
\\Desktop\\win32\\liboradb\.dll;80
|
|
\\Windows\\msdtc\.exe;80
|
|
\\Windows\\gpvc\.exe;80
|
|
\\Windows\\Help\\srservice\.chm;80
|
|
\\Windows\\Help\\srservice\.hlp;70
|
|
ystem32\\lcsvsvc\.dll;80
|
|
\\Windows\\msdtc\.bat;70
|
|
:\\MSO10\\LATIN\.SHP;70
|
|
|
|
# US CERT Alert (TA17-117A)
|
|
\\3D Tetris\.exe;60
|
|
\\2016-12-01_05-18_c1cb28327d3364768d1c1e4ce0d9bc07_4132357b;80
|
|
\\2016-11-30_00-13_23d03ee4bf57de7087055b230dae7c5b_79a67d75;80
|
|
\\f157874512\.exe;80
|
|
\\artf\.exe;80
|
|
\\age\.exex;80
|
|
\\b20ce00a6864225f05de6407fac80ddb83cd0aec00ada438c1e354cdd0d7d5df\.bin;80
|
|
\\WinCConnect\.exe;60
|
|
\\RCt\.exe;80
|
|
\\SXm\.exe;80
|
|
\\offcee\.EXE;80
|
|
\\ShorcutLauncher\.exe;80
|
|
\\ap1\.exe;80
|
|
\\run\.dll;60
|
|
\\Vba32ar\.exe;80
|
|
\\runsna\.dll;80
|
|
\\dragon\.exe;80
|
|
\\dragon\.dll;80
|
|
\\IPHLPAPI\.dll;80
|
|
\\GeekBuddyRSP\.exe;80
|
|
\\cif\.exe;80
|
|
\\condition\.dat;80
|
|
\\gentee\.dll;60
|
|
\\csvde\.exe;80
|
|
\\nltest\.exe;60
|
|
|
|
# Oilrig https://goo.gl/Gw32C8
|
|
\\Program Files \(x86\)\\Microsoft Idle\\[^\\]{1,16}\.exe;70
|
|
\\Start Menu\\Programs\\Startup\\WinInit\.lnk;70
|
|
\\Start Menu\\Programs\\Startup\\SyncInit\.lnk;70
|
|
|
|
# Snake / Turla https://goo.gl/QaOh4V
|
|
/Library/LaunchDaemons/com.adobe\.update\.plist;70
|
|
/Library/Scripts/installd\.sh;70
|
|
/Library/Scripts/queue;70
|
|
/var/tmp/\.ur-;70
|
|
/tmp/\.gdm-socket;70
|
|
/tmp/\.gdm-selinux;70
|
|
|
|
# Custom SHIM SDB found - this is suspicious - see https://goo.gl/xW90xr
|
|
\\Windows\\AppPatch\\Custom\\[^\\]{1,50}\.sdb;80
|
|
\\Windows\\AppPatch\\Custom\\Custom64\\[^\\]{1,50}\.sdb;80
|
|
|
|
# FIN7 SHIM temp files pattern - see https://goo.gl/xW90xr
|
|
\\Windows\\Temp\\sdb[A-Z0-9]{4}\.tmp$;60
|
|
|
|
# Kazuar - https://goo.gl/eDDTQj
|
|
\\AppData\\Local\\[a-f0-9]{32}\\[a-f0-9]{32}\.dll;70
|
|
\\AppData\\Local\\[a-f0-9]{32}\\[a-f0-9]{32}\\;60
|
|
|
|
# End
|