SHOW:
|
|
- or go back to the newest paste.
| 1 | Files: | |
| 2 | ||
| 3 | BILL_OF_LADIG_SHIPPING_DOCSPDF.rar | |
| 4 | 1b2cf23895a8b87faa2a0cff4bdc448572357aeadf114353517cdb9055a38d23 | |
| 5 | ||
| 6 | Orden de compra.exe | |
| 7 | 33ba597423706b8abd06af2e6e602fbb6f37bce4e8c3537c08bf6a71891c4169 | |
| 8 | ||
| 9 | ||
| 10 | BILL OF LADING SHIPPING DOCSPDF.scr (AnyDesk instance) | |
| 11 | 1d21fe93f7cc6898d25510b30ae921a1704780858f8610974a31aed7de457d70 | |
| 12 | ||
| 13 | vJYIGohBMFpBSBGYdpuFPqYc.exe | |
| 14 | FA0AE9F2DD86A1F0A0225D59E461E9D3196CAB383001B6C4A26019611AB618D2 | |
| 15 | ||
| 16 | vlc.exe (fake file) | |
| 17 | 84a89fbe416dc250832d27a335e2d354a4cc808dd0e38d99f703544db049a175 | |
| 18 | ||
| 19 | ||
| 20 | Network: | |
| 21 | ||
| 22 | Sender: [email protected] | |
| 23 | Protocol: smtp | |
| 24 | Host: pnkfpcdk.outbound-mail.sendgrid.net | |
| 25 | IP: 50.31.60.209 (USA) - 167.89.100.127 (USA) | |
| 26 | Port: 25 | |
| 27 | ||
| 28 | Network Handshake: | |
| 29 | ||
| 30 | Username: [email protected] | |
| 31 | Password: N!QbrVc7 | |
| 32 | Host: smtp.zuarakltd.com - us2.smtp.mailhostbox.com | |
| 33 | IP: 208.91.199.224 (USA) - 208.91.199.223 (USA) | |
| 34 | Port: 587 | |
| 35 | ||
| 36 | ||
| 37 | System Behavior: | |
| 38 | ||
| 39 | File Create | |
| 40 | process: BILL OF LADING SHIPPING DOCSPDF.scr | |
| 41 | path: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe | |
| 42 | op: CreateModify | |
| 43 | status: 0x00000000 | |
| 44 | ||
| 45 | File Write | |
| 46 | process: BILL OF LADING SHIPPING DOCSPDF.scr | |
| 47 | path: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe | |
| 48 | ||
| 49 | \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" |
