API tools faq
paste
paladin316

Exes_236712c488e7a8540e41f54ce5cab3fa_exe_2019-07-23_07_30.txt

paladin316
Jul 23rd, 2019
2,091
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 55.04 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Sharik"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_236712c488e7a8540e41f54ce5cab3fa.exe"
  7. * File Size: 1296252
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "5a93e4d668af4d359afdf2ce9e15ddb91899305cd014e154ae561c05d51e3c89"
  10. * MD5: "236712c488e7a8540e41f54ce5cab3fa"
  11. * SHA1: "8cb0eca036e2207bca830ef19fcc553c9ff602fb"
  12. * SHA512: "1158c1817db0d7551095bc9419c2fd4e00ec7596ab9a87b0e8ed5d2d047c603cb72f886af4dc4e5498963c4a9681dff56a8fd2588ce74e39cb92e2662d43c3bd"
  13. * CRC32: "B8AD230C"
  14. * SSDEEP: "24576:bNA3R5drXpddo0d3nMWg9tYGu6WKBa4F9lgFHGJYxGJH5SLMGw0nPd:G5Xdo0d3nnuqGNWebF/gU+xsH5So4n1"
  15.  
  16. * Process Execution:
  17. "Exes_236712c488e7a8540e41f54ce5cab3fa.exe",
  18. "wscript.exe",
  19. "qnd.exe",
  20. "qnd.exe",
  21. "RegSvcs.exe",
  22. "wscript.exe",
  23. "qnd.exe",
  24. "qnd.exe",
  25. "RegSvcs.exe",
  26. "wscript.exe",
  27. "qnd.exe",
  28. "qnd.exe",
  29. "RegSvcs.exe",
  30. "explorer.exe",
  31. "explorer.exe",
  32. "explorer.exe",
  33. "explorer.exe",
  34. "explorer.exe",
  35. "explorer.exe",
  36. "explorer.exe",
  37. "cmd.exe",
  38. "explorer.exe",
  39. "services.exe",
  40. "svchost.exe",
  41. "lsass.exe",
  42. "taskhost.exe",
  43. "dwm.exe",
  44. "conhost.exe"
  45.  
  46.  
  47. * Executed Commands:
  48. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nhh.vbs\"",
  49. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nhh.vbs ",
  50. "\"C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe\" mgu=rpt",
  51. "qnd.exe mgu=rpt",
  52. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\HHGJZ",
  53. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\run.vbs\"",
  54. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\run.vbs ",
  55. "C:\\Windows\\SysWOW64\\explorer.exe",
  56. "C:\\Windows\\explorer.exe",
  57. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\YOSFX",
  58. "C:\\Windows\\system32\\lsass.exe",
  59. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\GGYBX"
  60.  
  61.  
  62. * Signatures Detected:
  63.  
  64. "Description": "Attempts to connect to a dead IP:Port (3 unique times)",
  65. "Details":
  66.  
  67. "IP": "23.59.190.137:80"
  68.  
  69.  
  70. "IP": "23.59.190.120:80"
  71.  
  72.  
  73. "IP": "47.254.215.29:80"
  74.  
  75.  
  76.  
  77.  
  78. "Description": "Possible date expiration check, exits too soon after checking local time",
  79. "Details":
  80.  
  81. "process": "qnd.exe, PID 1920"
  82.  
  83.  
  84.  
  85.  
  86. "Description": "Creates RWX memory",
  87. "Details":
  88.  
  89.  
  90. "Description": "Detected script timer window indicative of sleep style evasion",
  91. "Details":
  92.  
  93. "Window": "WSH-Timer"
  94.  
  95.  
  96.  
  97.  
  98. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  99. "Details":
  100.  
  101. "ioc": "qnd.exe-77714587316763"
  102.  
  103.  
  104. "ioc": "qnd.exe-77714587316762"
  105.  
  106.  
  107. "ioc": "wm.exe-77714587318603"
  108.  
  109.  
  110. "ioc": "taskhost.exe-77714587319523"
  111.  
  112.  
  113. "ioc": "cmd.exe-77714587315683"
  114.  
  115.  
  116. "ioc": "conhost.exe-77714587315643"
  117.  
  118.  
  119.  
  120.  
  121. "Description": "Expresses interest in specific running processes",
  122. "Details":
  123.  
  124. "process": "lsm.exe"
  125.  
  126.  
  127. "process": "services.exe"
  128.  
  129.  
  130. "process": "wininit.exe"
  131.  
  132.  
  133. "process": "dwm.exe"
  134.  
  135.  
  136. "process": "RegSvcs.exe"
  137.  
  138.  
  139. "process": "csrss.exe"
  140.  
  141.  
  142. "process": "System"
  143.  
  144.  
  145. "process": "winlogon.exe"
  146.  
  147.  
  148. "process": "conhost.exe"
  149.  
  150.  
  151. "process": "smss.exe"
  152.  
  153.  
  154. "process": "svchost.exe"
  155.  
  156.  
  157. "process": "taskhost.exe"
  158.  
  159.  
  160. "process": "taskeng.exe"
  161.  
  162.  
  163. "process": "qnd.exe"
  164.  
  165.  
  166. "process": "lsass.exe"
  167.  
  168.  
  169.  
  170.  
  171. "Description": "Repeatedly searches for a not-found process, may want to run with startbrowser=1 option",
  172. "Details":
  173.  
  174.  
  175. "Description": "Reads data out of its own binary image",
  176. "Details":
  177.  
  178. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00000000, length: 0x00000007"
  179.  
  180.  
  181. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00000000, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00000007, length: 0x0013c775"
  185.  
  186.  
  187. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00001ff0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00003fe0, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00005fd0, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00007fc0, length: 0x00002000"
  197.  
  198.  
  199. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00009fb0, length: 0x00002000"
  200.  
  201.  
  202. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0000bfa0, length: 0x00002000"
  203.  
  204.  
  205. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0000df90, length: 0x00002000"
  206.  
  207.  
  208. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0000ff80, length: 0x00002000"
  209.  
  210.  
  211. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00011f70, length: 0x00002000"
  212.  
  213.  
  214. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00013f60, length: 0x00002000"
  215.  
  216.  
  217. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00015f50, length: 0x00002000"
  218.  
  219.  
  220. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00017f40, length: 0x00002000"
  221.  
  222.  
  223. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00019f30, length: 0x00002000"
  224.  
  225.  
  226. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0001bf20, length: 0x00002000"
  227.  
  228.  
  229. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0001df10, length: 0x00002000"
  230.  
  231.  
  232. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0001ff00, length: 0x00002000"
  233.  
  234.  
  235. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00021ef0, length: 0x00002000"
  236.  
  237.  
  238. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00023ee0, length: 0x00002000"
  239.  
  240.  
  241. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00025ed0, length: 0x00002000"
  242.  
  243.  
  244. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00027ec0, length: 0x00002000"
  245.  
  246.  
  247. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00029eb0, length: 0x00002000"
  248.  
  249.  
  250. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0002bea0, length: 0x00002000"
  251.  
  252.  
  253. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0002de90, length: 0x00002000"
  254.  
  255.  
  256. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0002fe80, length: 0x00002000"
  257.  
  258.  
  259. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00031e70, length: 0x00002000"
  260.  
  261.  
  262. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00033e60, length: 0x00002000"
  263.  
  264.  
  265. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00035e50, length: 0x00002000"
  266.  
  267.  
  268. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00037e40, length: 0x00002000"
  269.  
  270.  
  271. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00039e30, length: 0x00002000"
  272.  
  273.  
  274. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0003be20, length: 0x00002000"
  275.  
  276.  
  277. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0003de10, length: 0x00002000"
  278.  
  279.  
  280. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0003fe00, length: 0x00002000"
  281.  
  282.  
  283. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00041df0, length: 0x00002000"
  284.  
  285.  
  286. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00043de0, length: 0x00002000"
  287.  
  288.  
  289. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00045dd0, length: 0x00002000"
  290.  
  291.  
  292. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00047dc0, length: 0x00002000"
  293.  
  294.  
  295. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00049db0, length: 0x00002000"
  296.  
  297.  
  298. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0004bda0, length: 0x00002000"
  299.  
  300.  
  301. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0004dd90, length: 0x00002000"
  302.  
  303.  
  304. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0004fd80, length: 0x00002000"
  305.  
  306.  
  307. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00050a00, length: 0x00000032"
  308.  
  309.  
  310. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00050a1a, length: 0x000e89e2"
  311.  
  312.  
  313. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x001395cb, length: 0x00000028"
  314.  
  315.  
  316. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x001397b5, length: 0x00000028"
  317.  
  318.  
  319. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x001399d5, length: 0x00000028"
  320.  
  321.  
  322. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00139be2, length: 0x00000028"
  323.  
  324.  
  325. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00139dc8, length: 0x00000027"
  326.  
  327.  
  328. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x00139fbf, length: 0x00000028"
  329.  
  330.  
  331. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013a199, length: 0x00000028"
  332.  
  333.  
  334. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013a372, length: 0x00000028"
  335.  
  336.  
  337. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013a541, length: 0x00000029"
  338.  
  339.  
  340. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013a72d, length: 0x00000028"
  341.  
  342.  
  343. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013a932, length: 0x00000028"
  344.  
  345.  
  346. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013ab39, length: 0x00000028"
  347.  
  348.  
  349. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013ad2f, length: 0x00000028"
  350.  
  351.  
  352. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013af20, length: 0x00000028"
  353.  
  354.  
  355. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013b129, length: 0x00000028"
  356.  
  357.  
  358. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013b33a, length: 0x00000028"
  359.  
  360.  
  361. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013b554, length: 0x00000028"
  362.  
  363.  
  364. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013b74b, length: 0x00000028"
  365.  
  366.  
  367. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013b968, length: 0x00000028"
  368.  
  369.  
  370. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013bb42, length: 0x00000028"
  371.  
  372.  
  373. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013bd0f, length: 0x00000028"
  374.  
  375.  
  376. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013bf00, length: 0x00000028"
  377.  
  378.  
  379. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013c0da, length: 0x00000028"
  380.  
  381.  
  382. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013c2a6, length: 0x00000028"
  383.  
  384.  
  385. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013c4da, length: 0x00000028"
  386.  
  387.  
  388. "self_read": "process: Exes_236712c488e7a8540e41f54ce5cab3fa.exe, pid: 180, offset: 0x0013c6bf, length: 0x0000001b"
  389.  
  390.  
  391. "self_read": "process: wscript.exe, pid: 1780, offset: 0x00000000, length: 0x00000040"
  392.  
  393.  
  394. "self_read": "process: wscript.exe, pid: 1780, offset: 0x000000f0, length: 0x00000018"
  395.  
  396.  
  397. "self_read": "process: wscript.exe, pid: 1780, offset: 0x000001e8, length: 0x00000078"
  398.  
  399.  
  400. "self_read": "process: wscript.exe, pid: 1780, offset: 0x00018000, length: 0x00000020"
  401.  
  402.  
  403. "self_read": "process: wscript.exe, pid: 1780, offset: 0x00018058, length: 0x00000018"
  404.  
  405.  
  406. "self_read": "process: wscript.exe, pid: 1780, offset: 0x000181a8, length: 0x00000018"
  407.  
  408.  
  409. "self_read": "process: wscript.exe, pid: 1780, offset: 0x00018470, length: 0x00000010"
  410.  
  411.  
  412. "self_read": "process: wscript.exe, pid: 1780, offset: 0x00018640, length: 0x00000012"
  413.  
  414.  
  415. "self_read": "process: wscript.exe, pid: 1200, offset: 0x00000000, length: 0x00000040"
  416.  
  417.  
  418. "self_read": "process: wscript.exe, pid: 1200, offset: 0x000000f0, length: 0x00000018"
  419.  
  420.  
  421. "self_read": "process: wscript.exe, pid: 1200, offset: 0x000001e8, length: 0x00000078"
  422.  
  423.  
  424. "self_read": "process: wscript.exe, pid: 1200, offset: 0x00018000, length: 0x00000020"
  425.  
  426.  
  427. "self_read": "process: wscript.exe, pid: 1200, offset: 0x00018058, length: 0x00000018"
  428.  
  429.  
  430. "self_read": "process: wscript.exe, pid: 1200, offset: 0x000181a8, length: 0x00000018"
  431.  
  432.  
  433. "self_read": "process: wscript.exe, pid: 1200, offset: 0x00018470, length: 0x00000010"
  434.  
  435.  
  436. "self_read": "process: wscript.exe, pid: 1200, offset: 0x00018640, length: 0x00000012"
  437.  
  438.  
  439. "self_read": "process: wscript.exe, pid: 2344, offset: 0x00000000, length: 0x00000040"
  440.  
  441.  
  442. "self_read": "process: wscript.exe, pid: 2344, offset: 0x000000f0, length: 0x00000018"
  443.  
  444.  
  445. "self_read": "process: wscript.exe, pid: 2344, offset: 0x000001e8, length: 0x00000078"
  446.  
  447.  
  448. "self_read": "process: wscript.exe, pid: 2344, offset: 0x00018000, length: 0x00000020"
  449.  
  450.  
  451. "self_read": "process: wscript.exe, pid: 2344, offset: 0x00018058, length: 0x00000018"
  452.  
  453.  
  454. "self_read": "process: wscript.exe, pid: 2344, offset: 0x000181a8, length: 0x00000018"
  455.  
  456.  
  457. "self_read": "process: wscript.exe, pid: 2344, offset: 0x00018470, length: 0x00000010"
  458.  
  459.  
  460. "self_read": "process: wscript.exe, pid: 2344, offset: 0x00018640, length: 0x00000012"
  461.  
  462.  
  463.  
  464.  
  465. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  466. "Details":
  467.  
  468. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  469.  
  470.  
  471. "suspicious_request": "http://jnanny2.pw/ny/"
  472.  
  473.  
  474.  
  475.  
  476. "Description": "Performs some HTTP requests",
  477. "Details":
  478.  
  479. "url": "http://www.msftncsi.com/ncsi.txt"
  480.  
  481.  
  482. "url": "http://jnanny2.pw/ny/"
  483.  
  484.  
  485.  
  486.  
  487. "Description": "Executed a process and injected code into it, probably while unpacking",
  488. "Details":
  489.  
  490. "Injection": "qnd.exe(1176) -> RegSvcs.exe(3000)"
  491.  
  492.  
  493.  
  494.  
  495. "Description": "Detects Sandboxie through the presence of a library",
  496. "Details":
  497.  
  498.  
  499. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  500. "Details":
  501.  
  502. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier"
  503.  
  504.  
  505.  
  506.  
  507. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  508. "Details":
  509.  
  510. "Process": "qnd.exe (1676)"
  511.  
  512.  
  513.  
  514.  
  515. "Description": "Code injection with CreateRemoteThread in a remote process",
  516. "Details":
  517.  
  518. "Injection": "explorer.exe(1608) -> qnd.exe(1676)"
  519.  
  520.  
  521.  
  522.  
  523. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  524. "Details":
  525.  
  526. "unhook": "function_name: WSASend, type: modification"
  527.  
  528.  
  529. "unhook": "function_name: GetAddrInfoW, type: modification"
  530.  
  531.  
  532. "unhook": "function_name: send, type: modification"
  533.  
  534.  
  535.  
  536.  
  537. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  538. "Details":
  539.  
  540. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 1081189 times"
  541.  
  542.  
  543.  
  544.  
  545. "Description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
  546. "Details":
  547.  
  548. "regkeyval": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache"
  549.  
  550.  
  551.  
  552.  
  553. "Description": "Steals private information from local Internet browsers",
  554. "Details":
  555.  
  556. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal"
  557.  
  558.  
  559. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  560.  
  561.  
  562.  
  563.  
  564. "Description": "Installs itself for autorun at Windows startup",
  565. "Details":
  566.  
  567. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate"
  568.  
  569.  
  570. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\MGU_RP~1"
  571.  
  572.  
  573. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\26636189"
  574.  
  575.  
  576. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\start.vbs"
  577.  
  578.  
  579. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk"
  580.  
  581.  
  582. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk"
  583.  
  584.  
  585.  
  586.  
  587. "Description": "Creates a hidden or system file",
  588. "Details":
  589.  
  590. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe"
  591.  
  592.  
  593. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\afu.txt"
  594.  
  595.  
  596. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ano.bmp"
  597.  
  598.  
  599. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bhf.ppt"
  600.  
  601.  
  602. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bln.ico"
  603.  
  604.  
  605. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bqq.ppt"
  606.  
  607.  
  608. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\cke.txt"
  609.  
  610.  
  611. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\cmg.mp4"
  612.  
  613.  
  614. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\dsw.pdf"
  615.  
  616.  
  617. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\faj.mp4"
  618.  
  619.  
  620. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\fbw.ppt"
  621.  
  622.  
  623. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gbd.mp3"
  624.  
  625.  
  626. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gpm.icm"
  627.  
  628.  
  629. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gxw.txt"
  630.  
  631.  
  632. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hcu.dat"
  633.  
  634.  
  635. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hjp.pdf"
  636.  
  637.  
  638. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hkb.dat"
  639.  
  640.  
  641. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hqi.txt"
  642.  
  643.  
  644. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\iio.mp4"
  645.  
  646.  
  647. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\jeb.icm"
  648.  
  649.  
  650. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\kcg.mp4"
  651.  
  652.  
  653. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\mgu=rpt"
  654.  
  655.  
  656. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\mri.mp3"
  657.  
  658.  
  659. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nfe.ico"
  660.  
  661.  
  662. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nhh.vbs"
  663.  
  664.  
  665. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\och.ico"
  666.  
  667.  
  668. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\oib.xl"
  669.  
  670.  
  671. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\onb.pdf"
  672.  
  673.  
  674. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\oop.mp4"
  675.  
  676.  
  677. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pfj.pdf"
  678.  
  679.  
  680. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pfw.mp3"
  681.  
  682.  
  683. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pjd.pdf"
  684.  
  685.  
  686. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pnr.xl"
  687.  
  688.  
  689. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qcr.mp3"
  690.  
  691.  
  692. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sak.mp3"
  693.  
  694.  
  695. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sdo.jpg"
  696.  
  697.  
  698. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\smp.pdf"
  699.  
  700.  
  701. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sqn.xl"
  702.  
  703.  
  704. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tcl.docx"
  705.  
  706.  
  707. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tfr.mp4"
  708.  
  709.  
  710. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tvu.icm"
  711.  
  712.  
  713. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ukg.jpg"
  714.  
  715.  
  716. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wev.xl"
  717.  
  718.  
  719. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\whx.ppt"
  720.  
  721.  
  722. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wjl.bmp"
  723.  
  724.  
  725. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wpg.icm"
  726.  
  727.  
  728. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\xmw.ppt"
  729.  
  730.  
  731. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189"
  732.  
  733.  
  734. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe"
  735.  
  736.  
  737. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat"
  738.  
  739.  
  740. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat"
  741.  
  742.  
  743. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ini"
  744.  
  745.  
  746. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\run.vbs"
  747.  
  748.  
  749. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\start.cmd"
  750.  
  751.  
  752. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\start.vbs"
  753.  
  754.  
  755.  
  756.  
  757. "Description": "File has been identified by 37 Antiviruses on VirusTotal as malicious",
  758. "Details":
  759.  
  760. "MicroWorld-eScan": "Trojan.GenericKD.41491577"
  761.  
  762.  
  763. "McAfee": "Artemis!236712C488E7"
  764.  
  765.  
  766. "BitDefender": "Trojan.GenericKD.41491577"
  767.  
  768.  
  769. "K7GW": "Riskware ( 0040eff71 )"
  770.  
  771.  
  772. "K7AntiVirus": "Riskware ( 0040eff71 )"
  773.  
  774.  
  775. "Symantec": "Trojan.Gen.MBT"
  776.  
  777.  
  778. "ESET-NOD32": "Win32/Injector.Autoit.EDS"
  779.  
  780.  
  781. "APEX": "Malicious"
  782.  
  783.  
  784. "Avast": "Win32:Trojan-gen"
  785.  
  786.  
  787. "ClamAV": "Win.Dropper.Fakexls-7058214-0"
  788.  
  789.  
  790. "GData": "Win32.Trojan.Agent.0F80PV"
  791.  
  792.  
  793. "Kaspersky": "Trojan.Win32.Propagate.meb"
  794.  
  795.  
  796. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  797.  
  798.  
  799. "AegisLab": "Trojan.Win32.Generic.4!c"
  800.  
  801.  
  802. "Endgame": "malicious (high confidence)"
  803.  
  804.  
  805. "Sophos": "Troj/Autoit-COU"
  806.  
  807.  
  808. "Comodo": "Malware@#vec144obtek1"
  809.  
  810.  
  811. "F-Secure": "Trojan.TR/Autoit.fvgcd"
  812.  
  813.  
  814. "Invincea": "heuristic"
  815.  
  816.  
  817. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  818.  
  819.  
  820. "FireEye": "Generic.mg.236712c488e7a854"
  821.  
  822.  
  823. "Emsisoft": "Trojan.GenericKD.41491577 (B)"
  824.  
  825.  
  826. "Paloalto": "generic.ml"
  827.  
  828.  
  829. "Webroot": "W32.Malware.Gen"
  830.  
  831.  
  832. "Microsoft": "Trojan:Win32/Dynamer!rfn"
  833.  
  834.  
  835. "Arcabit": "Trojan.Generic.D2791C79"
  836.  
  837.  
  838. "ZoneAlarm": "Trojan.Win32.Propagate.meb"
  839.  
  840.  
  841. "AhnLab-V3": "Malware/Win32.Generic.C3338047"
  842.  
  843.  
  844. "Ad-Aware": "Trojan.GenericKD.41491577"
  845.  
  846.  
  847. "Zoner": "Probably RARAutorun"
  848.  
  849.  
  850. "Tencent": "Win32.Trojan.Propagate.Hpid"
  851.  
  852.  
  853. "Ikarus": "Trojan.Inject"
  854.  
  855.  
  856. "Fortinet": "AutoIt/Injector.EDS!tr"
  857.  
  858.  
  859. "AVG": "Win32:Trojan-gen"
  860.  
  861.  
  862. "Cybereason": "malicious.036e22"
  863.  
  864.  
  865. "CrowdStrike": "win/malicious_confidence_80% (W)"
  866.  
  867.  
  868. "Qihoo-360": "HEUR/QVM06.3.B079.Malware.Gen"
  869.  
  870.  
  871.  
  872.  
  873. "Description": "Checks the presence of disk drives in the registry, possibly for anti-virtualization",
  874. "Details":
  875.  
  876.  
  877. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  878. "Details":
  879.  
  880. "target": "clamav:Win.Dropper.Fakexls-7058214-0, sha256:5a93e4d668af4d359afdf2ce9e15ddb91899305cd014e154ae561c05d51e3c89, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  881.  
  882.  
  883.  
  884.  
  885. "Description": "Harvests information related to installed mail clients",
  886. "Details":
  887.  
  888. "file": "C:\\Users\\user\\Documents\\Outlook Files\\Outlook.pst"
  889.  
  890.  
  891. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  892.  
  893.  
  894. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\POP3 Server"
  895.  
  896.  
  897. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\IMAP Server"
  898.  
  899.  
  900. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\SMTP Server"
  901.  
  902.  
  903. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  904.  
  905.  
  906. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
  907.  
  908.  
  909. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\POP3 Server"
  910.  
  911.  
  912. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
  913.  
  914.  
  915. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\SMTP Server"
  916.  
  917.  
  918. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\IMAP Server"
  919.  
  920.  
  921. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
  922.  
  923.  
  924.  
  925.  
  926. "Description": "Created network traffic indicative of malicious activity",
  927. "Details":
  928.  
  929. "signature": "ET DNS Query to a *.pw domain - Likely Hostile"
  930.  
  931.  
  932. "signature": "ET TROJAN Sharik/Smoke CnC Beacon 7"
  933.  
  934.  
  935.  
  936.  
  937.  
  938. * Started Service:
  939. "VaultSvc"
  940.  
  941.  
  942. * Mutexes:
  943. "DefaultTabtip-MainUI",
  944. "CicLoadWinStaWinSta0",
  945. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  946. "Local\\ZoneAttributeCacheCounterMutex",
  947. "Local\\ZonesCacheCounterMutex",
  948. "Local\\ZonesLockedCacheCounterMutex",
  949. "7E8C820C05FE53DA70B24D931AD9346CC1C5B64F",
  950. "8E7F69A8BBB1D5F016A1C4D28CA18928",
  951. "D2AAECCA995D6CE76C2D3B0A436206B6",
  952. "opera_shared_counter",
  953. "opera_shared_counter64",
  954. "BA60E8863DDFDC44E46BABEFF4B6B830",
  955. "F3BD47D1098EFBB5CE7F8E9D33847060",
  956. "4ACD3CFBBCD35F9578AC8C10F1CA3D18",
  957. "32D57310E73CEAEE3DB58B665172A3F5"
  958.  
  959.  
  960. * Modified Files:
  961. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\__tmp_rar_sfx_access_check_3824109",
  962. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nfe.ico",
  963. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\mgu=rpt",
  964. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\nhh.vbs",
  965. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qnd.exe",
  966. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gpm.icm",
  967. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\cmg.mp4",
  968. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ano.bmp",
  969. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\och.ico",
  970. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ukg.jpg",
  971. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\oop.mp4",
  972. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sdo.jpg",
  973. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\oib.xl",
  974. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hkb.dat",
  975. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pfj.pdf",
  976. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\kcg.mp4",
  977. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wev.xl",
  978. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\jeb.icm",
  979. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sqn.xl",
  980. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pfw.mp3",
  981. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\whx.ppt",
  982. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tvu.icm",
  983. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\sak.mp3",
  984. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gxw.txt",
  985. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\iio.mp4",
  986. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\mri.mp3",
  987. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\dsw.pdf",
  988. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pnr.xl",
  989. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tfr.mp4",
  990. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\faj.mp4",
  991. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hqi.txt",
  992. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\tcl.docx",
  993. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\onb.pdf",
  994. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\gbd.mp3",
  995. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bhf.ppt",
  996. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wjl.bmp",
  997. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hcu.dat",
  998. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\xmw.ppt",
  999. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\afu.txt",
  1000. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\smp.pdf",
  1001. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\wpg.icm",
  1002. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\pjd.pdf",
  1003. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bqq.ppt",
  1004. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\hjp.pdf",
  1005. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\fbw.ppt",
  1006. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\cke.txt",
  1007. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\bln.ico",
  1008. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\qcr.mp3",
  1009. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\HHGJZ",
  1010. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\ini",
  1011. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\start.vbs",
  1012. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\start.cmd",
  1013. "\\??\\PIPE\\srvsvc",
  1014. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\start.lnk",
  1015. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\run.vbs",
  1016. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  1017. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat",
  1018. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\hviticat.lnk",
  1019. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  1020. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\YOSFX",
  1021. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 2980966669",
  1022. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  1023. "C:\\Users\\user\\AppData\\Local\\Temp\\85F0.tmp",
  1024. "C:\\Users\\user\\AppData\\Local\\Temp\\8630.tmp",
  1025. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\GGYBX"
  1026.  
  1027.  
  1028. * Deleted Files:
  1029. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\__tmp_rar_sfx_access_check_3824109",
  1030. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\HHGJZ",
  1031. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe",
  1032. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe",
  1033. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\tbtfsgew.exe:Zone.Identifier",
  1034. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\hviticat\\hviticat",
  1035. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\YOSFX",
  1036. "C:\\Windows\\Tasks\\Opera scheduled Autoupdate 2980966669.job",
  1037. "C:\\Windows\\sysnative\\Tasks\\Opera scheduled Autoupdate 2980966669",
  1038. "C:\\Users\\user\\AppData\\Local\\Temp\\85F0.tmp",
  1039. "C:\\Users\\user\\AppData\\Local\\Temp\\8630.tmp",
  1040. "C:\\Users\\user\\AppData\\Local\\Temp\\26636189\\GGYBX"
  1041.  
  1042.  
  1043. * Modified Registry Keys:
  1044. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  1045. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  1046. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  1047. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
  1048. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
  1049. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsUpdate",
  1050. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\26636189",
  1051. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
  1052. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
  1053. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
  1054. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bmp\\OpenWithProgids\\Paint.Picture",
  1055. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cab\\OpenWithProgids\\CABFolder",
  1056. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.contact\\OpenWithProgids\\contact_wab_auto_file",
  1057. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.css\\OpenWithProgids\\CSSfile",
  1058. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.csv\\OpenWithProgids\\Excel.CSV",
  1059. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dib\\OpenWithProgids\\Paint.Picture",
  1060. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dll\\OpenWithProgids\\dllfile",
  1061. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\OpenWithProgids\\Word.Document.8",
  1062. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docm\\OpenWithProgids\\Word.DocumentMacroEnabled.12",
  1063. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.docx\\OpenWithProgids\\Word.Document.12",
  1064. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dot\\OpenWithProgids\\Word.Template.8",
  1065. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotm\\OpenWithProgids\\Word.TemplateMacroEnabled.12",
  1066. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dotx\\OpenWithProgids\\Word.Template.12",
  1067. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dwfx\\OpenWithProgids\\Windows.XPSReachViewer",
  1068. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.easmx\\OpenWithProgids\\Windows.XPSReachViewer",
  1069. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.edrwx\\OpenWithProgids\\Windows.XPSReachViewer",
  1070. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.emf\\OpenWithProgids\\emffile",
  1071. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.eprtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1072. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exe\\OpenWithProgids\\exefile",
  1073. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.fon\\OpenWithProgids\\fonfile",
  1074. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gif\\OpenWithProgids\\giffile",
  1075. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.htm\\OpenWithProgids\\ChromeHTML",
  1076. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.html\\OpenWithProgids\\ChromeHTML",
  1077. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ico\\OpenWithProgids\\icofile",
  1078. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ini\\OpenWithProgids\\inifile",
  1079. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jfif\\OpenWithProgids\\pjpegfile",
  1080. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpe\\OpenWithProgids\\jpegfile",
  1081. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpeg\\OpenWithProgids\\jpegfile",
  1082. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jpg\\OpenWithProgids\\jpegfile",
  1083. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jtx\\OpenWithProgids\\Windows.XPSReachViewer",
  1084. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.lnk\\OpenWithProgids\\lnkfile",
  1085. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mht\\OpenWithProgids\\mhtmlfile",
  1086. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mhtml\\OpenWithProgids\\mhtmlfile",
  1087. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.msg\\OpenWithProgids\\Outlook.File.msg.15",
  1088. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ocx\\OpenWithProgids\\ocxfile",
  1089. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.odt\\OpenWithProgids\\Word.OpenDocumentText.12",
  1090. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.otf\\OpenWithProgids\\otffile",
  1091. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.png\\OpenWithProgids\\pngfile",
  1092. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pot\\OpenWithProgids\\PowerPoint.Template.8",
  1093. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potm\\OpenWithProgids\\PowerPoint.TemplateMacroEnabled.12",
  1094. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.potx\\OpenWithProgids\\PowerPoint.Template.12",
  1095. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppam\\OpenWithProgids\\PowerPoint.Addin.12",
  1096. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsm\\OpenWithProgids\\PowerPoint.SlideShowMacroEnabled.12",
  1097. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppsx\\OpenWithProgids\\PowerPoint.SlideShow.12",
  1098. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ppt\\OpenWithProgids\\PowerPoint.Show.8",
  1099. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptm\\OpenWithProgids\\PowerPoint.ShowMacroEnabled.12",
  1100. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pptx\\OpenWithProgids\\PowerPoint.Show.12",
  1101. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ps1xml\\OpenWithProgids\\Microsoft.PowerShellXMLData.1",
  1102. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rle\\OpenWithProgids\\rlefile",
  1103. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rtf\\OpenWithProgids\\Word.RTF.8",
  1104. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.scf\\OpenWithProgids\\SHCmdFile",
  1105. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.search-ms\\OpenWithProgids\\SearchFolder",
  1106. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shtml\\OpenWithProgids\\ChromeHTML",
  1107. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldm\\OpenWithProgids\\PowerPoint.SlideMacroEnabled.12",
  1108. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sldx\\OpenWithProgids\\PowerPoint.Slide.12",
  1109. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sys\\OpenWithProgids\\sysfile",
  1110. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tif\\OpenWithProgids\\TIFImage.Document",
  1111. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tiff\\OpenWithProgids\\TIFImage.Document",
  1112. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttc\\OpenWithProgids\\ttcfile",
  1113. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ttf\\OpenWithProgids\\ttffile",
  1114. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.txt\\OpenWithProgids\\txtfile",
  1115. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vsto\\OpenWithProgids\\bootstrap.vsto.1",
  1116. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wdp\\OpenWithProgids\\wdpfile",
  1117. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wmf\\OpenWithProgids\\wmffile",
  1118. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlam\\OpenWithProgids\\Excel.AddInMacroEnabled",
  1119. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xls\\OpenWithProgids\\Excel.Sheet.8",
  1120. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsb\\OpenWithProgids\\Excel.SheetBinaryMacroEnabled.12",
  1121. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsm\\OpenWithProgids\\Excel.SheetMacroEnabled.12",
  1122. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlsx\\OpenWithProgids\\Excel.Sheet.12",
  1123. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xlt\\OpenWithProgids\\Excel.Template.8",
  1124. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltm\\OpenWithProgids\\Excel.TemplateMacroEnabled",
  1125. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xltx\\OpenWithProgids\\Excel.Template",
  1126. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xml\\OpenWithProgids\\xmlfile",
  1127. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xps\\OpenWithProgids\\Windows.XPSReachViewer",
  1128. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xsl\\OpenWithProgids\\xslfile",
  1129. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.zip\\OpenWithProgids\\CompressedFolder",
  1130. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vbs\\OpenWithProgids\\VBSFile",
  1131. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Path",
  1132. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Hash",
  1133. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 2980966669\\Id",
  1134. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Opera scheduled Autoupdate 2980966669\\Index",
  1135. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\Triggers",
  1136. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6CEA3105-522C-426E-B037-45373CC7E923\\DynamicInfo",
  1137. "HKEY_CURRENT_USER\\Software\\e39f83dd",
  1138. "HKEY_CURRENT_USER\\Software\\b5c9d58b"
  1139.  
  1140.  
  1141. * Deleted Registry Keys:
  1142. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1143. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  1144. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1145. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  1146. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 2980966669.job",
  1147. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\Opera scheduled Autoupdate 2980966669.job.fp"
  1148.  
  1149.  
  1150. * DNS Communications:
  1151.  
  1152. "type": "A",
  1153. "request": "jnanny2.pw",
  1154. "answers":
  1155.  
  1156. "data": "47.254.215.29",
  1157. "type": "A"
  1158.  
  1159.  
  1160.  
  1161.  
  1162.  
  1163. * Domains:
  1164.  
  1165. "ip": "47.254.215.29",
  1166. "domain": "jnanny2.pw"
  1167.  
  1168.  
  1169.  
  1170. * Network Communication - ICMP:
  1171.  
  1172. * Network Communication - HTTP:
  1173.  
  1174. "count": 2,
  1175. "body": "",
  1176. "uri": "http://www.msftncsi.com/ncsi.txt",
  1177. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1178. "method": "GET",
  1179. "host": "www.msftncsi.com",
  1180. "version": "1.1",
  1181. "path": "/ncsi.txt",
  1182. "data": "GET /ncsi.txt HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nHost: www.msftncsi.com\r\n\r\n",
  1183. "port": 80
  1184.  
  1185.  
  1186. "count": 1,
  1187. "body": "",
  1188. "uri": "http://jnanny2.pw/ny/",
  1189. "user-agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)",
  1190. "method": "POST",
  1191. "host": "jnanny2.pw",
  1192. "version": "1.1",
  1193. "path": "/ny/",
  1194. "data": "POST /ny/ HTTP/1.1\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nPragma: no-cache\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; InfoPath.3)\r\nContent-Length: 63\r\nHost: jnanny2.pw\r\n\r\n",
  1195. "port": 80
  1196.  
  1197.  
  1198.  
  1199. * Network Communication - SMTP:
  1200.  
  1201. * Network Communication - Hosts:
  1202.  
  1203. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!