23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious App/Bitcoin Sample 28e15c25926d… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 28e15c25926d…. Malware family: App/Bitcoin. Threat score 70/100. 1/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340","keywords":["Suspicious","App/Bitcoin","malware analysis","sandbox report","threat intelligence","28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340"],"about":{"@type":"SoftwareApplication","name":"Bitfinite-QT-(Windows).zip","applicationCategory":["peexe","executable"],"identifier":"28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"App/Bitcoin","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tc0e,"" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\__db.80000001.7c46b5d2" at 00015167-00003868-0000010C-71318287 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\__db.80000001.7c46b5d2" at 00015167-00003868-0000010C-71326038 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\blkindex.dat" at 00015167-00003868-0000010C-71332053 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\blkindex.dat" at 00015167-00003868-0000010C-71342660 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\__db.8000000a.69baa16b" at 00015167-00003868-0000010C-71556902 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\__db.8000000a.69baa16b" at 00015167-00003868-0000010C-71560776 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\wallet.dat" at 00015167-00003868-0000010C-71567988 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\wallet.dat" at 00015167-00003868-0000010C-71573627 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-71595461 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-71610593 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73760514 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73773657 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73786739 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73804690 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73821533 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73836988 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73854471 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73868548 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-73881609 "" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Bitfinite\database\log.0000000001" at 00015167-00003868-0000010C-7389422025:T5af,"\Sessions\1\BaseNamedObjects\.NET CLR Data_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NET CLR Networking_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NET Data Provider for Oracle_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NET Memory Cache 4.0_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\.NETFramework_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\ASP.NET_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\ASP.NET_4.0.30319_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\aspnet_state_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\BITS_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\ESENT_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\Lsa_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\MSSCNTRS_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\Outlook_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_f1c" "\Sessions\1\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_f1c"26:T592,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\tzres.dll" "" touched file "C:\Windows\System32\en-US\tzres.dll.mui" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Users\W9GQDun\AppData\Roaming\Microsoft\Windows\Start Menu" "" touched file "C:\Users\W9GQDun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "" touched file "C:\Users\W9GQDun\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui"27:T438d,Heuristic match: "iphone-stun.strato-iphone.de" Heuristic match: "numb.viagenie.ca" Heuristic match: "s1.taraba.net" Heuristic match: "s2.taraba.net" Heuristic match: "stun.12connect.com" Heuristic match: "stun.12voip.com" Heuristic match: "stun.1und1.de" Heuristic match: "stun.2talk.co.nz" Heuristic match: "stun.2talk.com" Heuristic match: "stun.3clogic.com" Heuristic match: "stun.3cx.com" Heuristic match: "stun.a-mm.tv" Heuristic match: "stun.aa.net.uk" Heuristic match: "stun.acrobits.cz" Heuristic match: "stun.actionvoip.com" Heuristic match: "stun.advfn.com" Heuristic match: "stun.aeta-audio.com" Heuristic match: "stun.aeta.com" Heuristic match: "stun.alltel.com.au" Heuristic match: "stun.altar.com.pl" Heuristic match: "stun.annatel.net" Heuristic match: "stun.arbuz.ru" Heuristic match: "stun.avigora.com" Heuristic match: "stun.avigora.fr" Heuristic match: "stun.awa-shima.com" Heuristic match: "stun.awt.be" Heuristic match: "stun.b2b2c.ca" Heuristic match: "stun.bahnhof.net" Heuristic match: "stun.barracuda.com" Heuristic match: "stun.bluesip.net" Heuristic match: "stun.bmwgs.cz" Heuristic match: "stun.botonakis.com" Heuristic match: "stun.budgetphone.nl" Heuristic match: "stun.budgetsip.com" Heuristic match: "stun.cablenet-as.net" Heuristic match: "stun.callromania.ro" Heuristic match: "stun.callwithus.com" Heuristic match: "stun.cbsys.net" Heuristic match: "stun.chathelp.ru" Heuristic match: "stun.cheapvoip.com" Heuristic match: "stun.ciktel.com" Heuristic match: "stun.cloopen.com" Heuristic match: "stun.colouredlines.com.au" Heuristic match: "stun.comfi.com" Heuristic match: "stun.commpeak.com" Heuristic match: "stun.comtube.com" Heuristic match: "stun.comtube.ru" Heuristic match: "stun.cope.es" Heuristic match: "stun.counterpath.com" Heuristic match: "stun.counterpath.net" Heuristic match: "stun.cryptonit.net" Heuristic match: "stun.darioflaccovio.it" Heuristic match: "stun.datamanagement.it" Heuristic match: "stun.dcalling.de" Heuristic match: "stun.decanet.fr" Heuristic match: "stun.demos.ru" Heuristic match: "stun.develz.org" Heuristic match: "stun.dingaling.ca" Heuristic match: "stun.doublerobotics.com" Heuristic match: "stun.drogon.net" Heuristic match: "stun.duocom.es" Heuristic match: "stun.dus.net" Heuristic match: "stun.e-fon.ch" Heuristic match: "stun.easybell.de" Heuristic match: "stun.easycall.pl" Heuristic match: "stun.easyvoip.com" Heuristic match: "stun.efficace-factory.com" Heuristic match: "stun.einsundeins.com" Heuristic match: "stun.einsundeins.de" Heuristic match: "stun.ekiga.net" Heuristic match: "stun.epygi.com" Heuristic match: "stun.etoilediese.fr" Heuristic match: "stun.eyeball.com" Heuristic match: "stun.faktortel.com.au" Heuristic match: "stun.freecall.com" Heuristic match: "stun.freeswitch.org" Heuristic match: "stun.freevoipdeal.com" Heuristic match: "stun.fuzemeeting.com" Heuristic match: "stun.gmx.de" Heuristic match: "stun.gmx.net" Heuristic match: "stun.gradwell.com" Heuristic match: "stun.halonet.pl" Heuristic match: "stun.hoiio.com" Heuristic match: "stun.hosteurope.de" Heuristic match: "stun.ideasip.com" Heuristic match: "stun.imesh.com" Heuristic match: "stun.infra.net" Heuristic match: "stun.internetcalls.com" Heuristic match: "stun.intervoip.com" Heuristic match: "stun.ipcomms.net" Heuristic match: "stun.ipfire.org" Heuristic match: "stun.ippi.fr" Heuristic match: "stun.ipshka.com" Heuristic match: "stun.iptel.org" Heuristic match: "stun.irian.at" Heuristic match: "stun.it1.hr" Heuristic match: "stun.ivao.aero" Heuristic match: "stun.jappix.com" Heuristic match: "stun.jumblo.com" Heuristic match: "stun.justvoip.com" Heuristic match: "stun.kanet.ru" Heuristic match: "stun.kiwilink.co.nz" Heuristic match: "stun.kundenserver.de" Heuristic match: "stun.l.google.com" Heuristic match: "fKstun.linea7.net" Heuristic match: "stun.linphone.org" Heuristic match: "stun.liveo.fr" Heuristic match: "stun.lowratevoip.com" Heuristic match: "stun.lugosoft.com" Heuristic match: "stun.lundimatin.fr" Heuristic match: "stun.magnet.ie" Heuristic match: "stun.manle.com" Heuristic match: "stun.mgn.ru" Heuristic match: "stun.mit.de" Heuristic match: "stun.mitake.com.tw" Heuristic match: "stun.miwifi.com" Heuristic match: "stun.modulus.gr" Heuristic match: "stun.mozcom.com" Heuristic match: "stun.myvoiptraffic.com" Heuristic match: "stun.mywatson.it" Heuristic match: "stun.nas.net" Heuristic match: "stun.neotel.co.za" Heuristic match: "stun.netappel.com" Heuristic match: "stun.netappel.fr" Heuristic match: "stun.netgsm.com.tr" Heuristic match: "stun.nfon.net" Heuristic match: "stun.noblogs.org" Heuristic match: "stun.noc.ams-ix.net" Heuristic match: "stun.node4.co.uk" Heuristic match: "stun.nonoh.net" Heuristic match: "stun.nottingham.ac.uk" Heuristic match: "stun.nova.is" Heuristic match: "stun.nventure.com" Heuristic match: "stun.on.net.mk" Heuristic match: "stun.ooma.com" Heuristic match: "stun.ooonet.ru" Heuristic match: "stun.outland-net.de" Heuristic match: "stun.ozekiphone.com" Heuristic match: "stun.patlive.com" Heuristic match: "stun.personal-voip.de" Heuristic match: "stun.petcube.com" Heuristic match: "stun.phone.com" Heuristic match: "stun.phoneserve.com" Heuristic match: "stun.pjsip.org" Heuristic match: "stun.poivy.com" Heuristic match: "stun.powerpbx.org" Heuristic match: "stun.powervoip.com" Heuristic match: "stun.ppdi.com" Heuristic match: "stun.prizee.com" Heuristic match: "stun.qq.com" Heuristic match: "stun.qvod.com" Heuristic match: "stun.rackco.com" Heuristic match: "stun.rapidnet.de" Heuristic match: "stun.rb-net.com" Heuristic match: "stun.remote-learner.net" Heuristic match: "stun.rixtelecom.se" Heuristic match: "stun.rockenstein.de" Heuristic match: "stun.rolmail.net" Heuristic match: "stun.rounds.com" Heuristic match: "stun.rynga.com" Heuristic match: "stun.samsungsmartcam.com" Heuristic match: "stun.schlund.de" Heuristic match: "stun.services.mozilla.com" Heuristic match: "stun.sigmavoip.com" Heuristic match: "stun.sip.us" Heuristic match: "stun.sipdiscount.com" Heuristic match: "stun.sipgate.net" Heuristic match: "'stun.sipgate.net" Heuristic match: "stun.siplogin.de" Heuristic match: "stun.sipnet.net" Heuristic match: "stun.sipnet.ru" Heuristic match: "stun.siportal.it" Heuristic match: "stun.sippeer.dk" Heuristic match: "stun.siptraffic.com" Heuristic match: "stun.skylink.ru" Heuristic match: "stun.sma.de" Heuristic match: "stun.smartvoip.com" Heuristic match: "stun.smsdiscount.com" Heuristic match: "stun.snafu.de" Heuristic match: "stun.softjoys.com" Heuristic match: "stun.solcon.nl" Heuristic match: "stun.solnet.ch" Heuristic match: "stun.sonetel.com" Heuristic match: "stun.sonetel.net" Heuristic match: "stun.sovtest.ru" Heuristic match: "stun.speedy.com.ar" Heuristic match: "stun.spokn.com" Heuristic match: "stun.srce.hr" Heuristic match: "stun.ssl7.net" Heuristic match: "stun.stunprotocol.org" Heuristic match: "stun.symform.com" Heuristic match: "stun.symplicity.com" Heuristic match: "stun.sysadminman.net" Heuristic match: "stun.t-online.de" Heuristic match: "stun.tagan.ru" Heuristic match: "stun.tatneft.ru" Heuristic match: "stun.teachercreated.com" Heuristic match: "stun.tel.lu" Heuristic match: "stun.telbo.com" Heuristic match: "stun.telefacil.com" Heuristic match: "stun.tis-dialog.ru" Heuristic match: "stun.tng.de" Heuristic match: "stun.twt.it" Heuristic match: "stun.u-blox.com" Heuristic match: "stun.ucallweconn.net" Heuristic match: "stun.ucsb.edu" Heuristic match: "stun.ucw.cz" Heuristic match: "stun.uls.co.za" Heuristic match: "stun.unseen.is" Heuristic match: "stun.usfamily.net" Heuristic match: "stun.veoh.com" Heuristic match: "stun.vidyo.com" Heuristic match: "stun.vipgroup.net" Heuristic match: "stun.virtual-call.com" Heuristic match: "stun.viva.gr" Heuristic match: "stun.vivox.com" Heuristic match: "stun.vline.com" Heuristic match: "stun.vo.lu" Heuristic match: "stun.vodafone.ro" Heuristic match: "stun.voicetrading.com" Heuristic match: "stun.voip.aebc.com" Heuristic match: "stun.voip.blackberry.com" Heuristic match: "stun.voip.eutelia.it" Heuristic match: "stun.voiparound.com" Heuristic match: "stun.voipblast.com" Heuristic match: "stun.voipbuster.com" Heuristic match: "stun.voipbusterpro.com" Heuristic match: "stun.voipcheap.co.uk" Heuristic match: "stun.voipcheap.com" Heuristic match: "stun.voipfibre.com" Heuristic match: "stun.voipgain.com" Heuristic match: "stun.voipgate.com" Heuristic match: "stun.voipinfocenter.com" Heuristic match: "stun.voipplanet.nl" Heuristic match: "stun.voippro.com" Heuristic match: "stun.voipraider.com" Heuristic match: "stun.voipstunt.com" Heuristic match: "stun.voipwise.com" Heuristic match: "stun.voipzoom.com" Heuristic match: "stun.voxgratia.org" Heuristic match: "stun.voxox.com" Heuristic match: "stun.voys.nl" Heuristic match: "stun.voztele.com" Heuristic match: "stun.vyke.com" Heuristic match: "stun.webcalldirect.com" Heuristic match: "stun.whoi.edu" Heuristic match: "stun.wifirst.net" Heuristic match: "stun.wwdl.net" Heuristic match: "stun.xs4all.nl" Heuristic match: "stun.xtratelecom.es" Heuristic match: "stun.yesss.at" Heuristic match: "stun.zadarma.com" Heuristic match: "stun.zadv.com" Heuristic match: "stun.zoiper.com" Heuristic match: "stun1.faktortel.com.au" Heuristic match: "stun1.l.google.com" Heuristic match: "fKstun1.voiceeclipse.net" Heuristic match: "stun2.l.google.com" Heuristic match: "fKstun3.l.google.com" Heuristic match: "fKstun4.l.google.com" Heuristic match: "fKstunserver.org" Heuristic match: "stun.antisip.com" Heuristic match: "Bitfinite.su" Pattern match: "qt-project.org/qmessagebox/images/qtlogo-64.png" Pattern match: "https://example.com/tx/%s" Pattern match: "http://www.opensource.org/licenses/mit-license.php" Heuristic match: "time.windows.com" Heuristic match: "time1.google.com" Heuristic match: "time2.google.com" Heuristic match: "time3.google.com" Heuristic match: "time4.google.com" Heuristic match: "clock.sjc.he.net" Heuristic match: "clock.nyc.he.net" Heuristic match: "ntp.sixxs.net" Heuristic match: "ntp.eu.sixxs.net" Heuristic match: "ntp.us.sixxs.net" Heuristic match: "ntp.ap.sixxs.net" Heuristic match: "ntp.karelia.pro" Heuristic match: "ntp.alpet.me" Heuristic match: "aviel.alpet.me" Heuristic match: "ntp.sampo.ru" Heuristic match: "ntp.szt.ru" Heuristic match: "ntp.ix.ru" Heuristic match: "ntp1.stratum2.ru" Heuristic match: "ntp2.stratum2.ru" Heuristic match: "ntp3.stratum2.ru" Heuristic match: "ntp4.stratum2.ru" Heuristic match: "ntp5.stratum2.ru" Heuristic match: "ntp6.stratum2.ru" Heuristic match: "ntp7.stratum2.ru" Heuristic match: "ntp1.stratum1.ru" Heuristic match: "ntp2.stratum1.ru" Heuristic match: "ntp3.stratum1.ru" Heuristic match: "ntp4.stratum1.ru" Heuristic match: "ntp1.vniiftri.ru" Heuristic match: "ntp2.vniiftri.ru" Heuristic match: "ntp3.vniiftri.ru" Heuristic match: "ntp4.vniiftri.ru" Heuristic match: "ntp21.vniiftri.ru" Heuristic match: "ntp1.niiftri.irkutsk.ru" Heuristic match: "ntp2.niiftri.irkutsk.ru" Heuristic match: "vniiftri.khv.ru" Heuristic match: "vniiftri2.khv.ru" Heuristic match: "ntp0.zenon.net" Heuristic match: "ntp.mobatime.ru" Heuristic match: "0.ru.pool.ntp.org" Heuristic match: "1.ru.pool.ntp.org" Heuristic match: "2.ru.pool.ntp.org" Heuristic match: "3.ru.pool.ntp.org" Heuristic match: "tock.cs.unlv.edu" Heuristic match: "timex.cs.columbia.edu" Heuristic match: "tick.cs.unlv.edu" Heuristic match: "sundial.columbia.edu" Heuristic match: "ntp-1.ece.cmu.edu" Heuristic match: "ntp-2.ece.cmu.edu" Heuristic match: "ntp1.cs.wisc.edu" Heuristic match: "ntp2.cs.wisc.edu" Heuristic match: "ntp3.cs.wisc.edu" Heuristic match: "ntp-01.caltech.edu" Heuristic match: "ntp-02.caltech.edu" Heuristic match: "ntp-03.caltech.edu" Heuristic match: "ntp-04.caltech.edu" Heuristic match: "nist1-pa.ustiming.org" Heuristic match: "time.nist.gov" Heuristic match: "time-a.nist.gov" Heuristic match: "time-b.nist.gov" Heuristic match: "time-c.nist.gov" Heuristic match: "time-d.nist.gov" Heuristic match: "time-nw.nist.gov" Heuristic match: "nist1-macon.macon.ga.us" Heuristic match: "nist.netservicesgroup.com" Heuristic match: "nisttime.carsoncity.k12.mi.us" Heuristic match: "nist1-lnk.binary.net" Heuristic match: "wwv.nist.gov" Heuristic match: "time-a.timefreq.bldrdoc.gov" Heuristic match: "time-b.timefreq.bldrdoc.gov" Heuristic match: "time-c.timefreq.bldrdoc.gov" Heuristic match: "utcnist.colorado.edu" Heuristic match: "utcnist2.colorado.edu" Heuristic match: "ntp-nist.ldsbc.net" Heuristic match: "nist1-lv.ustiming.org" Heuristic match: "nist-time-server.eoni.com" Heuristic match: "ntp1.bu.edu" Heuristic match: "ntp2.bu.edu" Heuristic match: "ntp3.bu.edu" Heuristic match: "0.us.pool.ntp.org" Heuristic match: "1.us.pool.ntp.org" Heuristic match: "2.us.pool.ntp.org" Heuristic match: "3.us.pool.ntp.org" Heuristic match: "wwv.otc.psu.edu" Heuristic match: "otc1.psu.edu" Heuristic match: "otc2.psu.edu" Heuristic match: "now.okstate.edu" Heuristic match: "ntp.colby.edu" Heuristic match: "bonehed.lcs.mit.edu" Heuristic match: "ntp-s1.cise.ufl.edu" Heuristic match: "ntp1.meraka.csir.co.za" Heuristic match: "ntp.is.co.za" Heuristic match: "ntp2.is.co.za" Heuristic match: "igubu.saix.net" Heuristic match: "ntp1.neology.co.za" Heuristic match: "ntp2.neology.co.za" Heuristic match: "tick.meraka.csir.co.za" Heuristic match: "tock.meraka.csir.co.za" Heuristic match: "ntp.time.org.za" Heuristic match: "ntp2.meraka.csir.co.za" Heuristic match: "0.za.pool.ntp.org" Heuristic match: "1.za.pool.ntp.org" Heuristic match: "2.za.pool.ntp.org" Heuristic match: "3.za.pool.ntp.org" Heuristic match: "ntp0.ien.it" Heuristic match: "ntp1.ien.it" Heuristic match: "ntp2.ien.it" Heuristic match: "ntp1.inrim.it" Heuristic match: "ntp2.inrim.it" Heuristic match: "0.it.pool.ntp.org" Heuristic match: "1.it.pool.ntp.org" Heuristic match: "2.it.pool.ntp.org" Heuristic match: "3.it.pool.ntp.org" Heuristic match: "ntp0.nl.net" Heuristic match: "ntp1.nl.net" Heuristic match: "ntp2.nl.net" Heuristic match: "ntp.utwente.nl" Heuristic match: "0.nl.pool.ntp.org" Heuristic match: "1.nl.pool.ntp.org" Heuristic match: "2.nl.pool.ntp.org" Heuristic match: "3.nl.pool.ntp.org" Heuristic match: "ntp2d.mcc.ac.uk" Heuristic match: "ntp2c.mcc.ac.uk" Heuristic match: "ntp2b.mcc.ac.uk" Heuristic match: "ntp.exnet.com" Heuristic match: "ntp.cis.strath.ac.uk" Heuristic match: "ntppub.le.ac.uk" Heuristic match: "0.uk.pool.ntp.org" Heuristic match: "1.uk.pool.ntp.org" Heuristic match: "2.uk.pool.ntp.org" Heuristic match: "3.uk.pool.ntp.org" Heuristic match: "chime.utoronto.ca" Heuristic match: "tick.utoronto.ca" Heuristic match: "time.nrc.ca" Heuristic match: "timelord.uregina.ca" Heuristic match: "tock.utoronto.ca" Pattern match: "www1.cmc.ec.gc.ca" Pattern match: "www2.cmc.ec.gc.ca" Heuristic match: "0.ca.pool.ntp.org" Heuristic match: "1.ca.pool.ntp.org" Heuristic match: "2.ca.pool.ntp.org" Heuristic match: "3.ca.pool.ntp.org" Heuristic match: "ntp.nict.jp" Heuristic match: "0.jp.pool.ntp.org" Heuristic match: "1.jp.pool.ntp.org" Heuristic match: "2.jp.pool.ntp.org" Heuristic match: "3.jp.pool.ntp.org" Heuristic match: "ntp.cs.mu.oz.au" Heuristic match: "augean.eleceng.adelaide.edu.au" Heuristic match: "0.au.pool.ntp.org" Heuristic match: "1.au.pool.ntp.org" Heuristic match: "2.au.pool.ntp.org" Heuristic match: "3.au.pool.ntp.org" Heuristic match: "time.ijs.si" Heuristic match: "0.at.pool.ntp.org" Heuristic match: "1.at.pool.ntp.org" Heuristic match: "2.at.pool.ntp.org" Heuristic match: "3.at.pool.ntp.org" Heuristic match: "clepsydra.dec.com" Heuristic match: "dummyaddress.onion" Heuristic match: "seedp4knqnoei57u.onion" Heuristic match: "seedr3hhlepyi7fd.onion" Heuristic match: "seed3uuomkclbiz4.onion" Heuristic match: "seedeh7qck3ouff5.onion" Heuristic match: "5rg3vq4jagckeckf.onion" Heuristic match: "seedt3sraf53ajiy.onion" Heuristic match: "seedg4qyccsg42oq.onion" Heuristic match: "novaqrtoywpg7jly.onion" Heuristic match: "seed3d5wolqbgrcb.onion" Heuristic match: "seed24u5dwph3qw4.onion" Heuristic match: "mj26ulzbs2oskgym.onion" Heuristic match: "eqon4usunavt76m7.onion" Heuristic match: "seedd3aldwpslzl3.onion" Heuristic match: "irc.lfnet.org" Pattern match: "https://en.bitcoin.it/wiki/BIP_0022" Pattern match: "qt.io/licensing" Pattern match: "qt-project.org/styles/commonstyle/images/cleartext-16.png" Pattern match: "qt-project.org/windows/cursors/images/" Heuristic match: "src\hb-buffer.cc" Heuristic match: "src\hb-shape.cc" Heuristic match: "src\hb-ot-layout.cc" Heuristic match: "src\hb-shape-plan.cc" Heuristic match: "src\hb-ot-shape-complex-thai.cc" Heuristic match: "nsrc\hb-ot-shape-complex-indic.cc" Heuristic match: "Diloloa.kI" Heuristic match: ".dop.sn.fm" Pattern match: "ddd.M.yyd/M/yyyydddd" Heuristic match: "GetExternalIPbySTUN(18446744073709551615) returned 193.70.47.200 in attempt 2; Server=stun.zoiper.com"28:T76b,"" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR DATA\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET CLR NETWORKING 4.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR ORACLE\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET DATA PROVIDER FOR SQLSERVER\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\.NET MEMORY CACHE 4.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MSDTC BRIDGE 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\MSDTC BRIDGE 4.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SERVICEMODELENDPOINT 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SERVICEMODELOPERATION 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SERVICEMODELSERVICE 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SMSVCHOST 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SMSVCHOST 4.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINDOWS WORKFLOW FOUNDATION 3.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINDOWS WORKFLOW FOUNDATION 4.0.0.0\LINKAGE") "" (Access type: "CREATE"; Path: "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\BITS\PERFORMANCE")29:T706,"" queried SystemProcessInformation at 00015167-00003868-00000105-43058480 "" queried SystemProcessInformation at 00015167-00003868-00000105-43184207 "" queried SystemProcessInformation at 00015167-00003868-00000105-71951502 "" queried SystemProcessInformation at 00015167-00003868-00000105-71958521 "" queried SystemProcessInformation at 00015167-00003868-00000105-71965475 "" queried SystemProcessInformation at 00015167-00003868-00000105-73551556 "" queried SystemProcessInformation at 00015167-00003868-00000105-73553273 "" queried SystemProcessInformation at 00015167-00003868-00000105-73609130 "" queried SystemProcessInformation at 00015167-00003868-00000105-75689046 "" queried SystemProcessInformation at 00015167-00003868-00000105-75696256 "" queried SystemProcessInformation at 00015167-00003868-00000105-75703582 "" queried SystemProcessInformation at 00015167-00003868-00000105-79441306 "" queried SystemProcessInformation at 00015167-00003868-00000105-79442905 "" queried SystemProcessInformation at 00015167-00003868-00000105-79476840 "" queried SystemProcessInformation at 00015167-00003868-00000105-81261411 "" queried SystemProcessInformation at 00015167-00003868-00000105-81270746 "" queried SystemProcessInformation at 00015167-00003868-00000105-81279582 "" queried SystemProcessInformation at 00015167-00003868-00000105-82749593 "" queried SystemProcessInformation at 00015167-00003868-00000105-82750557 "" queried SystemProcessInformation at 00015167-00003868-00000105-827763602a:T49e9,"23.21.150.121" Heuristic match: "IP address of the proxy (e.g. 127.0.0.1)" Heuristic match: "rpcallowip=127.0.0.1" "127.0.0.1" Heuristic match: "Send commands to node running on (default: 127.0.0.1)" "159.203.56.32" "67.205.136.224" "178.62.37.101" "92.243.23.21" "127.0.0.1:9050" Heuristic match: "Host: 127.0.0.1" Heuristic match: "/Bitfinite:1.0.0.2/" Heuristic match: ":irc.smutfairy.com 302 uBrnyQgGRn6MdYp :uBrnyQgGRn6MdYp=+uBrnyQgGRn@193.70.47.200 >UrZ" Heuristic match: ":irc.smutfairy.com 302 uBrnyQgGRn6MdYp :uBrnyQgGRn6MdYp=+uBrnyQgGRn@193.70.47.200 >UrZ^" Heuristic match: ":u3dmp3gwcjqFUCc!x325971202@46.226.57.14 QUIT :Remote host closed the connectionqUrZ" Heuristic match: ":u8rQGm3WNJM8UFJ!x738836235@139.193.136.194 QUIT :Read error: Connection reset by peertUrZC" Heuristic match: ":u7C8qGdYtHmt26K!u7C8qGdYtH@110.54.154.243 QUIT :Read error: Connection reset by peertUrZ" Heuristic match: ":u8rQGm3WNJM8UFJ!x184348729@139.193.136.194 JOIN :#Bitfinite00|UrZ\" Heuristic match: ":u7C8qGdYtHmt26K!u7C8qGdYtH@110.54.154.243 JOIN :#Bitfinite00" Heuristic match: ":uB9yYeEfkDQ6N9u!x932520387@180.191.112.89 QUIT :Read error: Connection reset by peer" Heuristic match: ":uBEpKgETVZrb8NC!x531502573@182.59.194.53 QUIT :Ping timeout: 600 seconds" Heuristic match: ":x68089223!x68089223@86.93.109.198 JOIN :#Bitfinite00" Heuristic match: ":u73tAmY65tae3Yr!u73tAmY65t@107.174.61.204 QUIT :Read error: Connection reset by peer" Heuristic match: ":uB9yYeEfkDQ6N9u!x995741260@180.191.112.89 JOIN :#Bitfinite00" Heuristic match: "Added 1 addresses from 159.203.56.32: 0 tried, 1 new" Heuristic match: "Added 1 addresses from 67.205.136.224: 0 tried, 2 new" Heuristic match: "Added 1 addresses from 178.62.37.101: 0 tried, 3 new" Heuristic match: "trying connection 178.62.37.101:3117 lastseen=75.0hrs" Heuristic match: "connected 178.62.37.101:3117" Heuristic match: "trying connection 159.203.56.32:3117 lastseen=82.5hrs" Heuristic match: "connected 159.203.56.32:3117" Heuristic match: "trying connection 67.205.136.224:3117 lastseen=115.6hrs" Heuristic match: "connected 67.205.136.224:3117" Heuristic match: "GetExternalIPbySTUN(18446744073709551615) returned 193.70.47.200 in attempt 2; Server=stun.zoiper.com" Heuristic match: "GetMyExternalIP() returned 193.70.47.200" Heuristic match: "AddLocal(193.70.47.200:3117,4)" Heuristic match: "IRC :irc.smutfairy.com 302 uBrnyQgGRn6MdYp :uBrnyQgGRn6MdYp=+uBrnyQgGRn@193.70.47.200" Heuristic match: "GetIPFromIRC() got userhost 193.70.47.200" Heuristic match: "GetIPFromIRC() returned 193.70.47.200" Heuristic match: "AddLocal(193.70.47.200:3117,3)" Heuristic match: "Added 193.70.47.200:3117 from 62.210.131.147: 0 tried, 4 new" Heuristic match: "IRC got new address: 193.70.47.200:3117" Heuristic match: "Added 121.133.11.193:3117 from 62.210.131.147: 0 tried, 5 new" Heuristic match: "IRC got new address: 121.133.11.193:3117" Heuristic match: "Added 91.125.239.72:3117 from 62.210.131.147: 0 tried, 6 new" Heuristic match: "IRC got new address: 91.125.239.72:3117" Heuristic match: "Added 180.191.112.89:3117 from 62.210.131.147: 0 tried, 7 new" Heuristic match: "IRC got new address: 180.191.112.89:3117" Heuristic match: "trying connection 91.125.239.72:3117 lastseen=0.8hrs" Heuristic match: "Added 114.125.22.187:3117 from 62.210.131.147: 0 tried, 8 new" Heuristic match: "IRC got new address: 114.125.22.187:3117" Heuristic match: "Added 109.26.14.250:3117 from 62.210.131.147: 0 tried, 9 new" Heuristic match: "IRC got new address: 109.26.14.250:3117" Heuristic match: "Added 123.21.32.148:3117 from 62.210.131.147: 0 tried, 10 new" Heuristic match: "IRC got new address: 123.21.32.148:3117" Heuristic match: "Added 124.122.221.24:3117 from 62.210.131.147: 0 tried, 11 new" Heuristic match: "IRC got new address: 124.122.221.24:3117" Heuristic match: "Added 45.56.158.67:3117 from 62.210.131.147: 0 tried, 12 new" Heuristic match: "IRC got new address: 45.56.158.67:3117" Heuristic match: "Added 138.19.231.23:3117 from 62.210.131.147: 0 tried, 13 new" Heuristic match: "IRC got new address: 138.19.231.23:3117" Heuristic match: "Added 105.157.25.100:3117 from 62.210.131.147: 0 tried, 14 new" Heuristic match: "IRC got new address: 105.157.25.100:3117" Heuristic match: "Added 24.135.181.150:3117 from 62.210.131.147: 0 tried, 15 new" Heuristic match: "IRC got new address: 24.135.181.150:3117" Heuristic match: "Added 117.0.66.131:3117 from 62.210.131.147: 0 tried, 16 new" Heuristic match: "IRC got new address: 117.0.66.131:3117" Heuristic match: "Added 110.54.154.243:3117 from 62.210.131.147: 0 tried, 17 new" Heuristic match: "IRC got new address: 110.54.154.243:3117" Heuristic match: "Added 14.102.30.9:3117 from 62.210.131.147: 0 tried, 18 new" Heuristic match: "IRC got new address: 14.102.30.9:3117" Heuristic match: "Added 203.88.145.147:3117 from 62.210.131.147: 0 tried, 19 new" Heuristic match: "IRC got new address: 203.88.145.147:3117" Heuristic match: "Added 87.243.140.145:3117 from 62.210.131.147: 0 tried, 20 new" Heuristic match: "IRC got new address: 87.243.140.145:3117" Heuristic match: "Added 5.18.207.191:3117 from 62.210.131.147: 0 tried, 21 new" Heuristic match: "IRC got new address: 5.18.207.191:3117" Heuristic match: "Added 183.80.184.49:3117 from 62.210.131.147: 0 tried, 22 new" Heuristic match: "IRC got new address: 183.80.184.49:3117" Heuristic match: "Added 185.156.175.140:3117 from 62.210.131.147: 0 tried, 23 new" Heuristic match: "IRC got new address: 185.156.175.140:3117" Heuristic match: "Added 81.100.216.147:3117 from 62.210.131.147: 0 tried, 24 new" Heuristic match: "IRC got new address: 81.100.216.147:3117" Heuristic match: "Added 42.115.71.124:3117 from 62.210.131.147: 0 tried, 25 new" Heuristic match: "IRC got new address: 42.115.71.124:3117" Heuristic match: "Added 110.54.213.232:3117 from 62.210.131.147: 0 tried, 26 new" Heuristic match: "IRC got new address: 110.54.213.232:3117" Heuristic match: "Added 107.174.61.204:3117 from 62.210.131.147: 0 tried, 27 new" Heuristic match: "IRC got new address: 107.174.61.204:3117" Heuristic match: "Added 45.121.216.250:3117 from 62.210.131.147: 0 tried, 28 new" Heuristic match: "IRC got new address: 45.121.216.250:3117" Heuristic match: "Added 31.220.86.23:3117 from 62.210.131.147: 0 tried, 29 new" Heuristic match: "IRC got new address: 31.220.86.23:3117" Heuristic match: "Added 185.93.75.4:3117 from 62.210.131.147: 0 tried, 30 new" Heuristic match: "IRC got new address: 185.93.75.4:3117" Heuristic match: "Added 95.34.222.99:3117 from 62.210.131.147: 0 tried, 31 new" Heuristic match: "IRC got new address: 95.34.222.99:3117" Heuristic match: "Added 73.183.219.106:3117 from 62.210.131.147: 0 tried, 32 new" Heuristic match: "IRC got new address: 73.183.219.106:3117" Heuristic match: "Added 192.99.110.128:3117 from 62.210.131.147: 0 tried, 33 new" Heuristic match: "IRC got new address: 192.99.110.128:3117" Heuristic match: "Added 49.145.121.236:3117 from 62.210.131.147: 0 tried, 34 new" Heuristic match: "IRC got new address: 49.145.121.236:3117" Heuristic match: "Added 73.2.7.185:3117 from 62.210.131.147: 0 tried, 35 new" Heuristic match: "IRC got new address: 73.2.7.185:3117" Heuristic match: "Added 173.79.196.217:3117 from 62.210.131.147: 0 tried, 36 new" Heuristic match: "IRC got new address: 173.79.196.217:3117" Heuristic match: "Added 113.23.24.3:3117 from 62.210.131.147: 0 tried, 37 new" Heuristic match: "IRC got new address: 113.23.24.3:3117" Heuristic match: "Added 80.211.246.145:3117 from 62.210.131.147: 0 tried, 38 new" Heuristic match: "IRC got new address: 80.211.246.145:3117" Heuristic match: "Added 36.80.21.142:3117 from 62.210.131.147: 0 tried, 39 new" Heuristic match: "IRC got new address: 36.80.21.142:3117" Heuristic match: "Added 139.192.64.63:3117 from 62.210.131.147: 0 tried, 40 new" Heuristic match: "IRC got new address: 139.192.64.63:3117" Heuristic match: "Added 139.228.49.252:3117 from 62.210.131.147: 0 tried, 41 new" Heuristic match: "IRC got new address: 139.228.49.252:3117" Heuristic match: "Added 139.193.136.194:3117 from 62.210.131.147: 0 tried, 42 new" Heuristic match: "IRC got new address: 139.193.136.194:3117" Heuristic match: "Added 66.241.169.35:3117 from 62.210.131.147: 0 tried, 43 new" Heuristic match: "IRC got new address: 66.241.169.35:3117" Heuristic match: "Added 86.94.241.135:3117 from 62.210.131.147: 0 tried, 44 new" Heuristic match: "IRC got new address: 86.94.241.135:3117" Heuristic match: "Added 81.151.11.26:3117 from 62.210.131.147: 0 tried, 45 new" Heuristic match: "IRC got new address: 81.151.11.26:3117" Heuristic match: "Added 122.54.103.178:3117 from 62.210.131.147: 0 tried, 46 new" Heuristic match: "IRC got new address: 122.54.103.178:3117" Heuristic match: "Added 178.90.31.50:3117 from 62.210.131.147: 0 tried, 47 new" Heuristic match: "IRC got new address: 178.90.31.50:3117" Heuristic match: "Added 197.210.24.45:3117 from 62.210.131.147: 0 tried, 48 new" Heuristic match: "IRC got new address: 197.210.24.45:3117" Heuristic match: "Added 103.85.196.46:3117 from 62.210.131.147: 0 tried, 49 new" Heuristic match: "IRC got new address: 103.85.196.46:3117" Heuristic match: "Added 171.101.61.67:3117 from 62.210.131.147: 0 tried, 50 new" Heuristic match: "IRC got new address: 171.101.61.67:3117" Heuristic match: "Added 105.229.213.223:3117 from 62.210.131.147: 0 tried, 51 new" Heuristic match: "IRC got new address: 105.229.213.223:3117" Heuristic match: "Added 178.84.241.89:3117 from 62.210.131.147: 0 tried, 52 new" Heuristic match: "IRC got new address: 178.84.241.89:3117" Heuristic match: "Added 36.80.140.156:3117 from 62.210.131.147: 0 tried, 53 new" Heuristic match: "IRC got new address: 36.80.140.156:3117" Heuristic match: "Added 182.59.194.53:3117 from 62.210.131.147: 0 tried, 54 new" Heuristic match: "IRC got new address: 182.59.194.53:3117" Heuristic match: "Added 4.16.182.178:3117 from 62.210.131.147: 0 tried, 55 new" Heuristic match: "IRC got new address: 4.16.182.178:3117" Heuristic match: "Added 79.116.47.112:3117 from 62.210.131.147: 0 tried, 56 new" Heuristic match: "IRC got new address: 79.116.47.112:3117" Heuristic match: "Added 122.37.185.149:3117 from 62.210.131.147: 0 tried, 57 new" Heuristic match: "IRC got new address: 122.37.185.149:3117" Heuristic match: "Added 14.202.250.84:3117 from 62.210.131.147: 0 tried, 58 new" Heuristic match: "IRC got new address: 14.202.250.84:3117" Heuristic match: "Added 176.74.241.40:3117 from 62.210.131.147: 0 tried, 59 new" Heuristic match: "IRC got new address: 176.74.241.40:3117" Heuristic match: "Added 86.93.87.40:3117 from 62.210.131.147: 0 tried, 60 new" Heuristic match: "IRC got new address: 86.93.87.40:3117" Heuristic match: "Added 86.93.109.198:3117 from 62.210.131.147: 0 tried, 61 new" Heuristic match: "IRC got new address: 86.93.109.198:3117" Heuristic match: "Added 41.77.52.44:3117 from 62.210.131.147: 0 tried, 62 new" Heuristic match: "IRC got new address: 41.77.52.44:3117" Heuristic match: "Added 77.71.186.48:3117 from 62.210.131.147: 0 tried, 63 new" Heuristic match: "IRC got new address: 77.71.186.48:3117" Heuristic match: "Added 107.172.188.197:3117 from 62.210.131.147: 0 tried, 64 new" Heuristic match: "IRC got new address: 107.172.188.197:3117" Heuristic match: "Added 124.83.102.76:3117 from 62.210.131.147: 0 tried, 65 new" Heuristic match: "IRC got new address: 124.83.102.76:3117" Heuristic match: "Added 77.205.110.3:3117 from 62.210.131.147: 0 tried, 66 new" Heuristic match: "IRC got new address: 77.205.110.3:3117" Heuristic match: "Added 195.82.104.23:3117 from 62.210.131.147: 0 tried, 67 new" Heuristic match: "IRC got new address: 195.82.104.23:3117" Heuristic match: "Added 37.147.95.249:3117 from 62.210.131.147: 0 tried, 68 new" Heuristic match: "IRC got new address: 37.147.95.249:3117" Heuristic match: "Added 84.104.132.203:3117 from 62.210.131.147: 0 tried, 69 new" Heuristic match: "IRC got new address: 84.104.132.203:3117" Heuristic match: "Added 85.150.126.21:3117 from 62.210.131.147: 0 tried, 70 new" Heuristic match: "IRC got new address: 85.150.126.21:3117" Heuristic match: "Added 93.36.166.80:3117 from 62.210.131.147: 0 tried, 71 new" Heuristic match: "IRC got new address: 93.36.166.80:3117" Heuristic match: "Added 142.167.37.104:3117 from 62.210.131.147: 0 tried, 72 new" Heuristic match: "IRC got new address: 142.167.37.104:3117" Heuristic match: "Added 103.44.51.218:3117 from 62.210.131.147: 0 tried, 73 new" Heuristic match: "IRC got new address: 103.44.51.218:3117" Heuristic match: "Added 46.226.57.14:3117 from 62.210.131.147: 0 tried, 74 new" Heuristic match: "IRC got new address: 46.226.57.14:3117" Heuristic match: "Added 88.98.203.233:3117 from 62.210.131.147: 0 tried, 75 new" Heuristic match: "IRC got new address: 88.98.203.233:3117" Heuristic match: "Added 2.39.232.119:3117 from 62.210.131.147: 0 tried, 76 new" Heuristic match: "IRC got new address: 2.39.232.119:3117" Heuristic match: "Added 194.151.101.34:3117 from 62.210.131.147: 0 tried, 77 new" Heuristic match: "IRC got new address: 194.151.101.34:3117" Heuristic match: "Added 186.95.200.40:3117 from 62.210.131.147: 0 tried, 78 new" Heuristic match: "IRC got new address: 186.95.200.40:3117" Heuristic match: "Added 59.18.217.227:3117 from 62.210.131.147: 0 tried, 79 new" Heuristic match: "ThreadNtpSamples: new offset sample from 193.79.237.14, offset=-33015." Heuristic match: "IRC got new address: 59.18.217.227:3117" Heuristic match: "Added 87.109.237.129:3117 from 62.210.131.147: 0 tried, 80 new" Heuristic match: "IRC got new address: 87.109.237.129:3117" Heuristic match: "Added 14.38.16.211:3117 from 62.210.131.147: 0 tried, 81 new" Heuristic match: "IRC got new address: 14.38.16.211:3117" Heuristic match: "Added 139.47.24.235:3117 from 62.210.131.147: 0 tried, 82 new" Heuristic match: "IRC got new address: 139.47.24.235:3117" Heuristic match: "ThreadNtpSamples: new offset sample from 146.64.58.41, offset=-33015." Heuristic match: "Added 93.75.12.234:3117 from 62.210.131.147: 0 tried, 83 new" Heuristic match: "IRC got new address: 93.75.12.234:3117" Heuristic match: "trying connection 123.21.32.148:3117 lastseen=0.9hrs" Heuristic match: "Added 75.64.218.182:3117 from 62.210.131.147: 0 tried, 84 new" Heuristic match: "IRC got new address: 75.64.218.182:3117" Heuristic match: "Added 84.112.75.7:3117 from 62.210.131.147: 0 tried, 85 new" Heuristic match: "IRC got new address: 84.112.75.7:3117" Heuristic match: "Added 185.77.243.83:3117 from 62.210.131.147: 0 tried, 86 new" Heuristic match: "IRC got new address: 185.77.243.83:3117" Heuristic match: "Added 180.190.68.120:3117 from 62.210.131.147: 0 tried, 87 new" Heuristic match: "IRC got new address: 180.190.68.120:3117" Heuristic match: "Added 24.54.165.100:3117 from 62.210.131.147: 0 tried, 88 new" Heuristic match: "IRC got new address: 24.54.165.100:3117" Heuristic match: "Added 59.3.15.147:3117 from 62.210.131.147: 0 tried, 89 new" Heuristic match: "IRC got new address: 59.3.15.147:3117" Heuristic match: "Added 198.38.93.100:3117 from 62.210.131.147: 0 tried, 90 new" Heuristic match: "IRC got new address: 198.38.93.100:3117" Heuristic match: "Added 45.35.64.39:3117 from 62.210.131.147: 0 tried, 91 new" Heuristic match: "IRC got new address: 45.35.64.39:3117" Heuristic match: "Added 165.227.41.82:3117 from 62.210.131.147: 0 tried, 92 new" Heuristic match: "IRC got new address: 165.227.41.82:3117" Heuristic match: "Added 45.55.239.120:3117 from 62.210.131.147: 0 tried, 93 new" Heuristic match: "IRC got new address: 45.55.239.120:3117" Heuristic match: "Added 188.226.200.150:3117 from 62.210.131.147: 0 tried, 94 new" Heuristic match: "IRC got new address: 188.226.200.150:3117" Heuristic match: "Added 165.227.29.191:3117 from 62.210.131.147: 0 tried, 95 new" Heuristic match: "IRC got new address: 165.227.29.191:3117" Heuristic match: "Added 52.34.135.242:3117 from 62.210.131.147: 0 tried, 96 new" Heuristic match: "IRC got new address: 52.34.135.242:3117" Heuristic match: "Moving 178.62.37.101:3117 to tried" Heuristic match: "receive version message: version 91003, blocks=88560, us=193.70.47.200:62079, them=178.62.37.101:3117, peer=178.62.37.101:3117" Heuristic match: "Moving 159.203.56.32:3117 to tried" Heuristic match: "receive version message: version 91003, blocks=88560, us=193.70.47.200:62080, them=159.203.56.32:3117, peer=159.203.56.32:3117" Heuristic match: "Moving 67.205.136.224:3117 to tried" Heuristic match: "receive version message: version 91003, blocks=88560, us=193.70.47.200:62081, them=67.205.136.224:3117, peer=67.205.136.224:3117" Heuristic match: "trying connection 59.3.15.147:3117 lastseen=0.9hrs" Heuristic match: "connected 59.3.15.147:3117" Heuristic match: "send version message: version 91003, blocks=4, us=193.70.47.200:3117, them=59.3.15.147:3117, peer=59.3.15.147:3117" Heuristic match: "trying connection 124.83.102.76:3117 lastseen=0.9hrs" Heuristic match: "trying connection 91.125.239.72:3117 lastseen=1.0hrs" Heuristic match: "Added 67.79.117.106:3117 from 62.210.131.147: 3 tried, 94 new" Heuristic match: "IRC got new address: 67.79.117.106:3117" Heuristic match: "trying connection 4.16.182.178:3117 lastseen=1.0hrs" Heuristic match: "trying connection 103.85.196.46:3117 lastseen=1.0hrs" Heuristic match: "trying connection 124.122.221.24:3117 lastseen=1.0hrs" Heuristic match: "trying connection 180.190.68.120:3117 lastseen=1.2hrs" Heuristic match: "trying connection 52.34.135.242:3117 lastseen=1.2hrs" Heuristic match: "trying connection 31.220.86.23:3117 lastseen=1.2hrs" Heuristic match: "trying connection 103.44.51.218:3117 lastseen=1.4hrs" Heuristic match: "trying connection 124.83.102.76:3117 lastseen=1.4hrs" Heuristic match: "trying connection 24.54.165.100:3117 lastseen=1.4hrs" Heuristic match: "Added 9 addresses from 159.203.56.32: 3 tried, 103 new" Heuristic match: "Added 6 addresses from 67.205.136.224: 3 tried, 109 new" Heuristic match: "Added 7 addresses from 178.62.37.101: 3 tried, 116 new" Heuristic match: "Moving 59.3.15.147:3117 to tried" Heuristic match: "receive version message: version 91003, blocks=87727, us=193.70.47.200:62084, them=59.3.15.147:3117, peer=59.3.15.147:3117" Heuristic match: "trying connection 46.226.57.14:3117 lastseen=1.4hrs" Heuristic match: "trying connection 81.100.216.147:3117 lastseen=1.6hrs" Heuristic match: "trying connection 183.80.184.49:3117 lastseen=1.6hrs" Heuristic match: "trying connection 171.101.61.67:3117 lastseen=1.6hrs" Heuristic match: "trying connection 105.157.25.100:3117 lastseen=1.8hrs" Heuristic match: "trying connection 121.133.11.193:3117 lastseen=1.8hrs" Heuristic match: "trying connection 124.83.102.76:3117 lastseen=1.8hrs"2b:T4d0,"" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\__db.80000001.7c46b5d2" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\__db.8000000a.69baa16b" with delete access "" opened "C:\ProgramData\boost_interprocess\1491694897\2050BD1CED9AD30190D92FBEED9AD3011C0F0000FFFFFFFF\" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.26af" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.c43e" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.4b1c" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.b2ef" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.7c62" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.1b99" with delete access "" opened "C:\ProgramData\boost_interprocess\1491694897\20B236D8F69AD30140E41AC2F79AD3011C0F0000FEFFFFFF\" with delete access "" opened "C:\Users\W9GQDun\AppData\Roaming\Bitfinite\peers.dat.51e5" with delete access2c:T506,RegCreateKeyExW RegCloseKey RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW RegOpenKeyExA RegDeleteValueW RegEnumKeyExW GetDriveTypeW CreateFileMappingA GetFileAttributesA FindFirstFileW GetFileAttributesW MapViewOfFileEx UnhandledExceptionFilter OpenFileMappingA GetThreadContext GetTempPathA CheckRemoteDebuggerPresent GetTempPathW OutputDebugStringW OutputDebugStringA DeviceIoControl CopyFileW GetModuleFileNameW GetVersionExA GetModuleFileNameA CreateDirectoryExW CreateThread ExitThread SleepEx LoadLibraryW GetVersionExW GetTickCount VirtualProtect LoadLibraryA GetStartupInfoA OpenProcess CreateDirectoryA DeleteFileA GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress CreateFileMappingW GetFileSizeEx FindNextFileW FindNextFileA FindFirstFileExW CreateFileW CreateFileA VirtualAllocEx GetCommandLineW MapViewOfFile GetModuleHandleA FindFirstFileA GetModuleHandleW GetFileAttributesExW WriteFile CreateProcessW Sleep TerminateProcess VirtualAlloc ShellExecuteW GetUpdateRect FindWindowW SetWindowsHookExW FindWindowExW GetWindowThreadProcessId accept WSAStartup WSASocketW recv send WSASend listen closesocket socket bind recvfrom sendto connect2d:T9be,Found malicious artifacts related to "217.10.68.152": ... URL: http://stun.sipgate.net/ (AV positives: 2/66 scanned on 01/30/2018 15:01:00) URL: http://217.10.68.152:3478/ (AV positives: 1/66 scanned on 01/21/2018 22:49:26) URL: http://stun.ideasip.com/ (AV positives: 2/66 scanned on 01/21/2018 22:22:45) URL: http://stun.faktortel.com.au/ (AV positives: 1/64 scanned on 09/26/2017 00:54:39) URL: http://stun.ekiga.net/ (AV positives: 1/65 scanned on 10/28/2015 19:41:39) File SHA256: a317ac2056c31c261c14c4171bbf0101b1eb0d3273067598213b56f75179f1bf (AV positives: 2/67 scanned on 01/16/2018 01:24:37) File SHA256: 003422656835d993cdee751cd69db0ca99d4e22b189c3bde00b7f058819ba5c6 (Date: 12/09/2017 13:10:37) File SHA256: 1fe6d7fec9c21e1fca8fba7ee3f18d2d913150f275832df041d1bf45eb4b31b5 (Date: 11/30/2017 19:44:15) File SHA256: 49760d0024736f7e4c8b7f084a85e685eb88b9e585359133ecc389dfc2de2dbc (AV positives: 1/68 scanned on 11/28/2017 18:20:29) File SHA256: a134f25a368b1fe41ceb03c3bdbe5b4e2038fbd6a93bca0f91202e1c46f4fd06 (AV positives: 2/66 scanned on 11/21/2017 03:29:46) File SHA256: 018bd76ae0447531b91f811264b27fb9e8579e6b23644a5955176c6053d4ba10 (AV positives: 25/65 scanned on 11/20/2017 08:28:06) File SHA256: 889e88ba8e82034b590d523ace16bb4a7bcdf6dffa6c3d35d1f5b56b00cebe99 (Date: 10/21/2017 10:53:32) File SHA256: abccade0022df46630516a16cbadea9350a64f16e2150bca1c46cd963a55d8c2 (Date: 10/21/2017 10:10:45) File SHA256: 63482110d9982760c1f3895087bbab3d41674c90410e6df4e7337753d6aabc0a (AV positives: 1/64 scanned on 09/08/2017 14:20:14) File SHA256: 02d9e29d34ec75a8164f839055ae960499c66125eada25178ef79201fddae87b (Date: 04/09/2017 16:33:44) Found malicious artifacts related to "193.79.237.14": ... File SHA256: 05ca26b3e22fa5194277d9cb77f837432fa12490eb002247fdb4b01c8432e401 (Date: 05/26/2015 13:46:44) File SHA256: 58d32ca5791e7e031c8ba4c99f2f20d5d8af63897f25fefc4cf99e14be40f860 (AV positives: 47/54 scanned on 04/27/2015 19:54:58) File SHA256: ad723addd04ec4898ea1c230729dda63da4a672da80aeb88af932aba110948aa (AV positives: 48/56 scanned on 04/18/2015 15:14:04) File SHA256: 54cc5c300d794759acec4f1317d5c9ca03f26ff370b7d3df4c15430bfbffe5ec (AV positives: 47/56 scanned on 04/17/2015 15:15:15) File SHA256: dc5a344154c1490bb9e55f176480fdfa2e837a1c6ebaff0e044dd43a30415cdc (AV positives: 46/55 scanned on 11/18/2014 23:16:04) File SHA256: 6a915f1b04e2aa88994dd499b4711f50886716aa51351a29dd609581125ef687 (AV positives: 44/53 scanned on 11/03/2014 20:26:00)2e:T9be,Found malicious artifacts related to "217.10.68.152": ... URL: http://stun.sipgate.net/ (AV positives: 2/66 scanned on 01/30/2018 15:01:00) URL: http://217.10.68.152:3478/ (AV positives: 1/66 scanned on 01/21/2018 22:49:26) URL: http://stun.ideasip.com/ (AV positives: 2/66 scanned on 01/21/2018 22:22:45) URL: http://stun.faktortel.com.au/ (AV positives: 1/64 scanned on 09/26/2017 00:54:39) URL: http://stun.ekiga.net/ (AV positives: 1/65 scanned on 10/28/2015 19:41:39) File SHA256: a317ac2056c31c261c14c4171bbf0101b1eb0d3273067598213b56f75179f1bf (AV positives: 2/67 scanned on 01/16/2018 01:24:37) File SHA256: 003422656835d993cdee751cd69db0ca99d4e22b189c3bde00b7f058819ba5c6 (Date: 12/09/2017 13:10:37) File SHA256: 1fe6d7fec9c21e1fca8fba7ee3f18d2d913150f275832df041d1bf45eb4b31b5 (Date: 11/30/2017 19:44:15) File SHA256: 49760d0024736f7e4c8b7f084a85e685eb88b9e585359133ecc389dfc2de2dbc (AV positives: 1/68 scanned on 11/28/2017 18:20:29) File SHA256: a134f25a368b1fe41ceb03c3bdbe5b4e2038fbd6a93bca0f91202e1c46f4fd06 (AV positives: 2/66 scanned on 11/21/2017 03:29:46) File SHA256: 018bd76ae0447531b91f811264b27fb9e8579e6b23644a5955176c6053d4ba10 (AV positives: 25/65 scanned on 11/20/2017 08:28:06) File SHA256: 889e88ba8e82034b590d523ace16bb4a7bcdf6dffa6c3d35d1f5b56b00cebe99 (Date: 10/21/2017 10:53:32) File SHA256: abccade0022df46630516a16cbadea9350a64f16e2150bca1c46cd963a55d8c2 (Date: 10/21/2017 10:10:45) File SHA256: 63482110d9982760c1f3895087bbab3d41674c90410e6df4e7337753d6aabc0a (AV positives: 1/64 scanned on 09/08/2017 14:20:14) File SHA256: 02d9e29d34ec75a8164f839055ae960499c66125eada25178ef79201fddae87b (Date: 04/09/2017 16:33:44) Found malicious artifacts related to "193.79.237.14": ... File SHA256: 05ca26b3e22fa5194277d9cb77f837432fa12490eb002247fdb4b01c8432e401 (Date: 05/26/2015 13:46:44) File SHA256: 58d32ca5791e7e031c8ba4c99f2f20d5d8af63897f25fefc4cf99e14be40f860 (AV positives: 47/54 scanned on 04/27/2015 19:54:58) File SHA256: ad723addd04ec4898ea1c230729dda63da4a672da80aeb88af932aba110948aa (AV positives: 48/56 scanned on 04/18/2015 15:14:04) File SHA256: 54cc5c300d794759acec4f1317d5c9ca03f26ff370b7d3df4c15430bfbffe5ec (AV positives: 47/56 scanned on 04/17/2015 15:15:15) File SHA256: dc5a344154c1490bb9e55f176480fdfa2e837a1c6ebaff0e044dd43a30415cdc (AV positives: 46/55 scanned on 11/18/2014 23:16:04) File SHA256: 6a915f1b04e2aa88994dd499b4711f50886716aa51351a29dd609581125ef687 (AV positives: 44/53 scanned on 11/03/2014 20:26:00)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/+B///8AD//8DwP/8H/w/+H//H/H//4/j///H5///58f///OP///xj8OD+Z8DAPkfPnz4Hn5+fD5+fnw+fn58Pn5+fD5+fnwefn58Hz58+J8AwPmPgYH5j///8cf///PH///j4///x/H//4/4f/4f/B/8P/4DwH//gAH///AP/w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1791658846607,"unified_at":"2026-10-10T19:00:46.607Z","metadata":{"hashes":{"sha256":"28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340","sha1":"0b6c6e23509ecb4643f60dae75561d90252a62f2","md5":"341b6986197bc77a866be0aea4e45c54","sha512":"3c5b659b40b35c884bd5cdd651f9842b973c60eea27dec2da8f0215b630dd8d1902824f89d9f261f3be3f346d7d9c1c62694ff0ba4a1e0169aeeb3f6283f837f","ssdeep":"393216:Q9N7b+KH9CPwiya3U2KXBRzHn3YF5CApz8U+0Jsv6tWKFdu9CC:M9p38OjZ","ssdeep_chunks":["393216:Q9N7b+K","393216:9N7b+KH","393216:N7b+KH9","393216:7b+KH9C","393216:b+KH9CP","393216:+KH9CPw","393216:KH9CPwi","393216:H9CPwiy","393216:9CPwiya","393216:CPwiya3","393216:Pwiya3U","393216:wiya3U2","393216:iya3U2K","393216:ya3U2KX","393216:a3U2KXB","393216:3U2KXBR","393216:U2KXBRz","393216:2KXBRzH","393216:KXBRzHn","393216:XBRzHn3","393216:BRzHn3Y","393216:RzHn3YF","393216:zHn3YF5","393216:Hn3YF5C","393216:n3YF5CA","393216:3YF5CAp","393216:YF5CApz","393216:F5CApz8","393216:5CApz8U","393216:CApz8U+","393216:Apz8U+0","393216:pz8U+0J","393216:z8U+0Js","393216:8U+0Jsv","393216:U+0Jsv6","393216:+0Jsv6t","393216:0Jsv6tW","393216:Jsv6tWK","393216:sv6tWKF","393216:v6tWKFd","393216:6tWKFdu","393216:tWKFdu9","393216:WKFdu9C","393216:KFdu9CC","786432:Q9N7b+K","786432:9N7b+KH","786432:N7b+KH9","786432:7b+KH9C","786432:b+KH9CP","786432:+KH9CPw","786432:KH9CPwi","786432:H9CPwiy","786432:9CPwiya","786432:CPwiya3","786432:Pwiya3U","786432:wiya3U2","786432:iya3U2K","786432:ya3U2KX","786432:a3U2KXB","786432:3U2KXBR","786432:U2KXBRz","786432:2KXBRzH","786432:KXBRzHn","786432:XBRzHn3","786432:BRzHn3Y","786432:RzHn3YF","786432:zHn3YF5","786432:Hn3YF5C","786432:n3YF5CA","786432:3YF5CAp","786432:YF5CApz","786432:F5CApz8","786432:5CApz8U","786432:CApz8U+","786432:Apz8U+0","786432:pz8U+0J","786432:z8U+0Js","786432:8U+0Jsv","786432:U+0Jsv6","786432:+0Jsv6t","786432:0Jsv6tW","786432:Jsv6tWK","786432:sv6tWKF","786432:v6tWKFd","786432:6tWKFdu","786432:tWKFdu9","786432:WKFdu9C","786432:KFdu9CC","393216:M9p38Oj","393216:9p38OjZ"],"imphash":"3fb83965aac9fcbcffbfac6ada5be5ca"},"file_info":{"file_name":"Bitfinite-QT-(Windows).zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":23079936,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1517410405000,"last_seen":1660598594000,"last_multi_scan":1660598594000}},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":12,"malicious_count":6,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/Bitcoin-CA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"App/Bitcoin","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$24","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)\" (SID: 2018908, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"tick.meraka.csir.co.za\"\n \"stun.qvod.com\"\n \"0.au.pool.ntp.org\"\n \"irc.lfnet.org\"\n \"stun.zoiper.com\"\n \"ntp2.nl.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"115.231.216.13:3478\"\n \"62.210.131.147:6667\"\n \"103.38.120.36:123\"\n \"178.62.37.101:3117\"\n \"159.203.56.32:3117\"\n \"67.205.136.224:3117\"\n \"217.10.68.152:3478\"\n \"91.125.239.72:3117\"\n \"193.79.237.14:123\"\n \"146.64.58.41:123\"\n \"123.21.32.148:3117\"\n \"59.3.15.147:3117\"\n \"124.83.102.76:3117\"\n \"4.16.182.178:3117\"\n \"103.85.196.46:3117\"\n \"124.122.221.24:3117\"\n \"180.190.68.120:3117\"\n \"52.34.135.242:3117\"\n \"31.220.86.23:3117\"\n \"103.44.51.218:3117\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"__db.8000000a.69baa16b\" has type \"Berkeley DB (Btree version 9 native byte-order)\"\n \"peers.dat.26af\" has type \"data\"\n \"peers.dat.1b99\" has type \"data\"\n \"peers.dat.c43e\" has type \"data\"\n \"__db.80000001.7c46b5d2\" has type \"Berkeley DB (Btree version 9 native byte-order)\"\n \"wallet.dat\" has type \"Berkeley DB (Btree version 9 native byte-order)\"\n \"blkindex.dat\" has type \"Berkeley DB (Btree version 9 native byte-order)\"\n \"debug.log\" has type \"ASCII text with very long lines with CRLF CR line terminators\"\n \"BitfiniteURI\" has type \"data\"\n \"peers.dat.7c62\" has type \"data\"\n \"peers.dat.4b1c\" has type \"data\"\n \"blk0001.dat\" has type \"dBase III DBT version number 0 next free block index 1306867503 1st item \"\\377\\377\\377\\377\"\"\n \"peers.dat.51e5\" has type \"data\"\n \"peers.dat.b2ef\" has type \"data\"\n \"Bitfinite.conf\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00015167-00003868-00000105-43053734","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$29","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vboxLayout\" (Indicator: \"vbox\")\n \"vboxLayout1\" (Indicator: \"vbox\")\n \"vboxLayout2\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 115.231.216.13\"\n \"UDP connection to 103.38.120.36\"\n \"UDP connection to 217.10.68.152\"\n \"UDP connection to 193.79.237.14\"\n \"UDP connection to 146.64.58.41\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2a","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instsant messenger related domain","description":"\"stun.voip.blackberry.com\" (Indicator: \"blackberry.com\"; File: \"Bitfinite-qt.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2b","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2c","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"Bitfinite-qt.exe.bin\" claims program is from Fri Sep 5 10:03:13 2031","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (often used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":5,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 27 (or more) hosts in at least 17 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Network Related","name":"Sends network traffic on a port typically used by IRC","description":"\"IRC traffic to 62.210.131.147 on port 6667","origin":"Network Traffic","relevance":6,"id":"network-13","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 62.210.131.147 on port 6667\n TCP traffic to 178.62.37.101 on port 3117\n TCP traffic to 159.203.56.32 on port 3117\n TCP traffic to 67.205.136.224 on port 3117\n TCP traffic to 91.125.239.72 on port 3117\n TCP traffic to 123.21.32.148 on port 3117\n TCP traffic to 59.3.15.147 on port 3117\n TCP traffic to 124.83.102.76 on port 3117\n TCP traffic to 4.16.182.178 on port 3117\n TCP traffic to 103.85.196.46 on port 3117\n TCP traffic to 124.122.221.24 on port 3117\n TCP traffic to 180.190.68.120 on port 3117\n TCP traffic to 52.34.135.242 on port 3117\n TCP traffic to 31.220.86.23 on port 3117\n TCP traffic to 103.44.51.218 on port 3117\n TCP traffic to 24.54.165.100 on port 3117\n TCP traffic to 46.226.57.14 on port 3117\n TCP traffic to 81.100.216.147 on port 3117\n TCP traffic to 183.80.184.49 on port 3117\n TCP traffic to 171.101.61.67 on port 3117\n TCP traffic to 105.157.25.100 on port 3117\n TCP traffic to 121.133.11.193 on port 3117","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":90,"imported_dlls_count":99,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":44,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":27,"dns_resolutions_count":6,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5a71d6167ca3e14d2f319086","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"undetected","threat_score":75,"contacted_countries":["AUS","BGD","CHN","DEU","ESP","EU","FRA","GBR","IND","KOR","MAR","NLD","PHL","THA","USA","VNM","ZAF"],"submit_name":"Bitfinite-QT-(Windows).zip","analysis_start_time":"2018-01-31T15:43:18+00:00","indicators_count":{"informative":13,"suspicious":21,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"115.231.216.13","port":3478,"protocol":"UDP","country":"China","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"62.210.131.147","port":6667,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"103.38.120.36","port":123,"protocol":"UDP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"178.62.37.101","port":3117,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"159.203.56.32","port":3117,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"67.205.136.224","port":3117,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"217.10.68.152","port":3478,"protocol":"UDP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"91.125.239.72","port":3117,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"193.79.237.14","port":123,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"146.64.58.41","port":123,"protocol":"UDP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"123.21.32.148","port":3117,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"59.3.15.147","port":3117,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"124.83.102.76","port":3117,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"4.16.182.178","port":3117,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"103.85.196.46","port":3117,"protocol":"TCP","country":"Bangladesh","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"124.122.221.24","port":3117,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"180.190.68.120","port":3117,"protocol":"TCP","country":"Philippines","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"52.34.135.242","port":3117,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"31.220.86.23","port":3117,"protocol":"TCP","country":"Spain","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"103.44.51.218","port":3117,"protocol":"TCP","country":"India","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"24.54.165.100","port":3117,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"46.226.57.14","port":3117,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"81.100.216.147","port":3117,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"183.80.184.49","port":3117,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"171.101.61.67","port":3117,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"105.157.25.100","port":3117,"protocol":"TCP","country":"Morocco","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"address":"121.133.11.193","port":3117,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"dns_resolutions":[{"domain":"tick.meraka.csir.co.za","country":"-","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"domain":"stun.qvod.com","address":"115.231.216.13","country":"China","registrar_name":"XINNET TECHNOLOGY CORPORATION","registrar_organization":"shenzhenshikuaibokejiyouxiangongsi","registrar_creation_date":"2002-07-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"domain":"0.au.pool.ntp.org","address":"130.95.13.1","country":"Australia","registrar_name":"Tucows Inc.","registrar_organization":"Network Time Foundation","registrar_name_servers":"DNS1.UDEL.EDU","registrar_creation_date":"1997-01-18T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"domain":"irc.lfnet.org","country":"-","registrar_name":"GKG.NET, INC.","registrar_organization":"Lilo Free Network","registrar_name_servers":"NS1.ACCUDNS.NET","registrar_creation_date":"2001-12-18T15:06:46+00:00","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"domain":"stun.zoiper.com","address":"217.10.68.152","country":"Germany","registrar_name":"Eurodns S.A.","registrar_creation_date":"2006-10-01T10:16:05+00:00","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"domain":"ntp2.nl.net","address":"193.79.237.14","country":"Netherlands","registrar_name":"NETWORK SOLUTIONS, LLC.","registrar_organization":"Verizon Deutschland GmbH","registrar_name_servers":"AUTH101.NS.UU.NET","registrar_creation_date":"1993-04-07T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}],"processes":[{"pid":3868,"ppid":0,"name":"Bitfinite-qt.exe","command_line":"","sha256":"28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340","normalized_path":"C:\\Bitfinite-qt.exe","uid":"00015167-00003868","icon":"$2f"}],"all_imported_dlls":["msvcr90.dll","rasman.dll","dnsapi.dll","sechost.dll","rpcss.dll","utildll.dll","tapiperf.dll","clusapi.dll","profapi.dll","msctf.dll","shell32.dll","shlwapi.dll","WSHTCPIP.DLL","ntmarta.dll","nlaapi.dll","wbemcomn.dll","cryptsp.dll","mscoree.dll","FWPUCLNT.DLL","CORPerfMonExt.dll","secur32.dll","perfdisk.dll","browcli.dll","wship6.dll","sysmain.dll","advapi32.dll","user32.dll","OLMAPI32.DLL","devobj.dll","dwmapi.dll","msvcr120_clr0400.dll","Aspnet_perf.dll","comctl32.dll","winnsi.dll","netapi32.dll","netutils.dll","rasctrs.dll","imm32.dll","winmm.dll","uxtheme.dll","mscoreei.dll","PerfCounter.dll","aspnet_counters.dll","cfgmgr32.dll","usbperf.dll","pnrpnsp.dll","esentprf.dll","resutils.dll","version.dll","perfproc.dll","perfctrs.dll","KernelBase.dll","rpcrt4.dll","clbcatq.dll","netfxperf.dll","rasadhlp.dll","msdtcprx.dll","bcrypt.dll","winsta.dll","perfos.dll","mswsock.dll","nsi.dll","pcwum.dll","pdh.dll","loadperf.dll","IPHLPAPI.DLL","mtxclu.dll","wtsapi32.dll","lpk.dll","RpcRtRemote.dll","NapiNSP.dll","bitsperf.dll","atl.dll","cryptdll.dll","ktmw32.dll","wkscli.dll","kernel32.dll","msvcrt.dll","ole32.dll","oleaut32.dll","perfts.dll","srvcli.dll","setupapi.dll","WmiApRpl.dll","ntdll.dll","rsaenh.dll","cryptbase.dll","Wldap32.dll","perfnet.dll","usp10.dll","ws2_32.dll","msvcp90.dll","tquery.dll","winrnr.dll","msscntrs.dll","logoncli.dll","samcli.dll","gdi32.dll","msdtcuiu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"peers.dat.51e5","sha256":"fe514a382329f9678657141b43dcc41206c6a13d95296674a9856f78c9511a06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.7c62","sha256":"fe514a382329f9678657141b43dcc41206c6a13d95296674a9856f78c9511a06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"BitfiniteURI","sha256":"bd50e12c55dda3ee443c1cb6d71c7bcf6351c4ec96f7bc8d6adec015d1192eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Bitfinite.conf","sha256":"122bff47667e823af4c37ef2deabe7e405df3fa6e9dc6adc3fdfe0ebdda5c571","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"__db.80000001.7c46b5d2","sha256":"dfd42d871f8fbb8b44426edcb7329793dbe1347f8aa84b029604eb2ed5dde5e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"__db.8000000a.69baa16b","sha256":"3788a53cc4479a7b449f708fc51c47111f85a4b5106cb32326b878a3658fc951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"blk0001.dat","sha256":"1b407ba049d6a1ec9a6da95b9efeae376285e07a8f4b528b49d0deeb7945d354","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"blkindex.dat","sha256":"4260b2960fca67c1bc36c7836512a228be3970a29b1436ae42607cb04664febc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"debug.log","sha256":"36fc19a132a12a5ef8553beefd8209cb872cd9f84555cf1b1c7bf452fe41f911","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.1b99","sha256":"fe514a382329f9678657141b43dcc41206c6a13d95296674a9856f78c9511a06","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.26af","sha256":"865684830523138db9e8606268a9a8ba3bb131acf5949bcea09bf88e1ea3cba2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.4b1c","sha256":"c47c5ce9067c2e837a8aaf68549bb86cacc8d603ea76b0b9ee9f385360cdc72f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.b2ef","sha256":"c47c5ce9067c2e837a8aaf68549bb86cacc8d603ea76b0b9ee9f385360cdc72f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"peers.dat.c43e","sha256":"6f9e7935d21a32882e4c7f62b9b55cc84daf113cb0b55377e57ee3a0459c309d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"wallet.dat","sha256":"77db5f3ad7f07350dadb70d4a80aca0c171cec6a8e9265d8763c167d16a61a85","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\Bitfinite.conf","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\.lock","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\debug.log","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\database","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\db.log","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\DB_CONFIG","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\__db.001","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\database\\log.0000000001","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\Users\\W9GQDun","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\__db.80000001.7c46b5d2","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\blkindex.dat","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\blk0001.dat","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\__db.8000000a.69baa16b","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\wallet.dat","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\.config","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\Bitfinite-qt.exe.config","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"C:\\Bitfinite-qt.exe","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%APPDATA%\\Bitfinite\\peers.dat","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%ALLUSERSPROFILE%\\boost_interprocess\\1491694897\\BitfiniteURI","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%ALLUSERSPROFILE%\\boost_interprocess","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"path":"%ALLUSERSPROFILE%\\boost_interprocess\\1491694897","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\BITFINITE\\BITFINITE-QT\\","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"key":"HKCU\\SOFTWARE\\BITFINITE\\","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_4.0.30319_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\aspnet_state_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Lsa_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSSCNTRS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Instance: ESENT Performance Data Schema Version 85","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MSDTC_STATS_EVENT","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"PerfNet_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"PerfDisk_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"PerfOS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"BITS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"RemoteAccess_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"PerfProc_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"UGTHRSVC_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Global\\MSDTC_STATS_EVENT","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Global\\Instance: ESENT Performance Data Schema Version 85","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"aspnet_state_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"WmiApRpl_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"MSDTC_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ASP.NET_4.0.30319_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"rdyboost_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"TermService_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET Memory Cache 4.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"usbhub_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET CLR Networking_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET CLR Data_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET Data Provider for SqlServer_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Tcpip_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Outlook_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"UGatherer_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ASP.NET_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"TapiSrv_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NETFramework_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Spooler_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"WSearchIdxPi_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"MSSCNTRS_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Lsa_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":".NET Data Provider for Oracle_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ESENT_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_f1c","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"bipc_gmap_sem_lock_3868_13161915841.594000","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"Global\\LOADPERF_MUTEX","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\LOADPERF_MUTEX","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\bipc_gmap_sem_lock_3868_13161915841.594000","sources":[{"report_type":"sandbox","report_id":"5a71d6167ca3e14d2f319086"}]}]}},"report_ids":{"sandbox_job_ids":["5a71d6167ca3e14d2f319086"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Suspicious App/Bitcoin Sample 28e15c25926d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 28e15c25926d…. Malware family: App/Bitcoin. Threat score 70/100. 1/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340"}],["$","meta","4",{"property":"og:title","content":"Suspicious App/Bitcoin Sample 28e15c25926d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 28e15c25926d…. Malware family: App/Bitcoin. Threat score 70/100. 1/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/28e15c25926dcd1a149ff0b6e7adb8f92638259fe9b5d111467de7c020582340"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious App/Bitcoin Sample 28e15c25926d… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 28e15c25926d…. Malware family: App/Bitcoin. Threat score 70/100. 1/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]