API tools faq
paste
Advertisement
paladin316

Exes_5196a7de5adc3f9beda8b42a602276ec_exe_2019-08-15_09_30.txt

paladin316
Aug 15th, 2019
1,460
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 44.46 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Malicious"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_5196a7de5adc3f9beda8b42a602276ec.exe"
  7. * File Size: 1367801
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "ba1410576f819a2b743d15f3861a62366c246506f5abf0df67982f8224e9c2b9"
  10. * MD5: "5196a7de5adc3f9beda8b42a602276ec"
  11. * SHA1: "8844bc81f9e994f8a8995cfa78e03cdd3a4132f6"
  12. * SHA512: "ca6fecf4c7c8d8a32ca92c948e3bbb8a76b654eb4025660e8035f34a4de9d12cdcc3c220de762676a48cb086472cf6cd5f4dc90dd766749060885cac8a2f1db3"
  13. * CRC32: "1C6B8C99"
  14. * SSDEEP: "24576:8NA3R5drXIvJsuITDRqwkIMaNneDKgPJfRImIKu1h6LId7nf1RMMaReV5BHFAm0Y:95IxBITDsw7M7PJfufd1h6LIdzfXMf2x"
  15.  
  16. * Process Execution:
  17. "Exes_5196a7de5adc3f9beda8b42a602276ec.exe",
  18. "wscript.exe",
  19. "vuv.exe",
  20. "RegSvcs.exe",
  21. "svchost.exe",
  22. "WmiPrvSE.exe"
  23.  
  24.  
  25. * Executed Commands:
  26. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\evf.vbs\"",
  27. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\evf.vbs ",
  28. "\"C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe\" umw=djk",
  29. "vuv.exe umw=djk",
  30. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  31.  
  32.  
  33. * Signatures Detected:
  34.  
  35. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  36. "Details":
  37.  
  38. "IP": "173.223.52.200:80"
  39.  
  40.  
  41. "IP": "13.107.4.50:80"
  42.  
  43.  
  44. "IP": "23.111.11.204:80"
  45.  
  46.  
  47.  
  48.  
  49. "Description": "Creates RWX memory",
  50. "Details":
  51.  
  52.  
  53. "Description": "Detected script timer window indicative of sleep style evasion",
  54. "Details":
  55.  
  56. "Window": "WSH-Timer"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  62. "Details":
  63.  
  64. "ioc": "o.o.1"
  65.  
  66.  
  67.  
  68.  
  69. "Description": "Expresses interest in specific running processes",
  70. "Details":
  71.  
  72. "process": "RegSvcs.exe"
  73.  
  74.  
  75. "process": "conhost.exe"
  76.  
  77.  
  78.  
  79.  
  80. "Description": "Reads data out of its own binary image",
  81. "Details":
  82.  
  83. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00000000, length: 0x00000007"
  84.  
  85.  
  86. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00000000, length: 0x00002000"
  87.  
  88.  
  89. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00000007, length: 0x0014def2"
  90.  
  91.  
  92. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00001ff0, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00003fe0, length: 0x00002000"
  96.  
  97.  
  98. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00005fd0, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00007fc0, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00009fb0, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0000bfa0, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0000df90, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0000ff80, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00011f70, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00013f60, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00015f50, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00017f40, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00019f30, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0001bf20, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0001df10, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0001ff00, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00021ef0, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00023ee0, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00025ed0, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00027ec0, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00029eb0, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0002bea0, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0002de90, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0002fe80, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00031e70, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00033e60, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00035e50, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00037e40, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00039e30, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0003be20, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0003de10, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0003fe00, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00041df0, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00043de0, length: 0x00002000"
  192.  
  193.  
  194. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00045600, length: 0x00000031"
  195.  
  196.  
  197. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00045619, length: 0x00101824"
  198.  
  199.  
  200. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00146ff3, length: 0x00000028"
  201.  
  202.  
  203. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001471f5, length: 0x00000029"
  204.  
  205.  
  206. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001473d6, length: 0x00000028"
  207.  
  208.  
  209. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001475ee, length: 0x00000028"
  210.  
  211.  
  212. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001477bf, length: 0x00000027"
  213.  
  214.  
  215. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001479b9, length: 0x00000028"
  216.  
  217.  
  218. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00147b90, length: 0x00000028"
  219.  
  220.  
  221. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00147d68, length: 0x00000028"
  222.  
  223.  
  224. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00147f64, length: 0x00000028"
  225.  
  226.  
  227. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148166, length: 0x00000028"
  228.  
  229.  
  230. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148333, length: 0x00000028"
  231.  
  232.  
  233. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148501, length: 0x00000028"
  234.  
  235.  
  236. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148743, length: 0x00000028"
  237.  
  238.  
  239. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014890f, length: 0x00000028"
  240.  
  241.  
  242. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148b17, length: 0x00000028"
  243.  
  244.  
  245. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148ce5, length: 0x00000028"
  246.  
  247.  
  248. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00148efe, length: 0x00000028"
  249.  
  250.  
  251. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001490e3, length: 0x00000028"
  252.  
  253.  
  254. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x001492ae, length: 0x00000028"
  255.  
  256.  
  257. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00149490, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014966f, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00149865, length: 0x00000028"
  264.  
  265.  
  266. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00149a5f, length: 0x00000028"
  267.  
  268.  
  269. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00149c57, length: 0x00000028"
  270.  
  271.  
  272. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x00149e36, length: 0x00000028"
  273.  
  274.  
  275. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a03e, length: 0x00000028"
  276.  
  277.  
  278. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a24d, length: 0x00000028"
  279.  
  280.  
  281. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a421, length: 0x00000028"
  282.  
  283.  
  284. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a612, length: 0x00000028"
  285.  
  286.  
  287. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a7dc, length: 0x00000027"
  288.  
  289.  
  290. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014a9c4, length: 0x00000028"
  291.  
  292.  
  293. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014abb4, length: 0x00000028"
  294.  
  295.  
  296. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014adb5, length: 0x00000028"
  297.  
  298.  
  299. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014af87, length: 0x00000028"
  300.  
  301.  
  302. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014b17f, length: 0x00000028"
  303.  
  304.  
  305. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014b353, length: 0x00000028"
  306.  
  307.  
  308. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014b567, length: 0x00000028"
  309.  
  310.  
  311. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014b759, length: 0x00000028"
  312.  
  313.  
  314. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014b979, length: 0x00000028"
  315.  
  316.  
  317. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014bb44, length: 0x00000028"
  318.  
  319.  
  320. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014bd25, length: 0x00000028"
  321.  
  322.  
  323. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014bf20, length: 0x00000028"
  324.  
  325.  
  326. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014c0ff, length: 0x00000028"
  327.  
  328.  
  329. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014c2f2, length: 0x00000027"
  330.  
  331.  
  332. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014c4e6, length: 0x00000028"
  333.  
  334.  
  335. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014c70b, length: 0x00000028"
  336.  
  337.  
  338. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014c8da, length: 0x00000028"
  339.  
  340.  
  341. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014caac, length: 0x00000028"
  342.  
  343.  
  344. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014ccd2, length: 0x00000028"
  345.  
  346.  
  347. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014cec7, length: 0x00000028"
  348.  
  349.  
  350. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014d0d4, length: 0x00000028"
  351.  
  352.  
  353. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014d2c8, length: 0x00000028"
  354.  
  355.  
  356. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014d4b1, length: 0x00000028"
  357.  
  358.  
  359. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014d67d, length: 0x00000028"
  360.  
  361.  
  362. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014d87a, length: 0x00000028"
  363.  
  364.  
  365. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014da52, length: 0x00000028"
  366.  
  367.  
  368. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014dc1e, length: 0x00000028"
  369.  
  370.  
  371. "self_read": "process: Exes_5196a7de5adc3f9beda8b42a602276ec.exe, pid: 712, offset: 0x0014de3e, length: 0x0000001b"
  372.  
  373.  
  374. "self_read": "process: wscript.exe, pid: 1692, offset: 0x00000000, length: 0x00000040"
  375.  
  376.  
  377. "self_read": "process: wscript.exe, pid: 1692, offset: 0x000000f0, length: 0x00000018"
  378.  
  379.  
  380. "self_read": "process: wscript.exe, pid: 1692, offset: 0x000001e8, length: 0x00000078"
  381.  
  382.  
  383. "self_read": "process: wscript.exe, pid: 1692, offset: 0x00018000, length: 0x00000020"
  384.  
  385.  
  386. "self_read": "process: wscript.exe, pid: 1692, offset: 0x00018058, length: 0x00000018"
  387.  
  388.  
  389. "self_read": "process: wscript.exe, pid: 1692, offset: 0x000181a8, length: 0x00000018"
  390.  
  391.  
  392. "self_read": "process: wscript.exe, pid: 1692, offset: 0x00018470, length: 0x00000010"
  393.  
  394.  
  395. "self_read": "process: wscript.exe, pid: 1692, offset: 0x00018640, length: 0x00000012"
  396.  
  397.  
  398.  
  399.  
  400. "Description": "Drops a binary and executes it",
  401. "Details":
  402.  
  403. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe"
  404.  
  405.  
  406.  
  407.  
  408. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  409. "Details":
  410.  
  411. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  412.  
  413.  
  414. "suspicious_request": "http://checkip.dyndns.org/"
  415.  
  416.  
  417. "suspicious_request": "http://repository.certum.pl/ca.cer"
  418.  
  419.  
  420.  
  421.  
  422. "Description": "Performs some HTTP requests",
  423. "Details":
  424.  
  425. "url": "http://checkip.dyndns.org/"
  426.  
  427.  
  428. "url": "http://repository.certum.pl/ca.cer"
  429.  
  430.  
  431. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  432.  
  433.  
  434.  
  435.  
  436. "Description": "Looks up the external IP address",
  437. "Details":
  438.  
  439. "domain": "checkip.dyndns.org"
  440.  
  441.  
  442.  
  443.  
  444. "Description": "Executed a process and injected code into it, probably while unpacking",
  445. "Details":
  446.  
  447. "Injection": "vuv.exe(2688) -> RegSvcs.exe(1060)"
  448.  
  449.  
  450.  
  451.  
  452. "Description": "Sniffs keystrokes",
  453. "Details":
  454.  
  455. "SetWindowsHookExW": "Process: RegSvcs.exe(1060)"
  456.  
  457.  
  458.  
  459.  
  460. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  461. "Details":
  462.  
  463. "Process": "RegSvcs.exe tried to sleep 2304 seconds, actually delayed analysis time by 0 seconds"
  464.  
  465.  
  466.  
  467.  
  468. "Description": "Steals private information from local Internet browsers",
  469. "Details":
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  472.  
  473.  
  474.  
  475.  
  476. "Description": "Installs itself for autorun at Windows startup",
  477. "Details":
  478.  
  479. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  480.  
  481.  
  482. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\UMW_DJ~1"
  483.  
  484.  
  485.  
  486.  
  487. "Description": "Creates a hidden or system file",
  488. "Details":
  489.  
  490. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe"
  491.  
  492.  
  493. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\66880718"
  494.  
  495.  
  496. "file": "C:\\Users\\user\\temp"
  497.  
  498.  
  499. "file": "C:\\Users\\user\\AppData\\Roaming\\ScreenShot"
  500.  
  501.  
  502.  
  503.  
  504. "Description": "Retrieves Windows ProductID, probably to fingerprint the sandbox",
  505. "Details":
  506.  
  507.  
  508. "Description": "File has been identified by 19 Antiviruses on VirusTotal as malicious",
  509. "Details":
  510.  
  511. "Malwarebytes": "Trojan.MalPack.AISFX.Generic"
  512.  
  513.  
  514. "K7AntiVirus": "Trojan ( 005559bd1 )"
  515.  
  516.  
  517. "K7GW": "Trojan ( 005559bd1 )"
  518.  
  519.  
  520. "Cybereason": "malicious.1f9e99"
  521.  
  522.  
  523. "APEX": "Malicious"
  524.  
  525.  
  526. "Invincea": "heuristic"
  527.  
  528.  
  529. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  530.  
  531.  
  532. "Trapmine": "suspicious.low.ml.score"
  533.  
  534.  
  535. "FireEye": "Generic.mg.5196a7de5adc3f9b"
  536.  
  537.  
  538. "Cyren": "W32/AutoIt.EN.gen!Eldorado"
  539.  
  540.  
  541. "Antiy-AVL": "TrojanArcBomb/Win32.Agent"
  542.  
  543.  
  544. "Microsoft": "Trojan:Win32/Wacatac.B!ml"
  545.  
  546.  
  547. "AegisLab": "Trojan.BAT.Crypter.tqa8"
  548.  
  549.  
  550. "AhnLab-V3": "Malware/Win32.RL_Generic.R286428"
  551.  
  552.  
  553. "Zoner": "Probably RARAutorun"
  554.  
  555.  
  556. "Rising": "Trojan.Win32.Presenoker.a (CLASSIC)"
  557.  
  558.  
  559. "Yandex": "Trojan.Agent!nS7qVYN4VgU"
  560.  
  561.  
  562. "CrowdStrike": "win/malicious_confidence_100% (D)"
  563.  
  564.  
  565. "Qihoo-360": "HEUR/QVM10.1.379F.Malware.Gen"
  566.  
  567.  
  568.  
  569.  
  570. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  571. "Details":
  572.  
  573.  
  574. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  575. "Details":
  576.  
  577. "dropped": "clamav:Win.Trojan.Autoit-6922942-0, sha256:fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  578.  
  579.  
  580.  
  581.  
  582. "Description": "Harvests information related to installed mail clients",
  583. "Details":
  584.  
  585. "file": "C:\\Users\\user\\AppData\\Roaming\\Thunderbird\\profiles.ini"
  586.  
  587.  
  588. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\9375CFF0413111d3B88A00104B2A6676"
  589.  
  590.  
  591. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  592.  
  593.  
  594. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Password"
  595.  
  596.  
  597. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
  598.  
  599.  
  600. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\HTTP Password"
  601.  
  602.  
  603. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  604.  
  605.  
  606. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\HTTP Password"
  607.  
  608.  
  609. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  610.  
  611.  
  612. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Password"
  613.  
  614.  
  615. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
  616.  
  617.  
  618. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Password"
  619.  
  620.  
  621. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Password"
  622.  
  623.  
  624. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  625.  
  626.  
  627. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Password"
  628.  
  629.  
  630. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Password"
  631.  
  632.  
  633. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  634.  
  635.  
  636.  
  637.  
  638. "Description": "Attempts to create or modify system certificates",
  639. "Details":
  640.  
  641.  
  642. "Description": "Makes SMTP requests, possibly sending spam or exfiltrating data.",
  643. "Details":
  644.  
  645. "SMTP": "213.180.193.38 (smtp.yandex.ru)"
  646.  
  647.  
  648. "SMTP": "77.88.21.38 (smtp.yandex.ru)"
  649.  
  650.  
  651.  
  652.  
  653. "Description": "Collects information to fingerprint the system",
  654. "Details":
  655.  
  656.  
  657.  
  658. * Started Service:
  659.  
  660. * Mutexes:
  661. "DefaultTabtip-MainUI",
  662. "CicLoadWinStaWinSta0",
  663. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  664. "Local\\ZoneAttributeCacheCounterMutex",
  665. "Local\\ZonesCacheCounterMutex",
  666. "Local\\ZonesLockedCacheCounterMutex",
  667. "Global\\CLR_CASOFF_MUTEX",
  668. "Global\\.net clr networking",
  669. "Local\\_!MSFTHISTORY!_",
  670. "Local\\c:!users!user!appdata!local!microsoft!windows!temporary internet files!content.ie5!",
  671. "Local\\c:!users!user!appdata!roaming!microsoft!windows!cookies!",
  672. "Local\\c:!users!user!appdata!local!microsoft!windows!history!history.ie5!"
  673.  
  674.  
  675. * Modified Files:
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\__tmp_rar_sfx_access_check_10655453",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\hwb.bmp",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\umw=djk",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\evf.vbs",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vuv.exe",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\tjx.cpl",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\scj.bin",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\glt.ico",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fig.mp3",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\loc.mp3",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\jxb.jpg",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\tna.docx",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vqo.mp3",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ctu.xl",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\xtr.ico",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ksd.bin",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\jkl.ppt",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\erv.bin",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\eop.msc",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\bdf.jpg",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\spg.log",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\rfi.jpg",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\euc.pdf",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\hhk.mp3",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\hkp.docx",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\usb.bin",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\njt.xml",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\vkb.xl",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\bwx.mp3",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\unx.exe",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\qxj.ppt",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ljb.ppt",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\xbg.bin",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\hkr.dll",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\tkf.ppt",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fvl.bmp",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\iat.txt",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ubx.dat",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\rkv.dat",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\gjj.msc",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\kds.xls",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fds.cpl",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\evx.xls",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ipc.bmp",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\jvm.dll",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\wsj.txt",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ioh.xls",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\uhn.bin",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\udm.pdf",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ilq.icm",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\qiv.exe",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\cul.icm",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\gsi.xl",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\cfh.jpg",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\pcw.xls",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\hse.cpl",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ola.msc",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\uxx.msc",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\qea.txt",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\tup.exe",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\xoi.xml",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\qqx.dat",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\clp.xls",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\xhs.pdf",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\jod.icm",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\rvl.ppt",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\qrr.xl",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ocb.bin",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\xga.ico",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\aed.exe",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\sjj.dat",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\kli.msc",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\ppr.exe",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fge.mp3",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\jav.bin",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\wau.cpl",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\skd.dat",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\dbu.pdf",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fed.bin",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\fmf.jpg",
  756. "C:\\Users\\user\\temp\\hwb.bmp",
  757. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat",
  758. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat",
  759. "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat",
  760. "C:\\Users\\user\\AppData\\Roaming\\ScreenShot\\screen.jpeg",
  761. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\000F7F8FAB2D96E6F8CBD5C9A3B4EC90",
  762. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\000F7F8FAB2D96E6F8CBD5C9A3B4EC90",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF1D.tmp",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF1E.tmp",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF6E.tmp",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF6F.tmp",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF9E.tmp",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF9F.tmp",
  769. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  770. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C.tmp",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D.tmp",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8D.tmp",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E.tmp",
  775. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  776. "\\??\\WMIDataDevice",
  777. "\\??\\PIPE\\wkssvc",
  778. "\\??\\PIPE\\srvsvc"
  779.  
  780.  
  781. * Deleted Files:
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\66880718\\__tmp_rar_sfx_access_check_10655453",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF1D.tmp",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF1E.tmp",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF6E.tmp",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF6F.tmp",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\CabFF9E.tmp",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\TarFF9F.tmp",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab5C.tmp",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar5D.tmp",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab8D.tmp",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar8E.tmp"
  793.  
  794.  
  795. * Modified Registry Keys:
  796. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  797. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  798. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  799. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  800. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Tracing\\RegSvcs_RASAPI32",
  801. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\EnableFileTracing",
  802. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\EnableConsoleTracing",
  803. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\FileTracingMask",
  804. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\ConsoleTracingMask",
  805. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\MaxFileSize",
  806. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Tracing\\RegSvcs_RASAPI32\\FileDirectory",
  807. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\6252DC40F71143A22FDE9EF7348E064251B18118\\Blob"
  808.  
  809.  
  810. * Deleted Registry Keys:
  811. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  812. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  813. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  814. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  815. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\Certificates\\6252DC40F71143A22FDE9EF7348E064251B18118"
  816.  
  817.  
  818. * DNS Communications:
  819.  
  820. "type": "A",
  821. "request": "checkip.dyndns.org",
  822. "answers":
  823.  
  824. "data": "checkip.dyndns.com",
  825. "type": "CNAME"
  826.  
  827.  
  828. "data": "162.88.193.70",
  829. "type": "A"
  830.  
  831.  
  832. "data": "216.146.43.71",
  833. "type": "A"
  834.  
  835.  
  836. "data": "216.146.43.70",
  837. "type": "A"
  838.  
  839.  
  840. "data": "131.186.113.70",
  841. "type": "A"
  842.  
  843.  
  844.  
  845.  
  846. "type": "A",
  847. "request": "smtp.yandex.ru",
  848. "answers":
  849.  
  850. "data": "213.180.204.38",
  851. "type": "A"
  852.  
  853.  
  854. "data": "213.180.193.38",
  855. "type": "A"
  856.  
  857.  
  858. "data": "93.158.134.38",
  859. "type": "A"
  860.  
  861.  
  862. "data": "77.88.21.38",
  863. "type": "A"
  864.  
  865.  
  866. "data": "87.250.250.38",
  867. "type": "A"
  868.  
  869.  
  870.  
  871.  
  872. "type": "A",
  873. "request": "repository.certum.pl",
  874. "answers":
  875.  
  876. "data": "23.111.11.204",
  877. "type": "A"
  878.  
  879.  
  880. "data": "repository.uzto.netdna-cdn.com",
  881. "type": "CNAME"
  882.  
  883.  
  884.  
  885.  
  886.  
  887. * Domains:
  888.  
  889. "ip": "162.88.193.70",
  890. "domain": "checkip.dyndns.org"
  891.  
  892.  
  893. "ip": "23.111.11.204",
  894. "domain": "repository.certum.pl"
  895.  
  896.  
  897. "ip": "213.180.204.38",
  898. "domain": "smtp.yandex.ru"
  899.  
  900.  
  901.  
  902. * Network Communication - ICMP:
  903.  
  904. * Network Communication - HTTP:
  905.  
  906. "count": 1,
  907. "body": "",
  908. "uri": "http://checkip.dyndns.org/",
  909. "user-agent": "",
  910. "method": "GET",
  911. "host": "checkip.dyndns.org",
  912. "version": "1.1",
  913. "path": "/",
  914. "data": "GET / HTTP/1.1\r\nHost: checkip.dyndns.org\r\nConnection: Keep-Alive\r\n\r\n",
  915. "port": 80
  916.  
  917.  
  918. "count": 2,
  919. "body": "",
  920. "uri": "http://repository.certum.pl/ca.cer",
  921. "user-agent": "Microsoft-CryptoAPI/6.1",
  922. "method": "GET",
  923. "host": "repository.certum.pl",
  924. "version": "1.1",
  925. "path": "/ca.cer",
  926. "data": "GET /ca.cer HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: repository.certum.pl\r\n\r\n",
  927. "port": 80
  928.  
  929.  
  930. "count": 1,
  931. "body": "",
  932. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  933. "user-agent": "Microsoft-CryptoAPI/6.1",
  934. "method": "GET",
  935. "host": "www.download.windowsupdate.com",
  936. "version": "1.1",
  937. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  938. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86410\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  939. "port": 80
  940.  
  941.  
  942. "count": 1,
  943. "body": "",
  944. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  945. "user-agent": "Microsoft-CryptoAPI/6.1",
  946. "method": "GET",
  947. "host": "www.download.windowsupdate.com",
  948. "version": "1.1",
  949. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  950. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86408\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  951. "port": 80
  952.  
  953.  
  954.  
  955. * Network Communication - SMTP:
  956.  
  957. "raw": "EHLO Host\r\nSTARTTLS\r\n\\x16\\x03\\x01\\x00q\\x01\\x00\\x00m\\x03\\x01U\\x1e*\\x9d\\xb7\\x7f\\x87\\x0fz\\xd8\\xa89\\xeda\\x0b\\x87B\\xea\\xa9C\\x94h~q;\\xe1\\x9b\\xf06\\xdd\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00,\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0esmtp.yandex.ru\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x16\\x03\\x01\\x00F\\x10\\x00\\x00BA\\x04\\x9a\n2\\x94\\xad\\xf1)\\xf4:\\xa2\\x9c\\x03\\x91\\xff/\\xb4\\xd7H\\xe3\\xab&~.r\\x0e\\x8e\\x8b\\x12\\x86\\xc5a\\xd1\\xbf\\x84\\xf9gJ\\xb1b\\xb4\\x14zf\\xce\\x88O\\xe9\\xb2\\x93\\x8d\\xba8\\xa0\\x9c=`l`\\xb5;\\xe3+i\t\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000\\xef=Q\\x191\\xabM\\x15\\x11\\x96\\xbc\\xe91\\x15\\xdf-\\x8f\\xf4\\x85\\x96J\\x0c\\x16\\xbc)\\xa2~\\xa9,\\xd8\\xe9\\xe1\\xf7:\\x1e6\\x1f\\x9b\\x06\\xb6\\xaa\"t\\x1a'\\xc4\\xdbEHLO Host\r\nSTARTTLS\r\n\\x16\\x03\\x01\\x00\\x91\\x01\\x00\\x00\\x8d\\x03\\x01U\\x1e\\xca\\x06\\x02\\xa1P\\x17\\x14\\xc3\\x1b^\\xd7\\x80\\x83\\x91t\\xa5\\xbeqT\\xc3O\\xfb'A4:u\\xddd \\xaf\\x96\\xf0\\x90%\\x82\\xa2v\\x16nq\\xa7\\x9a\\xeeJ\\xec\\xb4\\xaf>\\xf5\\\\xaaw\\xa2\\x06\\x18\\xb9\\x7f+\\xaf\\x84D\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00,\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0esmtp.yandex.ru\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x16\\x03\\x01\\x00F\\x10\\x00\\x00BA\\x04\\xcb\\x9f\\x9bq\\x0e\\xa5\\xe4\\x9e0\\x08q\\x80\\xe1&\\xc0'\\xf0\\xcb\\xff\\xf3\\x9d\\xf9\\x0f'\\xe4y4Ic\\x8cj\\x98\\xac\\x15\\x19\\x9ct.Q19O\\x84\\xa5\\xaf\\xa2\\xa9\\x1a\\xd6\\x83\\xb7SP?'\\xaf\\xca\\xcb\\\\xe7P\\x88p\\xa9\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x0006\\xb0\\x84\\x7f\\x9b@\\xfa\\x17'\\x1b;\\xf2\\xfe Y\\xc4\\xac\\xf9v\\xba\\xc7E,\\x16\\xe2\\xf1\\xbe>\\xa2c\\x13\\xce\\x8a|\\x8c\n\\xdb\\x07\\xe3M\\xd3\\xb9M\\xa3(\\xc4\\xfa\\xb5\\x17\\x03\\x01\\x000\\x1c\\x19\\xee\\x1d\\x92\\xe3\\xe7\\xd8M\\xeb\\xaa\\xf7\\xc85\\x81\\xc4F\\xe6\\x1aE7(\\x8a\\xc8\\xc9\\x04\\xeb\\x0f\\xf34\\xcb\\x9bR\\x85<d\\\\xa8QC\\xbe\\x80\\xe8''\\x06\\xd0\\x17\\x03\\x01\\x00Pza\\xc3(@J\\x14\\xb6 \\xa1\\xc7\\x0c\\xa7$\\xae.\\x8f\\xc0\\xf7?\\xf2_w\\xcc\\x08\\x12\\xddp\\xf7a\\xba\\xbd\\xdd\\x98\\xb4\\xd1\\xd0d\\xf2uq\\x06\\x10\\x13\\xfb\\x1f\\xd1\\xc5\\xaa\\x051\\xb8\\xcc\\x833\\x1c-.S\\x83g\\x93:K\\x05\\xe8\\xa5m\\xd7\\x8d~\\xb1Q\\x0c\\x7f\\xa3=\\xf6\\xd6",
  958. "dst": "213.180.193.38"
  959.  
  960.  
  961. "raw": "EHLO Host\r\nSTARTTLS\r\n\\x16\\x03\\x01\\x00q\\x01\\x00\\x00m\\x03\\x01U\\x1e*\\x04\\xa7\\xc0\\xa1n\\x831\\x7f\\xf8:\\xc0\\xc7\\xcc\\xda\\xc1^O\\xd5H\\xdc\\xc5V=\\xd4`\\x01k\\x1a\\x00\\x00\\x18\\x00/\\x005\\x00\\x05\\x00\n\\xc0\\x13\\xc0\\x14\\xc0\t\\xc0\n\\x002\\x008\\x00\\x13\\x00\\x04\\x01\\x00\\x00,\\xff\\x01\\x00\\x01\\x00\\x00\\x00\\x00\\x13\\x00\\x11\\x00\\x00\\x0esmtp.yandex.ru\\x00\n\\x00\\x06\\x00\\x04\\x00\\x17\\x00\\x18\\x00\\x0b\\x00\\x02\\x01\\x00\\x16\\x03\\x01\\x00F\\x10\\x00\\x00BA\\x04`+\\xf4\\xb9vw\\x12\\xde\\xce\\xb0\\xfd\\xf3we\"K0\\xf8 \\xda\\xe2P\\xb3\\x17\\xa7G\\xb1\\x19\\x91p\\x05\\xd8pZ-|B\\xdaM\\x93\\xfa1\\xb7\\xc9\\x942\\xd9\\xca\\xe3\\x08\\x14\\x06\\xa22\\x1d\\xd5\\xe8\\xbe\\xf3\\xc9\\x9a\r\\x14\\x03\\x01\\x00\\x01\\x01\\x16\\x03\\x01\\x000=r\\xbba!\\xb4\\xdf\\xeb\\xccg\\x0cXU\\x88\\xfb\\xc9\\xd1t\\xe1\\xb9\\xd5rYy>\\x11\\xe1\\xc3l\\xf6\\xa2\\xc9&2\\xedpZ\\x10\\xc6\t*\\x86\\xfdb\\xe0\\xbbs\\xf5",
  962. "dst": "77.88.21.38"
  963.  
  964.  
  965.  
  966. * Network Communication - Hosts:
  967.  
  968. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!