API tools faq
paste
paladin316

Exes_3a9868788c609828c155ed449d86b9d0_exe_2019-07-09_22_30.txt

paladin316
Jul 9th, 2019
2,162
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 40.91 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Emotet"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_3a9868788c609828c155ed449d86b9d0.exe"
  7. * File Size: 1489920
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "299233458cd5b31c1c713b57dfe71be8bb128e04b03a9fc25a765237c5b6f2aa"
  10. * MD5: "3a9868788c609828c155ed449d86b9d0"
  11. * SHA1: "6fc102a1dde9ce403607d1751fd2c4301f0d8f89"
  12. * SHA512: "dc11e1db3b76b8c80558f06a4301032875eb3302263d78edff1143b8f7b12f0f4b25b8964e9b6d2c23cb1c840227f507e97a502e88ba7e3c90fe8d5631240d54"
  13. * CRC32: "D48653A9"
  14. * SSDEEP: "24576:NXrKaMKciX/82A/JhHJNHKePMqRUQBwtBYerGrCfQpdJWq25IBlSBK4:5Kwl8F/J5nH5zf+dpmU"
  15.  
  16. * Process Execution:
  17. "Exes_3a9868788c609828c155ed449d86b9d0.exe",
  18. "Isass.exe",
  19. "schtasks.exe",
  20. "schtasks.exe",
  21. "cmd.exe",
  22. "cscript.exe",
  23. "Isass.exe",
  24. "schtasks.exe",
  25. "schtasks.exe",
  26. "cmd.exe",
  27. "cscript.exe",
  28. "cmd.exe",
  29. "taskkill.exe",
  30. "svchost.exe",
  31. "taskeng.exe",
  32. "wscript.exe",
  33. "cmd.exe",
  34. "powershell.exe",
  35. "Isass.exe",
  36. "schtasks.exe",
  37. "schtasks.exe",
  38. "cmd.exe",
  39. "cscript.exe",
  40. "taskeng.exe",
  41. "Isass.exe",
  42. "schtasks.exe",
  43. "schtasks.exe",
  44. "cmd.exe",
  45. "cscript.exe",
  46. "Isass.exe",
  47. "schtasks.exe",
  48. "schtasks.exe",
  49. "cmd.exe",
  50. "cscript.exe",
  51. "Isass.exe",
  52. "schtasks.exe",
  53. "schtasks.exe",
  54. "cmd.exe",
  55. "cscript.exe",
  56. "Isass.exe",
  57. "schtasks.exe",
  58. "schtasks.exe",
  59. "cmd.exe",
  60. "cscript.exe",
  61. "Isass.exe",
  62. "schtasks.exe",
  63. "schtasks.exe",
  64. "cmd.exe",
  65. "cscript.exe",
  66. "Isass.exe",
  67. "schtasks.exe",
  68. "schtasks.exe",
  69. "cmd.exe",
  70. "cscript.exe",
  71. "svchost.exe",
  72. "WmiPrvSE.exe",
  73. "WmiPrvSE.exe",
  74. "WMIADAP.exe"
  75.  
  76.  
  77. * Executed Commands:
  78. "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe ",
  79. "C:\\Windows\\System32\\cmd.exe /c taskkill /im Exes_3a9868788c609828c155ed449d86b9d0.exe /f & erase C:\\Users\\user\\AppData\\Local\\Temp\\Exes_3a9868788c609828c155ed449d86b9d0.exe & exit",
  80. "schtasks.exe /Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"C:\\ProgramData\\WindowsAppCertification\\checker.vbs\" /F",
  81. "schtasks.exe /Create /SC MINUTE /MO 5 /TN \"Windows_Antimalware_Host_Systm\" /TR \"C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" /F",
  82. "C:\\Windows\\System32\\cmd.exe /c echo Set oWS = WScript.CreateObject(\"WScript.Shell\") > CreateShortcut.vbs & echo sLinkFile = \"%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk\" >> CreateShortcut.vbs & echo Set oLink = oWS.CreateShortcut(sLinkFile) >> CreateShortcut.vbs & echo oLink.TargetPath = \"C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe\" >> CreateShortcut.vbs & echo oLink.Save >> CreateShortcut.vbs & cscript CreateShortcut.vbs & del CreateShortcut.vbs",
  83. "taskkill /im Exes_3a9868788c609828c155ed449d86b9d0.exe /f",
  84. "cscript CreateShortcut.vbs",
  85. "taskeng.exe 5BEFDD64-06BD-4B7E-A05C-8D7E9D1F61C9 S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  86. "taskeng.exe 0626EAAF-54BA-4F58-BD44-A8A7F8D937BC S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  87. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
  88. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
  89. "C:\\Windows\\System32\\WScript.exe \"C:\\ProgramData\\WindowsAppCertification\\checker.vbs\"",
  90. "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe",
  91. "\"C:\\ProgramData\\WindowsAppCertification\\cert.cmd\"",
  92. "C:\\ProgramData\\WindowsAppCertification\\cert.cmd ",
  93. "powershell -WindowStyle Hidden -ExecutionPolicy Bypass -NoP -file C:\\ProgramData\\WindowsAppCertification\\WindowHelperStorageHostSystemThread.ps1"
  94.  
  95.  
  96. * Signatures Detected:
  97.  
  98. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  99. "Details":
  100.  
  101. "IP": "37.1.206.48:80"
  102.  
  103.  
  104.  
  105.  
  106. "Description": "Creates RWX memory",
  107. "Details":
  108.  
  109.  
  110. "Description": "Possible date expiration check, exits too soon after checking local time",
  111. "Details":
  112.  
  113. "process": "Exes_3a9868788c609828c155ed449d86b9d0.exe, PID 744"
  114.  
  115.  
  116.  
  117.  
  118. "Description": "Detected script timer window indicative of sleep style evasion",
  119. "Details":
  120.  
  121. "Window": "WSH-Timer"
  122.  
  123.  
  124. "Window": "WSH-Timer"
  125.  
  126.  
  127.  
  128.  
  129. "Description": "Expresses interest in specific running processes",
  130. "Details":
  131.  
  132. "process": "System"
  133.  
  134.  
  135.  
  136.  
  137. "Description": "Reads data out of its own binary image",
  138. "Details":
  139.  
  140. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00000000, length: 0x00000040"
  141.  
  142.  
  143. "self_read": "process: cscript.exe, pid: 2972, offset: 0x000000e8, length: 0x00000018"
  144.  
  145.  
  146. "self_read": "process: cscript.exe, pid: 2972, offset: 0x000001e0, length: 0x00000078"
  147.  
  148.  
  149. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00015e00, length: 0x00000020"
  150.  
  151.  
  152. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00015e58, length: 0x00000018"
  153.  
  154.  
  155. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00015f50, length: 0x00000018"
  156.  
  157.  
  158. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00016110, length: 0x00000010"
  159.  
  160.  
  161. "self_read": "process: cscript.exe, pid: 2972, offset: 0x00016230, length: 0x00000012"
  162.  
  163.  
  164. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00000000, length: 0x00000040"
  165.  
  166.  
  167. "self_read": "process: wscript.exe, pid: 2420, offset: 0x000000f8, length: 0x00000018"
  168.  
  169.  
  170. "self_read": "process: wscript.exe, pid: 2420, offset: 0x00000200, length: 0x7fe00000028"
  171.  
  172.  
  173. "self_read": "process: wscript.exe, pid: 2420, offset: 0x0001f200, length: 0x00000020"
  174.  
  175.  
  176. "self_read": "process: wscript.exe, pid: 2420, offset: 0x0001f258, length: 0x00000018"
  177.  
  178.  
  179. "self_read": "process: wscript.exe, pid: 2420, offset: 0x0001f3a8, length: 0x7fe00000018"
  180.  
  181.  
  182. "self_read": "process: wscript.exe, pid: 2420, offset: 0x0001f670, length: 0x00000010"
  183.  
  184.  
  185. "self_read": "process: wscript.exe, pid: 2420, offset: 0x0001f840, length: 0x00000012"
  186.  
  187.  
  188. "self_read": "process: wscript.exe, pid: 2420, offset: 0x7fe00000228, length: 0x7fe00000078"
  189.  
  190.  
  191. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00000000, length: 0x00000040"
  192.  
  193.  
  194. "self_read": "process: cscript.exe, pid: 2124, offset: 0x000000e8, length: 0x00000018"
  195.  
  196.  
  197. "self_read": "process: cscript.exe, pid: 2124, offset: 0x000001e0, length: 0x00000078"
  198.  
  199.  
  200. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00015e00, length: 0x00000020"
  201.  
  202.  
  203. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00015e58, length: 0x00000018"
  204.  
  205.  
  206. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00015f50, length: 0x00000018"
  207.  
  208.  
  209. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00016110, length: 0x00000010"
  210.  
  211.  
  212. "self_read": "process: cscript.exe, pid: 2124, offset: 0x00016230, length: 0x00000012"
  213.  
  214.  
  215. "self_read": "process: cscript.exe, pid: 856, offset: 0x00000000, length: 0x00000040"
  216.  
  217.  
  218. "self_read": "process: cscript.exe, pid: 856, offset: 0x000000e8, length: 0x00000018"
  219.  
  220.  
  221. "self_read": "process: cscript.exe, pid: 856, offset: 0x000001e0, length: 0x00000078"
  222.  
  223.  
  224. "self_read": "process: cscript.exe, pid: 856, offset: 0x00015e00, length: 0x00000020"
  225.  
  226.  
  227. "self_read": "process: cscript.exe, pid: 856, offset: 0x00015e58, length: 0x00000018"
  228.  
  229.  
  230. "self_read": "process: cscript.exe, pid: 856, offset: 0x00015f50, length: 0x00000018"
  231.  
  232.  
  233. "self_read": "process: cscript.exe, pid: 856, offset: 0x00016110, length: 0x00000010"
  234.  
  235.  
  236. "self_read": "process: cscript.exe, pid: 856, offset: 0x00016230, length: 0x00000012"
  237.  
  238.  
  239. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00000000, length: 0x00000040"
  240.  
  241.  
  242. "self_read": "process: cscript.exe, pid: 1880, offset: 0x000000e8, length: 0x00000018"
  243.  
  244.  
  245. "self_read": "process: cscript.exe, pid: 1880, offset: 0x000001e0, length: 0x00000078"
  246.  
  247.  
  248. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00015e00, length: 0x00000020"
  249.  
  250.  
  251. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00015e58, length: 0x00000018"
  252.  
  253.  
  254. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00015f50, length: 0x00000018"
  255.  
  256.  
  257. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00016110, length: 0x00000010"
  258.  
  259.  
  260. "self_read": "process: cscript.exe, pid: 1880, offset: 0x00016230, length: 0x00000012"
  261.  
  262.  
  263. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00000000, length: 0x00000040"
  264.  
  265.  
  266. "self_read": "process: cscript.exe, pid: 2416, offset: 0x000000e8, length: 0x00000018"
  267.  
  268.  
  269. "self_read": "process: cscript.exe, pid: 2416, offset: 0x000001e0, length: 0x00000078"
  270.  
  271.  
  272. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00015e00, length: 0x00000020"
  273.  
  274.  
  275. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00015e58, length: 0x00000018"
  276.  
  277.  
  278. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00015f50, length: 0x00000018"
  279.  
  280.  
  281. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00016110, length: 0x00000010"
  282.  
  283.  
  284. "self_read": "process: cscript.exe, pid: 2416, offset: 0x00016230, length: 0x00000012"
  285.  
  286.  
  287. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00000000, length: 0x00000040"
  288.  
  289.  
  290. "self_read": "process: cscript.exe, pid: 1480, offset: 0x000000e8, length: 0x00000018"
  291.  
  292.  
  293. "self_read": "process: cscript.exe, pid: 1480, offset: 0x000001e0, length: 0x00000078"
  294.  
  295.  
  296. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00015e00, length: 0x00000020"
  297.  
  298.  
  299. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00015e58, length: 0x00000018"
  300.  
  301.  
  302. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00015f50, length: 0x00000018"
  303.  
  304.  
  305. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00016110, length: 0x00000010"
  306.  
  307.  
  308. "self_read": "process: cscript.exe, pid: 1480, offset: 0x00016230, length: 0x00000012"
  309.  
  310.  
  311. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00000000, length: 0x00000040"
  312.  
  313.  
  314. "self_read": "process: cscript.exe, pid: 2580, offset: 0x000000e8, length: 0x00000018"
  315.  
  316.  
  317. "self_read": "process: cscript.exe, pid: 2580, offset: 0x000001e0, length: 0x00000078"
  318.  
  319.  
  320. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00015e00, length: 0x00000020"
  321.  
  322.  
  323. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00015e58, length: 0x00000018"
  324.  
  325.  
  326. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00015f50, length: 0x00000018"
  327.  
  328.  
  329. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00016110, length: 0x00000010"
  330.  
  331.  
  332. "self_read": "process: cscript.exe, pid: 2580, offset: 0x00016230, length: 0x00000012"
  333.  
  334.  
  335. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00000000, length: 0x00000040"
  336.  
  337.  
  338. "self_read": "process: cscript.exe, pid: 1804, offset: 0x000000e8, length: 0x00000018"
  339.  
  340.  
  341. "self_read": "process: cscript.exe, pid: 1804, offset: 0x000001e0, length: 0x00000078"
  342.  
  343.  
  344. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00015e00, length: 0x00000020"
  345.  
  346.  
  347. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00015e58, length: 0x00000018"
  348.  
  349.  
  350. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00015f50, length: 0x00000018"
  351.  
  352.  
  353. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00016110, length: 0x00000010"
  354.  
  355.  
  356. "self_read": "process: cscript.exe, pid: 1804, offset: 0x00016230, length: 0x00000012"
  357.  
  358.  
  359. "self_read": "process: cscript.exe, pid: 324, offset: 0x00000000, length: 0x00000040"
  360.  
  361.  
  362. "self_read": "process: cscript.exe, pid: 324, offset: 0x000000e8, length: 0x00000018"
  363.  
  364.  
  365. "self_read": "process: cscript.exe, pid: 324, offset: 0x000001e0, length: 0x00000078"
  366.  
  367.  
  368. "self_read": "process: cscript.exe, pid: 324, offset: 0x00015e00, length: 0x00000020"
  369.  
  370.  
  371. "self_read": "process: cscript.exe, pid: 324, offset: 0x00015e58, length: 0x00000018"
  372.  
  373.  
  374. "self_read": "process: cscript.exe, pid: 324, offset: 0x00015f50, length: 0x00000018"
  375.  
  376.  
  377. "self_read": "process: cscript.exe, pid: 324, offset: 0x00016110, length: 0x00000010"
  378.  
  379.  
  380. "self_read": "process: cscript.exe, pid: 324, offset: 0x00016230, length: 0x00000012"
  381.  
  382.  
  383.  
  384.  
  385. "Description": "A process created a hidden window",
  386. "Details":
  387.  
  388. "Process": "Exes_3a9868788c609828c155ed449d86b9d0.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  389.  
  390.  
  391. "Process": "Exes_3a9868788c609828c155ed449d86b9d0.exe -> C:\\Windows\\System32\\cmd.exe"
  392.  
  393.  
  394. "Process": "Isass.exe -> schtasks.exe"
  395.  
  396.  
  397. "Process": "Isass.exe -> schtasks.exe"
  398.  
  399.  
  400. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  401.  
  402.  
  403. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  404.  
  405.  
  406. "Process": "wscript.exe -> C:\\ProgramData\\WindowsAppCertification\\cert.cmd"
  407.  
  408.  
  409. "Process": "Isass.exe -> schtasks.exe"
  410.  
  411.  
  412. "Process": "Isass.exe -> schtasks.exe"
  413.  
  414.  
  415. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  416.  
  417.  
  418. "Process": "cmd.exe -> C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
  419.  
  420.  
  421. "Process": "Isass.exe -> schtasks.exe"
  422.  
  423.  
  424. "Process": "Isass.exe -> schtasks.exe"
  425.  
  426.  
  427. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  428.  
  429.  
  430. "Process": "Isass.exe -> schtasks.exe"
  431.  
  432.  
  433. "Process": "Isass.exe -> schtasks.exe"
  434.  
  435.  
  436. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  437.  
  438.  
  439. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  440.  
  441.  
  442. "Process": "Isass.exe -> schtasks.exe"
  443.  
  444.  
  445. "Process": "Isass.exe -> schtasks.exe"
  446.  
  447.  
  448. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  449.  
  450.  
  451. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  452.  
  453.  
  454. "Process": "Isass.exe -> schtasks.exe"
  455.  
  456.  
  457. "Process": "Isass.exe -> schtasks.exe"
  458.  
  459.  
  460. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  461.  
  462.  
  463. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  464.  
  465.  
  466. "Process": "Isass.exe -> schtasks.exe"
  467.  
  468.  
  469. "Process": "Isass.exe -> schtasks.exe"
  470.  
  471.  
  472. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  473.  
  474.  
  475. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  476.  
  477.  
  478. "Process": "Isass.exe -> schtasks.exe"
  479.  
  480.  
  481. "Process": "Isass.exe -> schtasks.exe"
  482.  
  483.  
  484. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  485.  
  486.  
  487. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  488.  
  489.  
  490. "Process": "Isass.exe -> schtasks.exe"
  491.  
  492.  
  493. "Process": "Isass.exe -> schtasks.exe"
  494.  
  495.  
  496. "Process": "Isass.exe -> C:\\Windows\\System32\\cmd.exe"
  497.  
  498.  
  499. "Process": "Isass.exe -> C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  500.  
  501.  
  502.  
  503.  
  504. "Description": "Drops a binary and executes it",
  505. "Details":
  506.  
  507. "binary": "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  508.  
  509.  
  510.  
  511.  
  512. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  513. "Details":
  514.  
  515. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  516.  
  517.  
  518. "suspicious_request": "http://api2.checkingsite.site/2.0/method/checkConnection"
  519.  
  520.  
  521.  
  522.  
  523. "Description": "Performs some HTTP requests",
  524. "Details":
  525.  
  526. "url": "http://api2.checkingsite.site/2.0/method/checkConnection"
  527.  
  528.  
  529.  
  530.  
  531. "Description": "The binary likely contains encrypted or compressed data.",
  532. "Details":
  533.  
  534. "section": "name: \\x00 , entropy: 7.98, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00032a00, virtual_size: 0x0006c000"
  535.  
  536.  
  537. "section": "name: .rsrc, entropy: 7.43, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00001800, virtual_size: 0x00005a7a"
  538.  
  539.  
  540. "section": "name: eiljzjew, entropy: 7.92, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00136400, virtual_size: 0x00137000"
  541.  
  542.  
  543. "section": "name: jqewjwee, entropy: 7.31, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000200, virtual_size: 0x00001000"
  544.  
  545.  
  546.  
  547.  
  548. "Description": "Deletes its original binary from disk",
  549. "Details":
  550.  
  551.  
  552. "Description": "Checks for the presence of known windows from debuggers and forensic tools",
  553. "Details":
  554.  
  555. "Window": "OLLYDBG"
  556.  
  557.  
  558. "Window": "GBDYLLO"
  559.  
  560.  
  561. "Window": "pediy06"
  562.  
  563.  
  564. "Window": "FilemonClass"
  565.  
  566.  
  567. "Window": "File Monitor - Sysinternals: www.sysinternals.com"
  568.  
  569.  
  570. "Window": "PROCMON_WINDOW_CLASS"
  571.  
  572.  
  573. "Window": "Process Monitor - Sysinternals: www.sysinternals.com"
  574.  
  575.  
  576. "Window": "RegmonClass"
  577.  
  578.  
  579. "Window": "Registry Monitor - Sysinternals: www.sysinternals.com"
  580.  
  581.  
  582. "Window": "18467-41"
  583.  
  584.  
  585. "Window": "OLLYDBG"
  586.  
  587.  
  588. "Window": "GBDYLLO"
  589.  
  590.  
  591. "Window": "pediy06"
  592.  
  593.  
  594. "Window": "FilemonClass"
  595.  
  596.  
  597. "Window": "File Monitor - Sysinternals: www.sysinternals.com"
  598.  
  599.  
  600. "Window": "PROCMON_WINDOW_CLASS"
  601.  
  602.  
  603. "Window": "Process Monitor - Sysinternals: www.sysinternals.com"
  604.  
  605.  
  606. "Window": "RegmonClass"
  607.  
  608.  
  609. "Window": "Registry Monitor - Sysinternals: www.sysinternals.com"
  610.  
  611.  
  612. "Window": "18467-41"
  613.  
  614.  
  615.  
  616.  
  617. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  618. "Details":
  619.  
  620. "Process": "taskeng.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  621.  
  622.  
  623. "Process": "Isass.exe tried to sleep 4740 seconds, actually delayed analysis time by 0 seconds"
  624.  
  625.  
  626. "Process": "WmiPrvSE.exe tried to sleep 420 seconds, actually delayed analysis time by 0 seconds"
  627.  
  628.  
  629.  
  630.  
  631. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  632. "Details":
  633.  
  634. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  635.  
  636.  
  637.  
  638.  
  639. "Description": "The following process appear to have been packed with Themida: Isass.exe, Exes_3a9868788c609828c155ed449d86b9d0.exe, Isass.exe, Isass.exe, Isass.exe, Isass.exe, Isass.exe, Isass.exe, Isass.exe, Isass.exe",
  640. "Details":
  641.  
  642.  
  643. "Description": "Installs itself for autorun at Windows startup",
  644. "Details":
  645.  
  646. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows_Antimalware_Host_Syst"
  647.  
  648.  
  649. "data": "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  650.  
  651.  
  652. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk"
  653.  
  654.  
  655. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk"
  656.  
  657.  
  658. "task": "schtasks.exe /Create /SC MINUTE /MO 30 /TN \"Windows_Antimalware_Host\" /TR \"C:\\ProgramData\\WindowsAppCertification\\checker.vbs\" /F"
  659.  
  660.  
  661.  
  662.  
  663. "Description": "Creates a hidden or system file",
  664. "Details":
  665.  
  666. "file": "C:\\ProgramData\\MicrosoftCorporation"
  667.  
  668.  
  669. "file": "C:\\ProgramData\\MicrosoftCorporation\\Windows"
  670.  
  671.  
  672. "file": "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32"
  673.  
  674.  
  675. "file": "C:\\ProgramData\\WindowsAppCertification"
  676.  
  677.  
  678. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2112ef2.TMP"
  679.  
  680.  
  681.  
  682.  
  683. "Description": "Checks for the presence of known devices from debuggers and forensic tools",
  684. "Details":
  685.  
  686.  
  687. "Description": "Detects the presence of Wine emulator via registry key",
  688. "Details":
  689.  
  690.  
  691. "Description": "File has been identified by 51 Antiviruses on VirusTotal as malicious",
  692. "Details":
  693.  
  694. "Bkav": "W32.HfsAutoB."
  695.  
  696.  
  697. "MicroWorld-eScan": "Gen:Variant.Zusy.277440"
  698.  
  699.  
  700. "CAT-QuickHeal": "Trojan.Generic"
  701.  
  702.  
  703. "McAfee": "Artemis!3A9868788C60"
  704.  
  705.  
  706. "VIPRE": "Trojan.Win32.Generic!BT"
  707.  
  708.  
  709. "BitDefender": "Gen:Variant.Zusy.277440"
  710.  
  711.  
  712. "K7GW": "Trojan ( 00529ea11 )"
  713.  
  714.  
  715. "K7AntiVirus": "Trojan ( 00529ea11 )"
  716.  
  717.  
  718. "TrendMicro": "TROJ_GEN.R049C0OCD18"
  719.  
  720.  
  721. "NANO-Antivirus": "Trojan.Win32.BtcMine.eywevo"
  722.  
  723.  
  724. "Cyren": "W32/Trojan.VWER-3454"
  725.  
  726.  
  727. "Symantec": "Trojan Horse"
  728.  
  729.  
  730. "TrendMicro-HouseCall": "TROJ_GEN.R049C0OCD18"
  731.  
  732.  
  733. "Paloalto": "generic.ml"
  734.  
  735.  
  736. "ClamAV": "Win.Trojan.Emotet-6472129-0"
  737.  
  738.  
  739. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  740.  
  741.  
  742. "AegisLab": "Troj.W32.Generic!c"
  743.  
  744.  
  745. "Tencent": "Win32.Trojan.Generic.Lmbg"
  746.  
  747.  
  748. "Ad-Aware": "Gen:Variant.Zusy.277440"
  749.  
  750.  
  751. "Sophos": "Mal/Generic-S"
  752.  
  753.  
  754. "F-Secure": "Gen:Variant.Zusy.277440"
  755.  
  756.  
  757. "DrWeb": "Trojan.BtcMine.1812"
  758.  
  759.  
  760. "Zillya": "Trojan.Packed.Win32.125001"
  761.  
  762.  
  763. "Invincea": "heuristic"
  764.  
  765.  
  766. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  767.  
  768.  
  769. "Fortinet": "W32/PossibleThreat"
  770.  
  771.  
  772. "Emsisoft": "Gen:Variant.Zusy.277440 (B)"
  773.  
  774.  
  775. "Ikarus": "Trojan.Win32.Themida"
  776.  
  777.  
  778. "Webroot": "Trojan.Spy.Emotet"
  779.  
  780.  
  781. "Avira": "TR/Crypt.TPM.zkvff"
  782.  
  783.  
  784. "MAX": "malware (ai score=98)"
  785.  
  786.  
  787. "Antiy-AVL": "Trojan/Win32.AGeneric"
  788.  
  789.  
  790. "Endgame": "malicious (high confidence)"
  791.  
  792.  
  793. "Arcabit": "Trojan.Zusy.D43BC0"
  794.  
  795.  
  796. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  797.  
  798.  
  799. "Microsoft": "Trojan:Win32/Tiggre!rfn"
  800.  
  801.  
  802. "AhnLab-V3": "Trojan/Win32.Generic.C2418350"
  803.  
  804.  
  805. "ALYac": "Gen:Variant.Zusy.277440"
  806.  
  807.  
  808. "AVware": "Trojan.Win32.Generic!BT"
  809.  
  810.  
  811. "VBA32": "Trojan.BtcMine"
  812.  
  813.  
  814. "Cylance": "Unsafe"
  815.  
  816.  
  817. "Panda": "Trj/CI.A"
  818.  
  819.  
  820. "ESET-NOD32": "a variant of Win32/Packed.Themida.AQA"
  821.  
  822.  
  823. "Rising": "Trojan.Generic!8.C3 (CLOUD)"
  824.  
  825.  
  826. "Yandex": "Trojan.Agent!ci5cNF/xOiM"
  827.  
  828.  
  829. "SentinelOne": "static engine - malicious"
  830.  
  831.  
  832. "GData": "Gen:Variant.Zusy.277440"
  833.  
  834.  
  835. "AVG": "Win32:Malware-gen"
  836.  
  837.  
  838. "Cybereason": "malicious.88c609"
  839.  
  840.  
  841. "Avast": "Win32:Malware-gen"
  842.  
  843.  
  844. "CrowdStrike": "malicious_confidence_80% (D)"
  845.  
  846.  
  847.  
  848.  
  849. "Description": "Checks the version of Bios, possibly for anti-virtualization",
  850. "Details":
  851.  
  852.  
  853. "Description": "Detects VirtualBox using ACPI tricks",
  854. "Details":
  855.  
  856.  
  857. "Description": "Detects VirtualBox through the presence of a registry key",
  858. "Details":
  859.  
  860.  
  861. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  862. "Details":
  863.  
  864. "target": "clamav:Win.Trojan.Emotet-6472129-0, sha256:299233458cd5b31c1c713b57dfe71be8bb128e04b03a9fc25a765237c5b6f2aa, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  865.  
  866.  
  867. "dropped": "clamav:Win.Trojan.Emotet-6472129-0, sha256:299233458cd5b31c1c713b57dfe71be8bb128e04b03a9fc25a765237c5b6f2aa , guest_paths:C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  868.  
  869.  
  870.  
  871.  
  872. "Description": "Creates a copy of itself",
  873. "Details":
  874.  
  875. "copy": "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe"
  876.  
  877.  
  878.  
  879.  
  880. "Description": "Anomalous binary characteristics",
  881. "Details":
  882.  
  883. "anomaly": "Unprintable characters found in section name"
  884.  
  885.  
  886.  
  887.  
  888.  
  889. * Started Service:
  890.  
  891. * Mutexes:
  892. "DBWinMutex",
  893. "Local\\ZoneAttributeCacheCounterMutex",
  894. "Local\\ZonesCacheCounterMutex",
  895. "Local\\ZonesLockedCacheCounterMutex",
  896. "Global\\CLR_CASOFF_MUTEX",
  897. "Global\\ADAP_WMI_ENTRY",
  898. "Global\\RefreshRA_Mutex",
  899. "Global\\RefreshRA_Mutex_Lib",
  900. "Global\\RefreshRA_Mutex_Flag"
  901.  
  902.  
  903. * Modified Files:
  904. "\\??\\SICE",
  905. "\\??\\SIWVID",
  906. "\\??\\NTICE",
  907. "C:\\ProgramData\\MicrosoftCorporation\\Windows\\System32\\Isass.exe",
  908. "C:\\ProgramData\\WindowsAppCertification\\WindowHelperStorageHostSystemThread.ps1",
  909. "C:\\ProgramData\\WindowsAppCertification\\checker.vbs",
  910. "C:\\ProgramData\\WindowsAppCertification\\cert.cmd",
  911. "C:\\Users\\user\\AppData\\Local\\Temp\\CreateShortcut.vbs",
  912. "C:\\Windows\\sysnative\\Tasks\\Windows_Antimalware_Host",
  913. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  914. "C:\\Windows\\sysnative\\Tasks\\Windows_Antimalware_Host_Systm",
  915. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  916. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  917. "\\??\\PIPE\\srvsvc",
  918. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Isass.lnk",
  919. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  920. "C:\\Windows\\sysnative\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk",
  921. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\N4LPOFHOFJOSIAOUCWP7.temp",
  922. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2112ef2.TMP",
  923. "C:\\Windows\\SysWOW64\\CreateShortcut.vbs",
  924. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  925. "\\??\\WMIDataDevice"
  926.  
  927.  
  928. * Deleted Files:
  929. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_3a9868788c609828c155ed449d86b9d0.exe",
  930. "C:\\Users\\user\\AppData\\Local\\Temp\\CreateShortcut.vbs",
  931. "C:\\Windows\\Tasks\\Windows_Antimalware_Host.job",
  932. "C:\\Windows\\Tasks\\Windows_Antimalware_Host_Systm.job",
  933. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  934. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms~RF2112ef2.TMP",
  935. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.1032.34681343",
  936. "C:\\Windows\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1032.34681359",
  937. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.1032.34681359",
  938. "C:\\Windows\\System32\\CreateShortcut.vbs"
  939.  
  940.  
  941. * Modified Registry Keys:
  942. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows_Antimalware_Host_Syst",
  943. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2C551989-1171-4867-83CD-A7BFD5CD4D6A\\Path",
  944. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2C551989-1171-4867-83CD-A7BFD5CD4D6A\\Hash",
  945. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Windows_Antimalware_Host\\Id",
  946. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Windows_Antimalware_Host\\Index",
  947. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2C551989-1171-4867-83CD-A7BFD5CD4D6A\\Triggers",
  948. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\2C551989-1171-4867-83CD-A7BFD5CD4D6A\\DynamicInfo",
  949. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\5BEFDD64-06BD-4B7E-A05C-8D7E9D1F61C9",
  950. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\23A33C0C-CE41-4DB7-8264-3905DCBCFC10\\DynamicInfo",
  951. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Windows_Antimalware_Host_Systm\\Index",
  952. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\23A33C0C-CE41-4DB7-8264-3905DCBCFC10\\Hash",
  953. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\23A33C0C-CE41-4DB7-8264-3905DCBCFC10\\Triggers",
  954. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\0626EAAF-54BA-4F58-BD44-A8A7F8D937BC",
  955. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\5BEFDD64-06BD-4B7E-A05C-8D7E9D1F61C9\\data",
  956. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  957. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  958. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  959. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\0626EAAF-54BA-4F58-BD44-A8A7F8D937BC\\data",
  960. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  961. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  962. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  963. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  964. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  965. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  966. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  967. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  968. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  969. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  970. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  971. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  972. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  973. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  974. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  975. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  976.  
  977.  
  978. * Deleted Registry Keys:
  979. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Windows_Antimalware_Host.job",
  980. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Windows_Antimalware_Host.job.fp",
  981. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Windows_Antimalware_Host_Systm.job",
  982. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Windows_Antimalware_Host_Systm.job.fp",
  983. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  984. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  985. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  986. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  987. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  988.  
  989.  
  990. * DNS Communications:
  991.  
  992. "type": "A",
  993. "request": "api2.checkingsite.site",
  994. "answers":
  995.  
  996. "data": "checkingsite.site",
  997. "type": "CNAME"
  998.  
  999.  
  1000. "data": "37.1.206.48",
  1001. "type": "A"
  1002.  
  1003.  
  1004.  
  1005.  
  1006. "type": "A",
  1007. "request": "api.hdjahw223aw.site",
  1008. "answers":
  1009.  
  1010. "data": "",
  1011. "type": "NXDOMAIN"
  1012.  
  1013.  
  1014.  
  1015.  
  1016. "type": "A",
  1017. "request": "api.opndfnsh22afd.site",
  1018. "answers":
  1019.  
  1020. "data": "",
  1021. "type": "NXDOMAIN"
  1022.  
  1023.  
  1024.  
  1025.  
  1026. "type": "A",
  1027. "request": "api.pojbhjdsg223dd.online",
  1028. "answers":
  1029.  
  1030. "data": "",
  1031. "type": "NXDOMAIN"
  1032.  
  1033.  
  1034.  
  1035.  
  1036. "type": "A",
  1037. "request": "api.ewjdfbhe2jdg.online",
  1038. "answers":
  1039.  
  1040. "data": "",
  1041. "type": "NXDOMAIN"
  1042.  
  1043.  
  1044.  
  1045.  
  1046.  
  1047. * Domains:
  1048.  
  1049. "ip": "",
  1050. "domain": "api.pojbhjdsg223dd.online"
  1051.  
  1052.  
  1053. "ip": "",
  1054. "domain": "api.opndfnsh22afd.site"
  1055.  
  1056.  
  1057. "ip": "",
  1058. "domain": "api.hdjahw223aw.site"
  1059.  
  1060.  
  1061. "ip": "",
  1062. "domain": "api.ewjdfbhe2jdg.online"
  1063.  
  1064.  
  1065. "ip": "37.1.206.48",
  1066. "domain": "api2.checkingsite.site"
  1067.  
  1068.  
  1069.  
  1070. * Network Communication - ICMP:
  1071.  
  1072. * Network Communication - HTTP:
  1073.  
  1074. "count": 26,
  1075. "body": "",
  1076. "uri": "http://api2.checkingsite.site/2.0/method/checkConnection",
  1077. "user-agent": "Mozilla/5.0 (Windows NT 6.1) Rarog/5.0",
  1078. "method": "POST",
  1079. "host": "api2.checkingsite.site",
  1080. "version": "1.1",
  1081. "path": "/2.0/method/checkConnection",
  1082. "data": "POST /2.0/method/checkConnection HTTP/1.1\r\nConnection: Keep-Alive\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1) Rarog/5.0\r\nContent-Length: 0\r\nHost: api2.checkingsite.site\r\n\r\n",
  1083. "port": 80
  1084.  
  1085.  
  1086.  
  1087. * Network Communication - SMTP:
  1088.  
  1089. * Network Communication - Hosts:
  1090.  
  1091. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!