24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Mydoom Sample 1b46afe1779e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1b46afe1779e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","keywords":["Malicious","Worm.Mydoom","malware analysis","sandbox report","threat intelligence","1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42"],"about":{"@type":"SoftwareApplication","name":"ATTACHMENT.SCR","applicationCategory":["peexe","executable"],"identifier":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Mydoom","antivirusDetections":{"malicious":26,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4cb,"WinRAR.v.3.2.and.key.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"26:T1ffb,Heuristic match: "yahoo.com" Heuristic match: "qcustomplot.com" Heuristic match: "126.com" Heuristic match: "126mx00.mxmail.netease.com" Heuristic match: "ShareReactor.com" Heuristic match: "126mx01.mxmail.netease.com" Heuristic match: "126mx02.mxmail.netease.com" Heuristic match: "126mx03.mxmail.netease.com" Heuristic match: "246tnt.com" Heuristic match: "Mellanox-com.mail.protection.outlook.com" Heuristic match: "aer-mx-01.cisco.com" Heuristic match: "alexa-global-in.qualcomm.com" Heuristic match: "alexa-in-ams.qualcomm.com" Heuristic match: "alexa-in-lv.qualcomm.com" Heuristic match: "alexa-in-sd.qualcomm.com" Heuristic match: "alexa-in-tai.qualcomm.com" Heuristic match: "alinet.it" Heuristic match: "alln-mx-01.cisco.com" Heuristic match: "sf.net" Heuristic match: "alum-mit-edu.mail.protection.outlook.com" Heuristic match: "alum.mit.edu" Heuristic match: "alumni-purdue-edu.mail.protection.outlook.com" Heuristic match: "alumni.purdue.edu" Heuristic match: "apple.com" Heuristic match: "ashi.footprints.net" Heuristic match: "aspmx2.googlemail.com" Heuristic match: "aspmx3.googlemail.com" Heuristic match: "athonet-com.mail.protection.outlook.com" Heuristic match: "athonet.com" Heuristic match: "baslerweb.com" Heuristic match: "gmail.com" Heuristic match: "baslug.org" Heuristic match: "bnr.ca" Heuristic match: "broadcom.com" Heuristic match: "cisco.com" Heuristic match: "cr0.net" Heuristic match: "delmic.com" Heuristic match: "desy.de" Heuristic match: "diningphilosopher.de" Heuristic match: "diorcet.fr" Heuristic match: "ericsson-com.mail.protection.outlook.com" Heuristic match: "ericsson.com" Heuristic match: "fb.mail.gandi.net" Heuristic match: "giga.or.at" Heuristic match: "gimp.org" Heuristic match: "gmx.net" Heuristic match: "iki.fi" Heuristic match: "inbox.lv" Heuristic match: "isl.rdc.toshiba.co.jp" Heuristic match: "ixperta.com" Heuristic match: "lists.tcpdump.org" Heuristic match: "ma1-aaemail-dr-lapp01.apple.com" Heuristic match: "ma1-aaemail-dr-lapp02.apple.com" Heuristic match: "ma1-aaemail-dr-lapp03.apple.com" Heuristic match: "mail.126.com" Heuristic match: "mail.246tnt.com" Heuristic match: "mail.alinet.it" Heuristic match: "mail.alum.mit.edu" Heuristic match: "mail.alumni.purdue.edu" Heuristic match: "mail.ashi.footprints.net" Heuristic match: "mail.athonet.com" Heuristic match: "mail.baslerweb.com" Heuristic match: "mail.cisco.com" Heuristic match: "mail.definitely.at" Heuristic match: "mail.delmic.com" Heuristic match: "mail.diningphilosopher.de" Heuristic match: "mail.diorcet.fr" Heuristic match: "mail.ericsson.com" Heuristic match: "mail.giga.or.at" Heuristic match: "mail.gmx.net" Heuristic match: "mail.iki.fi" Heuristic match: "mail.mail.ru" Heuristic match: "mail.mellanox.com" Heuristic match: "mail.netyl.org" Heuristic match: "mail.ns.aus.com" Heuristic match: "mail.primarydata.com" Heuristic match: "mail.promus.com" Heuristic match: "mail.qca.qualcomm.com" Heuristic match: "mail.ru" Heuristic match: "mail.samba.org" Heuristic match: "mail.samsung.com" Heuristic match: "mail.stoeckmann.org" Heuristic match: "mail.strongswan.org" Heuristic match: "mail.tycale.be" Heuristic match: "mail.web.de" Heuristic match: "mail.willglynn.com" Heuristic match: "mail.yahoo.com" Heuristic match: "mail01.baslerweb.com" Heuristic match: "mail1.ixperta.com" Heuristic match: "mail2.iki.fi" Heuristic match: "mail2.ixperta.com" Heuristic match: "mail3.iki.fi" Heuristic match: "mail3.ixperta.com" Heuristic match: "mailin.samsung.com" Heuristic match: "mailprot.hilton.com" Heuristic match: "maxx.shmoo.com" Heuristic match: "mellanox.com" Heuristic match: "mta5.am0.yahoodns.net" Heuristic match: "mta6.am0.yahoodns.net" Heuristic match: "mta7.am0.yahoodns.net" Heuristic match: "mx-ha02.web.de" Heuristic match: "mx-ha03.web.de" Heuristic match: "mx.126.com" Heuristic match: "mx.246tnt.com" Heuristic match: "mx.acantho.net" Heuristic match: "mx.alinet.it" Heuristic match: "mx.alum.mit.edu" Heuristic match: "mx.alumni.purdue.edu" Heuristic match: "mx.ashi.footprints.net" Heuristic match: "mx.athonet.com" Heuristic match: "mx.cisco.com" Heuristic match: "mx.delmic.com" Heuristic match: "mx.diningphilosopher.de" Heuristic match: "mx.ericsson.com" Heuristic match: "mx.giga.or.at" Heuristic match: "mx.gmx.net" Heuristic match: "mx.iki.fi" Heuristic match: "mx.inbox.lv" Heuristic match: "mx.mail.ru" Heuristic match: "mx.mellanox.com" Heuristic match: "mx.netyl.org" Heuristic match: "mx.ns.aus.com" Heuristic match: "mx.primarydata.com" Heuristic match: "mx.promus.com" Heuristic match: "mx.qca.qualcomm.com" Heuristic match: "mx.qq.com" Heuristic match: "mx.samba.org" Heuristic match: "mx.samsung.com" Heuristic match: "mx.stoeckmann.org" Heuristic match: "mx.strongswan.org" Heuristic match: "mx.tycale.be" Heuristic match: "mx.web.de" Heuristic match: "mx.willglynn.com" Heuristic match: "mx.yahoo.com" Heuristic match: "mx00.emig.gmx.net" Heuristic match: "mx00.kundenserver.de" Heuristic match: "mx01.bnr.ca" Heuristic match: "mx01.emig.gmx.net" Heuristic match: "mx01.kundenserver.de" Heuristic match: "mx04.bnr.ca" Heuristic match: "mx1-lw-eu.apache.org" Heuristic match: "mx1-lw-us.apache.org" Heuristic match: "mx1.acantho.net" Heuristic match: "mx1.inbox.lv" Heuristic match: "mx1.mtaroutes.com" Heuristic match: "mx1.qq.com" Heuristic match: "mx1.redhat.com" Heuristic match: "mx1.seznam.cz" Heuristic match: "mx2-lw-eu.apache.org" Heuristic match: "mx2-lw-us.apache.org" Heuristic match: "mx2.acantho.net" Heuristic match: "mx2.inbox.lv" Heuristic match: "mx2.mtaroutes.com" Heuristic match: "mx2.qq.com" Heuristic match: "mx2.redhat.com" Heuristic match: "mx3.mtaroutes.com" Heuristic match: "mx3.qq.com" Heuristic match: "mx4.mtaroutes.com" Heuristic match: "mxb.ovh.net" Heuristic match: "mxs.mail.ru" Heuristic match: "mxt.securemx.jp" Heuristic match: "netyl.org" Heuristic match: "ns.aus.com" Heuristic match: "ns1.samba.org" Heuristic match: "nwk-aaemail-lapp01.apple.com" Heuristic match: "nwk-aaemail-lapp02.apple.com" Heuristic match: "nwk-aaemail-lapp03.apple.com" Heuristic match: "onlineconnections.com.au" Heuristic match: "openoffice.org" Heuristic match: "owa.ixperta.com" Heuristic match: "primarydata-com.mail.protection.outlook.com" Heuristic match: "primarydata.com" Heuristic match: "promus.com" Heuristic match: "qca.qualcomm.com" Heuristic match: "qq.com" Heuristic match: "rcdn-mx-01.cisco.com" Heuristic match: "redhat.com" Heuristic match: "samba.org" Heuristic match: "samsung.com" Heuristic match: "seznam.cz" Heuristic match: "shmoo.com" Heuristic match: "smtp-intra-1.desy.de" Heuristic match: "smtp-intra-2.desy.de" Heuristic match: "smtp-intra-3.desy.de" Heuristic match: "smtp.126.com" Heuristic match: "smtp.alinet.it" Heuristic match: "smtp.alum.mit.edu" Heuristic match: "smtp.alumni.purdue.edu" Heuristic match: "smtp.ashi.footprints.net" Heuristic match: "smtp.delmic.com" Heuristic match: "smtp.diningphilosopher.de" Heuristic match: "smtp.ericsson.com" Heuristic match: "smtp.giga.or.at" Heuristic match: "smtp.gnome.org" Heuristic match: "smtp.iki.fi" Heuristic match: "smtp.mellanox.com" Heuristic match: "smtp.netyl.org" Heuristic match: "smtp.ns.aus.com" Heuristic match: "smtp.primarydata.com" Heuristic match: "smtp.promus.com" Heuristic match: "smtp.qca.qualcomm.com" Heuristic match: "smtp.samba.org" Heuristic match: "smtp.samsung.com" Heuristic match: "smtp.stoeckmann.org" Heuristic match: "smtp.tycale.be" Heuristic match: "smtp.web.de" Heuristic match: "smtp.willglynn.com" Heuristic match: "smtp.yahoo.com" Heuristic match: "sourcefrog.net" Heuristic match: "spool.mail.gandi.net" Heuristic match: "stoeckmann.org" Heuristic match: "strongswan.org" Heuristic match: "toshiba.co.jp" Heuristic match: "tycale.be" Heuristic match: "web.de" Heuristic match: "willglynn.com" Heuristic match: "winpcap-org.p10.spamhero.com" Heuristic match: "winpcap.org" Heuristic match: "wireshark-org.p40.spamhero.net" Heuristic match: "wireshark.org"27:T4cb,"WinRAR.v.3.2.and.key.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"28:T9da,".exe" wrote bytes "60126b73" to virtual address "0x74E5E324" (part of module "WININET.DLL") ".exe" wrote bytes "b830126b73ffe0" to virtual address "0x752B1368" (part of module "WS2_32.DLL") ".exe" wrote bytes "b8c0156b73ffe0" to virtual address "0x74B036B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ab074" to virtual address "0x74B10274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "7111c9007a3bc800ab8b02007f950200fc8c0200729602006cc805001ecdc5007d26c500" to virtual address "0x766307E4" (part of module "USER32.DLL") ".exe" wrote bytes "b840136b73ffe0" to virtual address "0x74B03AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x74B04E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x74B04D78" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ab074" to virtual address "0x74B10258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436b074" to virtual address "0x74B10278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c0df26771cf92577ccf825770d64277700000000c011567500000000fc3e567500000000e0135675000000009457bb7425e02677c6e0267700000000bc6aba7400000000cf315675000000009319bb74000000002c32567500000000" to virtual address "0x74EA1000" (part of module "NSI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x752B1680" (part of module "WS2_32.DLL") ".exe" wrote bytes "7d072a7781ed2877ae862777c6e02677effd29772d16287760142a77478d2777a8e226776089277700000000ad372b758b2d2b75b6412b7500000000" to virtual address "0x736C1000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "b436b074" to virtual address "0x74B1025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ab074" to virtual address "0x74B101FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83ab074" to virtual address "0x74B101E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436b074" to virtual address "0x74B10200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x74B04EA4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436b074" to virtual address "0x74B101E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x74B04D68" (part of module "SSPICLI.DLL")29:T19dd,".exe" created file "C:\Windows\lsass.exe:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp9987.tmp:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp9A06.tmp:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EURO\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Filters\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Help\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ICQ 4 Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\WinRAR.v.3.2.and.key.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\Kazaa Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\Harry Potter.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp99C6.tmp:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\WinRAR.v.3.2.and.key.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\DW\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\ICQ 4 Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\index.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\Harry Potter.com:Zone.Identifier"2a:Ta2c,76/81 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.exe" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Kazaa Lite.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Harry Potter.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "index.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Harry Potter.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Winamp 5.0 _en_.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.exe" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Winamp 5.0 _en_.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "ICQ 4 Lite.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "ICQ 4 Lite.exe" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Harry Potter.exe" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "Kazaa Lite.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "index.exe" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "ICQ 4 Lite.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate) 76/81 Antivirus vendors marked dropped file "index.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 93% detection rate)2b:T7eb,"126.com" with TTL 299 "126mx00.mxmail.netease.com" with TTL 40 "126mx01.mxmail.netease.com" with TTL 599 "126mx02.mxmail.netease.com" with TTL 445 "126mx03.mxmail.netease.com" with TTL 242 "Mellanox-com.mail.protection.outlook.com" with TTL 9 "alum-mit-edu.mail.protection.outlook.com" with TTL 9 "alum.mit.edu" with TTL 19 "alumni-purdue-edu.mail.protection.outlook.com" with TTL 9 "aspmx2.googlemail.com" with TTL 292 "aspmx3.googlemail.com" with TTL 292 "athonet-com.mail.protection.outlook.com" with TTL 9 "athonet.com" with TTL 59 "broadcom.com" with TTL 250 "desy.de" with TTL 59 "ericsson-com.mail.protection.outlook.com" with TTL 9 "ericsson.com" with TTL 59 "fb.mail.gandi.net" with TTL 59 "gimp.org" with TTL 299 "ixperta.com" with TTL 599 "mail.126.com" with TTL 599 "mail.alum.mit.edu" with TTL 59 "mail.athonet.com" with TTL 59 "mail.cisco.com" with TTL 4 "mail.giga.or.at" with TTL 599 "mail.mail.ru" with TTL 328 "mail.ns.aus.com" with TTL 299 "mail.promus.com" with TTL 299 "mail.qca.qualcomm.com" with TTL 599 "mail.ru" with TTL 37 "mail.samsung.com" with TTL 299 "mail.stoeckmann.org" with TTL 299 "mail.tycale.be" with TTL 299 "mail.yahoo.com" with TTL 208 "mail1.ixperta.com" with TTL 599 "mailin.samsung.com" with TTL 10 "mailprot.hilton.com" with TTL 197 "mta5.am0.yahoodns.net" with TTL 23 "mta6.am0.yahoodns.net" with TTL 37 "mta7.am0.yahoodns.net" with TTL 45 "mx-ha03.web.de" with TTL 178 "mx.acantho.net" with TTL 299 "mx.alum.mit.edu" with TTL 59 "mx.athonet.com" with TTL 59 "mx.delmic.com" with TTL 299 "mx.giga.or.at" with TTL 599 "mx.gmx.net" with TTL 599 "mx.mail.ru" with TTL 599 "mx.ns.aus.com" with TTL 299 "mx.promus.com" with TTL 299 "mx.qca.qualcomm.com" with TTL 599 "mx.qq.com" with TTL 59 "mx.samsung.com" with TTL 299 "mx.stoeckmann.org" with TTL 299 "mx.tycale.be" with TTL 299 "mx.web.de" with TTL 599 "mx.yahoo.com" with TTL 253 "mx01.emig.gmx.net" with TTL 318 "mx1.mtaroutes.com" with TTL 27 "mx1.seznam.cz" with TTL 982c:T9d2,"Mail traffic to 220.181.15.200 on port 25 (SMTP), "Mail traffic to 94.100.180.31 on port 25 (SMTP) "Mail traffic to 67.195.228.110 on port 25 (SMTP), "Mail traffic to 67.195.204.79 on port 25 (SMTP) "Mail traffic to 220.181.15.151 on port 25 (SMTP), "Mail traffic to 98.136.96.76 on port 25 (SMTP) "Mail traffic to 217.69.139.202 on port 25 (SMTP), "Mail traffic to 220.181.15.135 on port 25 (SMTP) "Mail traffic to 72.30.35.10 on port 25 (SMTP), "Mail traffic to 220.181.15.209 on port 25 (SMTP) "Mail traffic to 123.126.96.210 on port 25 (SMTP), "Mail traffic to 103.129.252.34 on port 25 (SMTP) "Mail traffic to 123.126.96.3 on port 25 (SMTP), "Mail traffic to 217.69.139.87 on port 25 (SMTP) "Mail traffic to 98.136.103.24 on port 25 (SMTP), "Mail traffic to 172.253.116.26 on port 25 (SMTP) "Mail traffic to 172.253.116.27 on port 25 (SMTP), "Mail traffic to 173.194.204.27 on port 25 (SMTP) "Mail traffic to 212.227.17.8 on port 25 (SMTP), "Mail traffic to 104.47.38.36 on port 25 (SMTP) "Mail traffic to 212.227.15.17 on port 25 (SMTP), "Mail traffic to 209.41.68.240 on port 25 (SMTP) "Mail traffic to 38.111.198.182 on port 25 (SMTP), "Mail traffic to 82.165.230.17 on port 25 (SMTP) "Mail traffic to 173.38.212.150 on port 25 (SMTP), "Mail traffic to 72.163.7.166 on port 25 (SMTP) "Mail traffic to 173.37.147.230 on port 25 (SMTP), "Mail traffic to 198.133.159.250 on port 25 (SMTP) "Mail traffic to 72.163.4.185 on port 25 (SMTP), "Mail traffic to 95.216.37.110 on port 25 (SMTP) "Mail traffic to 94.100.180.70 on port 25 (SMTP), "Mail traffic to 69.147.88.7 on port 25 (SMTP) "Mail traffic to 209.85.201.14 on port 25 (SMTP), "Mail traffic to 81.17.56.160 on port 25 (SMTP) "Mail traffic to 205.134.188.171 on port 25 (SMTP), "Mail traffic to 46.165.223.3 on port 25 (SMTP) "Mail traffic to 209.132.180.187 on port 25 (SMTP), "Mail traffic to 213.174.182.195 on port 25 (SMTP) "Mail traffic to 209.87.249.19 on port 25 (SMTP), "Mail traffic to 209.132.180.179 on port 25 (SMTP) "Mail traffic to 172.253.116.14 on port 25 (SMTP), "Mail traffic to 192.251.125.179 on port 25 (SMTP) "Mail traffic to 64.233.184.14 on port 25 (SMTP), "Mail traffic to 172.217.218.14 on port 25 (SMTP) "Mail traffic to 216.239.32.21 on port 25 (SMTP), "Mail traffic to 213.165.67.108 on port 25 (SMTP) "Mail traffic to 213.174.182.194 on port 25 (SMTP), "Mail traffic to 77.75.78.42 on port 25 (SMTP) "Mail traffic to 210.130.202.91 on port 25 (SMTP), "Mail traffic to 104.47.4.36 on port 25 (SMTP)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3cAAAf////////////////3AAAHj///////////////hwAAB/j/////////////+PcAAAf/j////////////4/3AAAH//j///////////j/9wAAB///j/////////+P//cAAAf///j////////4///3AAAH////j///////j///9wAAB///+IiIiIiIiIj///cAAAf//4j4+Pj4+Pj4j//3AAAH//iPj4+Pj4+Pj4j/9wAAB/+I+Pj4+Pj4+Pj4j/cAAAeIj4+Pj4+Pj4+Pj4iHAAAH+Pj4+Pj4+Pj4+Pj49wAAB/////////////////AAAAB///////////////8AAAAAB//////////////wAAAAAAB/////////////AAAAAAAAB///////////8AAAAAAAAAB//////////wAAAAAAAAAAB/////////AAAAAAAAAAAAB///////8AAAAAAAAAAAAAB//////wAAAAAAAAAAAAAAB3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////AAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAB+AAAA/wAAAf+AAAP/wAAH/+AAD//wAB//+AA///wAf//+AP/////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791528723175,"unified_at":"2026-10-09T06:52:03.175Z","metadata":{"hashes":{"sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","sha1":"180c416e11e7b423f90071a9ad510f4b4596acaf","md5":"23a4837d41512227a691d3a3f4febbef","sha512":"d3c92f71bc0592cc8d7264553f0502bb596bb221d1e7759b82ab1f416f1da9c92925f9082cfdaeb16aec6c4c3fa446e3703bd74c02be035c90ee12260294d480","ssdeep":"384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUun1WQ:SCIqdH/k1ZVcT194jp4uEQ","ssdeep_chunks":["384:FZcpzCI","384:ZcpzCIq","384:cpzCIqd","384:pzCIqdG","384:zCIqdG3","384:CIqdG3A","384:IqdG3A3","384:qdG3A3W","384:dG3A3WU","384:G3A3WUk","384:3A3WUkx","384:A3WUkx3","384:3WUkx38","384:WUkx38G","384:Ukx38GZ","384:kx38GZD","384:x38GZDJ","384:38GZDJu","384:8GZDJuJ","384:GZDJuJb","384:ZDJuJbf","384:DJuJbf1","384:JuJbf1+","384:uJbf1+o","384:Jbf1+o4","384:bf1+o44","384:f1+o44u","384:1+o44u8","384:+o44u8g","384:o44u8gH","384:44u8gHz","384:4u8gHzU","384:u8gHzUu","384:8gHzUun","384:gHzUun1","384:HzUun1W","384:zUun1WQ","768:FZcpzCI","768:ZcpzCIq","768:cpzCIqd","768:pzCIqdG","768:zCIqdG3","768:CIqdG3A","768:IqdG3A3","768:qdG3A3W","768:dG3A3WU","768:G3A3WUk","768:3A3WUkx","768:A3WUkx3","768:3WUkx38","768:WUkx38G","768:Ukx38GZ","768:kx38GZD","768:x38GZDJ","768:38GZDJu","768:8GZDJuJ","768:GZDJuJb","768:ZDJuJbf","768:DJuJbf1","768:JuJbf1+","768:uJbf1+o","768:Jbf1+o4","768:bf1+o44","768:f1+o44u","768:1+o44u8","768:+o44u8g","768:o44u8gH","768:44u8gHz","768:4u8gHzU","768:u8gHzUu","768:8gHzUun","768:gHzUun1","768:HzUun1W","768:zUun1WQ","384:SCIqdH/","384:CIqdH/k","384:IqdH/k1","384:qdH/k1Z","384:dH/k1ZV","384:H/k1ZVc","384:/k1ZVcT","384:k1ZVcT1","384:1ZVcT19","384:ZVcT194","384:VcT194j","384:cT194jp","384:T194jp4","384:194jp4u","384:94jp4uE","384:4jp4uEQ"],"imphash":"5d02f6de12eb07fb22fe87e05e50d6a0"},"file_info":{"file_name":"ATTACHMENT.SCR","file_type":["peexe","executable"],"file_type_id":"exe","file_size":22020,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1563359603000,"last_seen":1693038174000,"last_multi_scan":1693038174000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mofksys","neshta"]},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":14,"suspicious_count":20,"malicious_count":12,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.ts9n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.worm.22020.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm[Email]/Win32.Mydoom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/BAS.Samca.zictf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Worm.Mydoom-5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.Q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.Q worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"EmailWorm ( 0000439f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.Mydoom.l","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Mydoom-GBX!23A4837D4151","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Mydoom.cuyllc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/MyDoom-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Mydoom.34820","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Mydoom.CJDZ-5239","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"I-WORM.MyDoom.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Shiz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Mydoom.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm.Mydoom","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00009342-00002608-15329-111-00805247\n GetLocalTime@KERNEL32.DLL at 00009342-00002608-15329-104-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00009342-00002608-15329-104-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTime@KERNEL32.DLL directly followed by \"cmp word ptr [ebp-10h], 07C6h\" and \"jc 00805282h\" at 00009342-00002608-15329-111-00805247\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, 02h\" and \"jne 00802E06h\" at 00009342-00002608-15329-104-00802DB3","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-54-0080418A\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-121-00803B75\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-123-00804349\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-125-0080399E\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-82-0080359E\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-84-0080357F\n GetProcessHeap@KERNEL32.DLL at 00009342-00002608-15329-156-0080453B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"126.com\"\n \"126mx00.mxmail.netease.com\"\n \"126mx01.mxmail.netease.com\"\n \"126mx02.mxmail.netease.com\"\n \"126mx03.mxmail.netease.com\"\n \"246tnt.com\"\n \"Mellanox-com.mail.protection.outlook.com\"\n \"aer-mx-01.cisco.com\"\n \"alexa-global-in.qualcomm.com\"\n \"alexa-in-ams.qualcomm.com\"\n \"alexa-in-lv.qualcomm.com\"\n \"alexa-in-sd.qualcomm.com\"\n \"alexa-in-tai.qualcomm.com\"\n \"alinet.it\"\n \"alln-mx-01.cisco.com\"\n \"alum-mit-edu.mail.protection.outlook.com\"\n \"alum.mit.edu\"\n \"alumni-purdue-edu.mail.protection.outlook.com\"\n \"alumni.purdue.edu\"\n \"apple.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"16.115.198.60:1042\"\n \"220.181.15.200:25\"\n \"94.100.180.31:25\"\n \"67.195.228.110:25\"\n \"67.195.204.79:25\"\n \"220.181.15.151:25\"\n \"98.136.96.76:25\"\n \"217.69.139.202:25\"\n \"220.181.15.135:25\"\n \"72.30.35.10:25\"\n \"220.181.15.209:25\"\n \"123.126.96.210:25\"\n \"103.129.252.34:25\"\n \"123.126.96.3:25\"\n \"217.69.139.87:25\"\n \"98.136.103.24:25\"\n \"172.253.116.26:25\"\n \"172.253.116.27:25\"\n \"173.194.204.27:25\"\n \"212.227.17.8:25\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\taaikmbhu.txt\"\n \".exe\" created file \"%TEMP%\\tmp9987.tmp\"\n \".exe\" created file \"%TEMP%\\tmp9987.tmp:Zone.Identifier\"\n \".exe\" created file \"%TEMP%\\tmp9A06.tmp\"\n \".exe\" created file \"%TEMP%\\tmp9A06.tmp:Zone.Identifier\"\n \".exe\" created file \"%TEMP%\\tmp99C6.tmp\"\n \".exe\" created file \"%TEMP%\\tmp99C6.tmp:Zone.Identifier\"\n \".exe\" created file \"%TEMP%\\tmp9AD2.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"rctrl_renwnd32\"\n \".exe\" searching for class \"ATH_Note\"\n \".exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe:Zone.Identifier\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ATTACHMENT.SCR.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"\n \"WinRAR.v.3.2.and.key.com\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n UPX1 with unusual entropies 7.89790234125\n 7.89790234125","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"ATTACHMENT.SCR.bin\" has a section named \"UPX0\"\n \"ATTACHMENT.SCR.bin\" has a section named \"UPX1\"\n \"WinRAR.v.3.2.and.key.com\" has a section named \"UPX0\"\n \"WinRAR.v.3.2.and.key.com\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"00121000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$27","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRAYBAR\"; Value: \"%WINDIR%\\lsass.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"baslug.org\" seems to be random\n \"mail.eth.fcs\" seems to be random\n \"mail.promus.com\" seems to be random\n \"mx.126.com\" seems to be random\n \"mx.eth.fcs\" seems to be random\n \"mx.netyl.org\" seems to be random\n \"mx.promus.com\" seems to be random\n \"mx1.qq.com\" seems to be random\n \"mx2.qq.com\" seems to be random\n \"mx3.qq.com\" seems to be random\n \"mxs.mail.ru\" seems to be random\n \"rcdn-mx-01.cisco.com\" seems to be random\n \"smtp.delmic.com\" seems to be random\n \"wireshark.org\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00009342-00002608-15329-209-00807D81","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Network Related","name":"Detected very many DNS queries for domains that cannot be resolved","description":"\"alinet.it\"\n \"alumni.purdue.edu\"\n \"apple.com\"\n \"ashi.footprints.net\"\n \"athonet.com\"\n \"baslug.org\"\n \"bnr.ca\"\n \"broadcom.com\"\n \"cr0.net\"\n \"desy.de\"\n \"diningphilosopher.de\"\n \"diorcet.fr\"\n \"ericsson.com\"\n \"eth.fcs\"\n \"getpocket.com.xpi\"\n \"isl.rdc.toshiba.co.jp\"\n \"ixperta.com\"\n \"mail.alinet.it\"\n \"mail.alum.mit.edu\"\n \"mail.alumni.purdue.edu\"\n \"mail.ashi.footprints.net\"\n \"mail.eth.fcs\"\n \"mail.giga.or.at\"\n \"mail.mozilla.org.xpi\"\n \"mail.netyl.org\"\n \"mail.ns.aus.com\"\n \"mail.primarydata.com\"\n \"mail.qca.qualcomm.com\"\n \"mail.samba.org\"\n \"mail.stoeckmann.org\"","origin":"Network Traffic","relevance":10,"id":"network-34","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"C:\\ATTACHMENT.SCR.exe\" binds to port 1042","origin":"Network Traffic","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00009342-00002608-15329-83-008036E9\n recv@WS2_32.DLL at 00009342-00002608-15329-94-0080641A\n recv@WS2_32.DLL at 00009342-00002608-15329-136-0080783E\n recv@WS2_32.DLL at 00009342-00002608-15329-140-00807983","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\ATTACHMENT.SCR.exe\" marked \"%WINDIR%\\lsass.exe\" for deletion\n \"C:\\ATTACHMENT.SCR.exe\" marked \"%TEMP%\\tmp9A06.tmp\" for deletion\n \"C:\\ATTACHMENT.SCR.exe\" marked \"%TEMP%\\tmp9987.tmp\" for deletion\n \"C:\\ATTACHMENT.SCR.exe\" marked \"%TEMP%\\tmp99C6.tmp\" for deletion\n \"C:\\ATTACHMENT.SCR.exe\" marked \"%TEMP%\\tmp9AD2.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\lsass.exe\" with delete access\n \".exe\" opened \"%TEMP%\\tmp9A06.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp9987.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp99C6.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp9AD2.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ATTACHMENT.SCR.bin\" has an entrypoint in section \"UPX1\"\n \"WinRAR.v.3.2.and.key.com\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ATTACHMENT.SCR.bin\" claims program is from Thu Jan 1 00:00:00 1970\n \"WinRAR.v.3.2.and.key.com\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"$29","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/17 Antivirus vendors marked sample as malicious (88% detection rate)\n 67/70 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/17 Antivirus vendors marked sample as malicious (88% detection rate)\n 67/70 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$2a","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\" was dropped at \"%WINDIR%\\lsass.exe\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 60 (or more) hosts in at least 12 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Network Related","name":"Detected many DNS responses with a low TTL","description":"$2b","origin":"Network Traffic","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a typical mail related ports","description":"$2c","origin":"Network Traffic","relevance":6,"id":"network-10","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 16.115.198.60 on port 1042\n TCP traffic to 129.81.102.160 on port 1042\n TCP traffic to 15.28.205.95 on port 1042\n TCP traffic to 69.164.195.140 on port 1042\n TCP traffic to 15.7.181.90 on port 1042","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\ATTACHMENT.SCR.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%WINDIR%\\lsass.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"Found a lot of single characters ('w','i','n','i','n','e','t','.','d','l','l') being pushed to stack and GetProcAddress@KERNEL32.DLL in the same context (relevant concatenated strings: 'wininet.dll') at: 00009342-00002608-15329-77-00803108","origin":"Hybrid Analysis Technology","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 228 domains and 228 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":27,"files_written_count":218,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":148,"dns_resolutions_count":228,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["mofksys","neshta"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5d436a28028838283e670317","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42.exe","analysis_start_time":"2019-08-01T22:39:36+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5d2ef970028838743021d3db","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Mydoom","contacted_countries":["CAN","CHE","CHN","CZE","DEU","FIN","FRA","GBR","HKG","ITA","JPN","KOR","LVA","NLD","RUS","SWE","TWN","USA","ZZZ"],"submit_name":"ATTACHMENT.SCR","analysis_start_time":"2019-10-21T16:07:42+00:00","indicators_count":{"informative":14,"suspicious":26,"malicious":13},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"16.115.198.60","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"220.181.15.200","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"94.100.180.31","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"67.195.228.110","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"67.195.204.79","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"220.181.15.151","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"98.136.96.76","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.69.139.202","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"220.181.15.135","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"72.30.35.10","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"220.181.15.209","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"123.126.96.210","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"103.129.252.34","port":25,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"123.126.96.3","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.69.139.87","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"98.136.103.24","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.253.116.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.253.116.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"173.194.204.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.17.8","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.38.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.15.17","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.41.68.240","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"38.111.198.182","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"82.165.230.17","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"173.38.212.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"72.163.7.166","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"173.37.147.230","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"198.133.159.250","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"72.163.4.185","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"95.216.37.110","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"94.100.180.70","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"69.147.88.7","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.85.201.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"81.17.56.160","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"205.134.188.171","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"46.165.223.3","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.132.180.187","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"213.174.182.195","port":25,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.87.249.19","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.132.180.179","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.253.116.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"192.251.125.179","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"64.233.184.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.217.218.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"216.239.32.21","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"213.165.67.108","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"213.174.182.194","port":25,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"77.75.78.42","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"210.130.202.91","port":25,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.4.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"129.81.102.160","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"193.180.16.203","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.70.178.217","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"198.211.120.117","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.70.178.1","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"203.205.219.58","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"92.243.1.129","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.10.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"216.145.54.173","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"130.211.33.45","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"58.251.110.111","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"54.225.234.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"13.249.87.41","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"203.205.219.57","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"111.161.64.40","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"52.96.36.114","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"64.233.186.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.42.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.32.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"45.79.91.51","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"95.170.70.140","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"167.187.200.23","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"144.76.82.148","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"98.136.96.74","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"98.136.96.75","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"67.195.204.74","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"199.106.107.15","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"46.105.45.21","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"15.28.205.95","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"144.76.82.137","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.136.9.76","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"193.180.17.167","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"129.46.98.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.17.5","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.15.9","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"82.165.229.87","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"103.229.16.67","port":25,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.16.98.57","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"203.254.224.12","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"199.106.109.198","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.132.183.28","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"211.45.27.231","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"66.187.233.71","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"209.132.183.105","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"64.101.32.55","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.70.178.3","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.5.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"94.23.64.17","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"192.251.125.165","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.217.12.179","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.16.98.61","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"195.140.195.198","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"69.164.195.140","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"15.7.181.90","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"104.47.34.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"62.209.229.40","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"151.237.227.25","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"213.175.50.25","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"151.237.227.164","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.17.190","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.72.192.67","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"212.227.15.41","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"217.160.0.52","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"152.96.80.46","port":25,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"194.152.32.75","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"52.96.31.178","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"85.25.47.226","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"203.254.224.9","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"195.140.195.201","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"194.152.32.74","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"172.217.218.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"131.169.56.82","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"5.2.73.210","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"5.2.73.211","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"194.152.32.40","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"80.156.24.162","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"80.156.24.166","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"213.186.33.19","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"64.233.184.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"62.138.237.244","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"131.169.56.69","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"52.13.171.212","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.151.62.66","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.151.62.67","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.151.62.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.171.2.60","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.171.2.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.171.2.72","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"131.169.56.83","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"17.142.160.59","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"31.15.10.119","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"94.23.217.224","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"207.244.88.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"203.254.227.15","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"131.169.180.47","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"91.121.40.167","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"address":"192.254.190.168","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"dns_resolutions":[{"domain":"126.com","address":"123.126.96.210","ttl":299,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"126mx00.mxmail.netease.com","address":"220.181.15.206","ttl":40,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"126mx01.mxmail.netease.com","address":"220.181.15.138","ttl":599,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"126mx02.mxmail.netease.com","address":"220.181.15.143","ttl":445,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"126mx03.mxmail.netease.com","address":"220.181.15.198","ttl":242,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"246tnt.com","address":"213.186.33.19","ttl":10799,"country":"France","registrar_name":"GANDI SAS","registrar_name_servers":"A.DNS.GANDI.NET","registrar_creation_date":"2001-03-18T12:06:20+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"Mellanox-com.mail.protection.outlook.com","address":"104.47.8.36","ttl":9,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1994-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"aer-mx-01.cisco.com","address":"173.38.212.150","ttl":1605,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Cisco Technology Inc.","registrar_creation_date":"1987-05-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alexa-global-in.qualcomm.com","address":"199.106.107.15","ttl":2555,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Qualcomm Inc.","registrar_creation_date":"1988-07-07T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alexa-in-ams.qualcomm.com","address":"212.136.9.76","ttl":3066,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alexa-in-lv.qualcomm.com","address":"129.46.98.27","ttl":2616,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alexa-in-sd.qualcomm.com","address":"199.106.107.15","ttl":3404,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alexa-in-tai.qualcomm.com","address":"103.229.16.67","ttl":3570,"country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alln-mx-01.cisco.com","address":"173.37.147.230","ttl":1737,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alum-mit-edu.mail.protection.outlook.com","address":"104.47.38.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alum.mit.edu","address":"23.214.46.209","ttl":19,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alumni-purdue-edu.mail.protection.outlook.com","address":"104.47.41.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"alumni.purdue.edu","ttl":14731,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"apple.com","address":"17.178.96.59","ttl":2653,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ashi.footprints.net","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"aspmx2.googlemail.com","address":"64.233.177.26","ttl":292,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"aspmx3.googlemail.com","address":"74.125.192.26","ttl":292,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"athonet-com.mail.protection.outlook.com","address":"104.47.6.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"athonet.com","address":"94.23.64.17","ttl":59,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"baslerweb.com","address":"62.138.237.244","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"baslug.org","address":"94.23.64.17","ttl":21599,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"bnr.ca","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"broadcom.com","address":"52.13.171.212","ttl":250,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"cisco.com","address":"72.163.4.185","ttl":3441,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"cr0.net","address":"163.172.231.13","ttl":1799,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"delmic.com","address":"95.170.70.140","ttl":21599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"desy.de","address":"131.169.180.47","ttl":59,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"diorcet.fr","address":"198.211.120.117","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ericsson-com.mail.protection.outlook.com","address":"104.47.4.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ericsson.com","address":"193.180.16.203","ttl":59,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"eth.fcs","ttl":86390,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"fb.mail.gandi.net","address":"217.70.178.217","ttl":59,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"getpocket.com.xpi","ttl":86379,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"giga.or.at","address":"5.2.73.211","ttl":3599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"gimp.org","address":"209.132.180.179","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"gmx.net","address":"82.165.229.87","ttl":1545,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"iki.fi","address":"212.16.98.51","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"inbox.lv","address":"194.152.32.40","ttl":1916,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"isl.rdc.toshiba.co.jp","address":"202.249.10.123","ttl":4214,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ixperta.com","address":"31.15.10.119","ttl":599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"lists.tcpdump.org","address":"209.87.249.19","ttl":21599,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ma1-aaemail-dr-lapp01.apple.com","address":"17.171.2.60","ttl":7416,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ma1-aaemail-dr-lapp02.apple.com","address":"17.171.2.68","ttl":1313,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ma1-aaemail-dr-lapp03.apple.com","address":"17.171.2.72","ttl":2282,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.126.com","address":"103.129.252.34","ttl":599,"country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.246tnt.com","address":"91.121.40.167","ttl":10799,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.ashi.footprints.net","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.athonet.com","address":"52.96.26.162","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.baslerweb.com","address":"80.156.24.162","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.cisco.com","address":"72.163.14.8","ttl":4,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.definitely.at","address":"5.2.73.210","ttl":3599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.delmic.com","address":"216.58.194.51","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.diorcet.fr","address":"198.211.120.117","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.ericsson.com","address":"193.180.17.167","ttl":21599,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.eth.fcs","ttl":86392,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.gmx.net","address":"212.227.17.190","ttl":899,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.iki.fi","address":"212.16.98.57","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.mail.ru","address":"217.69.139.70","ttl":328,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.mellanox.com","address":"52.96.39.162","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.mozilla.org.xpi","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.netyl.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.ns.aus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.promus.com","address":"192.251.125.165","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.ru","address":"94.100.180.200","ttl":37,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.samba.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.samsung.com","address":"203.254.224.9","ttl":299,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.strongswan.org","address":"152.96.80.46","ttl":21599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.tycale.be","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.web.de","address":"213.165.67.124","ttl":21040,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.willglynn.com","address":"54.225.234.14","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail.yahoo.com","address":"69.147.88.7","ttl":208,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail01.baslerweb.com","address":"80.156.24.166","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail1.ixperta.com","address":"62.209.229.40","ttl":599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail2.iki.fi","address":"212.16.98.61","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail2.ixperta.com","address":"151.237.227.25","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail3.iki.fi","address":"195.140.195.198","ttl":2084,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mail3.ixperta.com","address":"213.175.50.25","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mailin.samsung.com","address":"203.254.224.12","ttl":10,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mailprot.hilton.com","address":"192.251.125.179","ttl":197,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"maxx.shmoo.com","address":"205.134.188.171","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mellanox.com","address":"130.211.33.45","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mozilla.com.xpi","ttl":86396,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mozilla.org.xpi","ttl":86385,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mta5.am0.yahoodns.net","address":"98.136.96.77","ttl":23,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mta6.am0.yahoodns.net","address":"98.136.96.76","ttl":37,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mta7.am0.yahoodns.net","address":"98.136.96.75","ttl":45,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx-ha02.web.de","address":"212.227.17.8","ttl":787,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx-ha03.web.de","address":"212.227.15.17","ttl":178,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.126.com","address":"123.126.96.210","ttl":17999,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.246tnt.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.acantho.net","address":"213.174.182.195","ttl":299,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.ashi.footprints.net","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.athonet.com","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.cisco.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.delmic.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.ericsson.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.eth.fcs","ttl":86395,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.gmx.net","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.iki.fi","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.inbox.lv","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.mail.ru","address":"94.100.180.87","ttl":599,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.mellanox.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.mozilla.org.xpi","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.netyl.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.ns.aus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.promus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.qq.com","address":"0.0.0.1","ttl":59,"country":"Reserved","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.samba.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.samsung.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.strongswan.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.tycale.be","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.web.de","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.willglynn.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx.yahoo.com","address":"98.136.103.24","ttl":253,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx00.emig.gmx.net","address":"212.227.15.9","ttl":633,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx00.kundenserver.de","address":"212.227.15.41","ttl":2375,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx01.bnr.ca","address":"198.133.159.250","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx01.emig.gmx.net","address":"212.227.17.5","ttl":318,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx01.kundenserver.de","address":"217.72.192.67","ttl":3808,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx04.bnr.ca","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1-lw-eu.apache.org","ttl":1774,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1-lw-us.apache.org","address":"207.244.88.150","ttl":1306,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.acantho.net","address":"213.174.182.194","ttl":3491,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.inbox.lv","address":"194.152.32.72","ttl":4754,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.mtaroutes.com","address":"38.111.198.184","ttl":27,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.qq.com","address":"58.251.110.111","ttl":3599,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.redhat.com","address":"209.132.183.28","ttl":3594,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx1.seznam.cz","address":"77.75.76.42","ttl":98,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2-lw-eu.apache.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2-lw-us.apache.org","ttl":1301,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2.acantho.net","address":"213.174.182.195","ttl":1335,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2.inbox.lv","address":"194.152.32.73","ttl":6250,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2.mtaroutes.com","address":"188.138.125.29","ttl":26,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2.qq.com","address":"203.205.219.58","ttl":599,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx2.redhat.com","address":"66.187.233.71","ttl":1832,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx3.mtaroutes.com","address":"46.165.224.87","ttl":59,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx3.qq.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mx4.mtaroutes.com","address":"81.17.56.160","ttl":244,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mxb.ovh.net","address":"46.105.45.21","ttl":3564,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mxs.mail.ru","address":"94.100.180.104","ttl":46,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"mxt.securemx.jp","address":"210.130.202.90","ttl":546,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"netyl.org","address":"92.243.1.129","ttl":10799,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ns.aus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ns1.samba.org","address":"144.76.82.137","ttl":8655,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"nwk-aaemail-lapp01.apple.com","address":"17.151.62.66","ttl":16169,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"nwk-aaemail-lapp02.apple.com","address":"17.151.62.67","ttl":2684,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"nwk-aaemail-lapp03.apple.com","address":"17.151.62.68","ttl":6585,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"onlineconnections.com.au","address":"192.254.190.168","ttl":13637,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"openoffice.org","address":"40.79.78.1","ttl":3086,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"ospf.msg","ttl":86388,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"owa.ixperta.com","address":"151.237.227.22","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"primarydata-com.mail.protection.outlook.com","address":"104.47.33.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"primarydata.com","address":"45.79.91.51","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"promus.com","address":"167.187.200.23","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"qca.qualcomm.com","address":"199.106.109.198","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"qq.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"rcdn-mx-01.cisco.com","address":"72.163.7.166","ttl":676,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"redhat.com","address":"209.132.183.105","ttl":3594,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"resources.jar","ttl":86392,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"samba.org","address":"144.76.82.148","ttl":7199,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"samsung.com","address":"211.45.27.231","ttl":76,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"seznam.cz","address":"77.75.75.172","ttl":243,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"shmoo.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp-intra-1.desy.de","address":"131.169.56.82","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp-intra-2.desy.de","address":"131.169.56.83","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp-intra-3.desy.de","address":"131.169.56.69","ttl":20482,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.126.com","address":"123.126.96.4","ttl":1799,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.ashi.footprints.net","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.delmic.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.ericsson.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.eth.fcs","ttl":86396,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.gnome.org","address":"209.132.180.187","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.iki.fi","address":"195.140.195.201","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.mellanox.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.mozilla.org.xpi","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.netyl.org","address":"217.70.178.3","ttl":10799,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.ns.aus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.promus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.samba.org","address":"144.76.82.148","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.samsung.com","address":"203.254.227.15","ttl":299,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.tycale.be","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.web.de","address":"213.165.67.108","ttl":207,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.willglynn.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"smtp.yahoo.com","address":"216.145.54.155","ttl":1621,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"sourcefrog.net","address":"216.239.32.21","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"spool.mail.gandi.net","address":"217.70.178.1","ttl":37,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"stoeckmann.org","address":"217.160.0.52","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"strongswan.org","address":"152.96.80.46","ttl":21599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"toshiba.co.jp","address":"106.186.93.49","ttl":209,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"tycale.be","address":"94.23.217.224","ttl":21599,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"web.de","address":"82.165.230.17","ttl":34,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"willglynn.com","address":"143.204.158.100","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"winpcap-org.p10.spamhero.com","address":"108.166.161.243","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"winpcap.org","address":"104.25.218.21","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"wireshark-org.p40.spamhero.net","address":"209.41.68.240","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"wireshark.org","address":"104.25.218.21","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"domain":"yahoo.com","address":"98.137.246.7","ttl":948,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}],"processes":[{"pid":2608,"ppid":0,"name":"ATTACHMENT.SCR.exe","command_line":"","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","normalized_path":"C:\\ATTACHMENT.SCR.exe","uid":"00009342-00002608","icon":"$2d"}],"all_imported_dlls":["shell32.dll","dhcpcsvc6.dll","dhcpcsvc.dll","shlwapi.dll","secur32.dll","kernel32.dll","gdi32.dll","lpk.dll","dnsapi.dll","FWPUCLNT.DLL","userenv.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","sechost.dll","pnrpnsp.dll","winnsi.dll","profapi.dll","msvcr100.dll","wininet.dll","api-ms-win-downlevel-user32-l1-1-0.dll","webio.dll","cryptbase.dll","ws2_32.dll","IPHLPAPI.DLL","rasadhlp.dll","version.dll","advapi32.dll","wow64.dll","mswsock.dll","normaliz.dll","tzres.dll","msvcrt.dll","ntdll.dll","imm32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wship6.dll","KernelBase.dll","NapiNSP.dll","WSHTCPIP.DLL","nsi.dll","api-ms-win-downlevel-version-l1-1-0.dll","wow64win.dll","rpcrt4.dll","iertutil.dll","msctf.dll","ole32.dll","winhttp.dll","user32.dll","sspicli.dll","usp10.dll","nlaapi.dll","winrnr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wow64cpu.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Winamp 5.0 _en_.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Winamp 5.0 _en_ Crack.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Winamp 5.0 _en_ Crack.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Winamp 5.0 _en_.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Winamp 5.0 _en_ Crack.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Winamp 5.0 _en_.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Kazaa Lite.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"WinRAR.v.3.2.and.key.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"index.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Harry Potter.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"ICQ 4 Lite.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"index.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Harry Potter.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Kazaa Lite.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"ICQ 4 Lite.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"WinRAR.v.3.2.and.key.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"index.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Harry Potter.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"WinRAR.v.3.2.and.key.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"ICQ 4 Lite.ShareReactor.com","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"lsass.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"Kazaa Lite.exe","sha256":"1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"taaikmbhu.txt","sha256":"3df8481c9416654663b04c87425d36714e243ba12a28f82ec1f23c1072e1086a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"tmp9987.tmp","sha256":"ab5748b49ce87065761195a07d4535b69b76cace32f69e79883f83da744788b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"tmp99C6.tmp","sha256":"ab5748b49ce87065761195a07d4535b69b76cace32f69e79883f83da744788b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"tmp9A06.tmp","sha256":"ab5748b49ce87065761195a07d4535b69b76cace32f69e79883f83da744788b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"name":"tmp9AD2.tmp","sha256":"9a6050a6ae9fd49dc975fd63804a4a69bea6e7fecc4b2313dc732fb17e29c33d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%WINDIR%\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"C:\\ATTACHMENT.SCR.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"C:\\ATTACHMENT.SCR.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%WINDIR%\\lsass.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%TEMP%\\taaikmbhu.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%TEMP%\\tmp9987.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%TEMP%\\tmp9A06.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\index.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\index.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%TEMP%\\tmp99C6.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\index.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\WinRAR.v.3.2.and.key.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\WinRAR.v.3.2.and.key.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\index.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\index.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Winamp 5.0 (en) Crack.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Winamp 5.0 (en) Crack.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5d2ef970028838743021d3db"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d2ef970028838743021d3db"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Worm.Mydoom Sample 1b46afe1779e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1b46afe1779e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42"}],["$","meta","4",{"property":"og:title","content":"Malicious Worm.Mydoom Sample 1b46afe1779e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1b46afe1779e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1b46afe1779e897e6b9f3714e9276ccb7a4cef6865eb6a4172f0dd1ce1a46b42"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Worm.Mydoom Sample 1b46afe1779e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1b46afe1779e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]