Network traffic detected: HTTP traff ic on port 443 -> 49 749
Network traffic detected: HTTP traff ic on port 49749 -> 443 String found in binary or memory: ndjview.so urceforge. String found in binary or memory: c.lencr.or g/0 String found in binary or memory: djview.sou rceforge.n etP String found in binary or memory: djview.sou rceforge.n etH String found in binary or memory: djview.sou rceforge.n et/version. String found in binary or memory: djview.sou rceforge.n et/ru/http ://windjvi ew.sourcef String found in binary or memory: djview.sou rceforge.n et/ru/ String found in binary or memory: djview.sou rceforge.n et Source: nsv27C6.tm p.0.dr, Wi nDjView We bsite.url. String found in binary or memory: djview.sou rcefor String found in binary or memory: o.lencr.or g0 String found in binary or memory: i.lencr.or g/0 String found in binary or memory: s.sf.net/N SIS_ErrorE rror String found in binary or memory: s.sf.net/N SIS_Error
String found in binary or memory: u.sourcefo rge.net8ht tps://sour ceforge.ne t/donate/i ndex.php?g roup_id=11 4927
String found in binary or memory: u.sourcefo rge.net String found in binary or memory: s.identrus t.com/root s/dstrootc ax3.p7c0 String found in binary or memory: s.identrus t.com/root s/dstrootc HTTP traffic detected: GET /versi on.txt HTT P/1.1User- Agent: Win DjViewHost : windjvie w.sourcefo rge.netCac he-Control : no-cacheĭNS traffic detected: queries fo r: windjvi ew.sourcef JA3 SSL client fingerprint seen in connection with other malware Uses secure TLS version for HTTPS connections Registry value created: HKEY_LOCAL _MACHINE\S OFTWARE\Mi crosoft\Wi ndows\Curr entVersion \Uninstall \WinDjView Source: C:\Users\u ser\Deskto p\WinDjVie w-2.1-Setu p.exeĭirectory created: C:\Program Files\Win DjViewĭirectory created: C:\Program Files\Win DjView\Win DjView.exeĭirectory created: C:\Program Files\Win DjView\uni nstall.exe Static PE information: LOCAL_SYMS _STRIPPED, 32BIT_MAC HINE, EXEC UTABLE_IMA GE, LINE_N UMS_STRIPP ED, RELOCS _STRIPPED
0 kommentar(er)
