String found in binary or memory: ema.org/We bPage String found in binary or memory: /u niversal-r oot.crl0 String found in binary or memory: p.thawte.c om0 String found in binary or memory: p.comodoca. String found in binary or memory: s.google.c o.uk/maps? hl=en&tab= wl String found in binary or memory: nloads.act ivestate.c om/Komodo/ releases/K omodo-IDE- latest.msi ?from=Acti vePerl-240 2-圆4 String found in binary or memory: dl.windows /msdownloa d/update/v 3/static/t rustedr/en /authroots tl.cab com/COMODO RSACertifi cationAuth ority.crl0 q String found in binary or memory: })() Search Image s M aps Play YouTube News Gmail Drive More » Web Histo ry | S ettings | Sig n in &n bsp (func tion() e quals m (Youtube )ĭNS traffic detected: queries fo r: update. com com 99.tmp\SYS TEM\/:*?"|.jobSoft ware\Micro soft\Windo ws\Current Version\Ru nUserDomai nSELECT `V alue` FROM `Property ` WHERE `P roperty` = '%s' equa ls (Ya hoo) String found in binary or memory: rA ww.google. tmp\SYSTE MSoftware\ Microsoft\ Windows\Cu rrentVersi on\Run.job UserDomain SELECT `Va lue` FROM `Property` WHERE `Pr operty` = '%s'$0 eq uals ( Yahoo)
tmp\SYSTE MSoftware\ Microsoft\ Windows\Cu rrentVersi on\Run.job UserDomain SELECT `Va lue` FROM `Property` WHERE `Pr operty` = '%s'$0I eq uals ( Yahoo) String found in binary or memory: "I&#IU#IZ# Ib#Ij#Ir#I. JA3 fingerprint: 37f463bf46 16ecd445d4 a1937da06e 19įound strings which match to known social media urls JA3 SSL client fingerprint seen in connection with other malware 2402-MSWin 32-圆4-401 627.exeĬontains functionality to enumerate / list files inside a directoryĬode function: 0_2_011F96 B0 _EH_pr olog3,Find FirstFileW ,FindClose ,Ĭode function: 0_2_011E49 F0 FindFir stFileW,Ge tLastError ,FindClose ,Ĭode function: 0_2_011F8D 95 _EH_pr olog3,new, FindFirstF ileW,FindC lose,Close Handle,Clo seHandle,Ĭode function: 0_2_012061 54 _EH_pr olog3,Find FirstFileW ,FindNextF ileW,FindN extFileW,_ wcsrchr,_w csrchr,_wc srchr,Find NextFileW, FindClose, FindClose, FindFirstF ileW,FindN extFileW,F indNextFil eW,FindNex tFileW,Fin dClose,Fin dClose,Ĭode function: 0_2_011FFA 6E _EH_pr olog3,Find FirstFileW ,FindClose , Source: C:\Users\u ser\Deskto p\ActivePe rl-5.24.1. Checks for available system drives (often done to infect USB drives)
0 kommentar(er)
