26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AdWare.NSIS.TornTV Sample 30ffe7ce28f7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 30ffe7ce28f7…. Malware family: AdWare.NSIS.TornTV. Threat score 100/100. 8/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68","keywords":["Malicious","AdWare.NSIS.TornTV","malware analysis","sandbox report","threat intelligence","30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68"],"about":{"@type":"SoftwareApplication","name":"Virus.xor","applicationCategory":["peexe","executable"],"identifier":"30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AdWare.NSIS.TornTV","antivirusDetections":{"malicious":8,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5de,"NSISdl.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "accept1.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "skip.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "FLVPlayer.lnk" has type "MS Windows shortcut Item id list present Has Relative path Has Working directory ctime=Mon Jan 1 00:06:32 1601 mtime=Mon Jan 1 00:06:32 1601 atime=Mon Jan 1 00:06:32 1601 length=0 window=hide" "brcdt.txt" has type "ASCII text with CRLF line terminators" "accept.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "1clogo.bmp" has type "PC bitmap Windows 3.x format 640 x 62 x 24" "accept0.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "load_4.bmp" has type "PC bitmap Windows 3.x format 14 x 14 x 24" "accept3.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "nssE3B3.tmp" has type "data" "inetc3.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "stage2" has type "ASCII text with no line terminators" "decline.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "back.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "uninst.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive" "accept2.bmp" has type "PC bitmap Windows 3.x format 161 x 34 x 24" "gC0" has type "HTML document ASCII text with very long lines with CRLF line terminators" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"28:Te15,Pattern match: "http://nsis.sf.net/NSIS_Error" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Heuristic match: "I=CH>>=,8<$R!R{@yx@C.C.Cg" Pattern match: "r.rm/rayf:r.r$r-roG" Pattern match: "http://www.hd-plugins.com/terms.htmhttp://www.hd-plugins.com/privacy.htmhttp://www.gnu.org/licenses/gpl.html0x00F0user32::GetWindowText" Pattern match: "www.mystartsearch.com/license_agreement.htmlhttp://www.mystartsearch.com/privacy_policy.htmlhttp://www.v9.com/license_agreement.htmlhttp://www.v9.com/privacy_policy.htmlhttp://en.hao123.com/about.html#disclaimerhttp://security.baidu.co.th/en/policy.php300C" Pattern match: "http://www..comhttp://www..com/eula.htmluser32::LoadImage" Pattern match: "http://www.sien.com/contact/http://www..com/Corporate/Termshttp://www..com/service/iminentappBabYour" Heuristic match: "Please review and install this special offer from Only SearchInstall FLVPlayer and Only Search Toolbar. Only Search is a popular free toolbar designed to make browsing and searching the internet faster and easier! I allow Only Search to be my homepage, sea" Pattern match: "http://valueapps..com/CT3310511/privacyopen" Pattern match: "SEARCH-SECURE.COM/privacy.htmWSSEARCH" Pattern match: "http://www..com/spabout.htmlopen" Heuristic match: "Please read the following important information and terms before continuing.\wslic.rtf320Install Search Protect to set my home page and default search to Bing Search for Internet Explorer, Firefox, and Chrome, and prevent third parties from changing my bro" Pattern match: "http://www.qwtbx.com/termsopen" Pattern match: "http://security.baidu.co.th/en/policy.phpSVB\Decline.bmpInstall" Pattern match: "www.AllDaySavings.com/EULA.phpopen" Pattern match: "www.beamrise.com/Legal/Eulaopen" Pattern match: "www.freeridegames.com/http://www.freeridegames.com/do/general?Partner=Default&jspName=licenseAgreementhttp://www.freeridegames.com/do/general?partner=Default&jspName=privacyBUDuser32::LoadImage" Pattern match: "http://PacFunction.info/Termsopen" Pattern match: "costmin.info/termsofuse.htmlopen" Pattern match: "soft.yandex.ru/distribution/GPYGophoto.it" Pattern match: "http://www.yontoo.com/TermsOfService.aspxhttp://www.pricemeter.net/eula/open" Pattern match: "http://wxpoint.ru/licenseopen" Pattern match: "http://support.microsoft.com/kb/290301" Pattern match: "http://info.trovi.com/Eula" Pattern match: "http://info.trovi.com/Privacy" Pattern match: "http://info.trovi.com/searchprotect/about" Pattern match: "http://info.trovi.com/searchprotect/uninstall" Pattern match: "http://www.whitesmoke.com/speula.html" Pattern match: "http://www.whitesmoke.com/spabout.html" Pattern match: "http://www.whitesmoke.com/spuninstall.html" Pattern match: "WWW...######444" Pattern match: "https://+t.agent,e.parentNode.insertBefore(n,e)}}function" Pattern match: "http://infopackinst.com/process/route/1775890316.html" Pattern match: "http://infopackinst.com/process/route/1775890316.html?refresh=noscript" Pattern match: "http://infopackinst.com/process/route/1775890316.html?refresh=meta"29:T1409,"* Des tonnes de Smileys, un Videochat dlirant : Beamrise ajoute des peps votre vie!Dfinir Beamrise comme navigateur par dfautAjouter des raccourcis mon bureau pour un accs direct facebook.com et pinterest.comAjouter Iminent sur le navigateur Beamrise ( en savoir plus ) avec des moticnes gratuits sur mes sites prfrs279293464332en savoir pluspolitique de confidentialitEn installant Beamrise, vous reconnaissez avoir lu et accept la politique de confidentialit et EULA, vous autorisez Beamrise dsactiver certains lments de logiciels incompatibles, et vous informer des mises jour de lapplication et des nouveaux contenus disponibles. Edit par Sien. En installant Iminent sur Beamrise, vous reconnaissez avoir lu et accept la politique de confidentialit et EULA. ar bo bz cl co do ec es gt mx pa pe pr py uy ve hn sv Beamrise: Permanezca conectado.Ms informacin* Descubra lo mejor de la web. Beamrise es rapido y 100% seguro!" (Indicator: "facebook.com") "que le proponemos!Hacer Beamrise mi navegador principalCrear iconos de acceso directo en mi escritorio para acceder a Facebook.com y pinterest.comAadir Iminent al navegador Beamrise ( ms informacin ) para tener acceso a miles de emoticonos gratuitos en mis sitios favoritos259428543515ms informacinpoltica de privacidadInstalando Beamrise usted certifica haber ledo y comprendido nuestro documento de poltica de privacidad y EULA. Tambin autoriza a Beamrise a desactivar ciertos elementos de programas que no son compatibles con Beamrise y a notificarle cuando el programa puede ser actualizado y cuando haya nuevo contenido. Proporcionado por SIEN. Cuando instala Iminent en su navegador Beamrise, usted indica estar de acuerdo con la poltica de privacidad y EULA. pt br Beamrise: Voc sempre ligado na web.Saiba mais* Descubra o melhor da web. Beamrise super rpido e seguro!" (Indicator: "facebook.com") "* Curta ainda mais o seu navegador usando o divertido vdeo chat e milhares de smileys!Definir Beamrise como meu navegador padroCriar atalhos na rea de trabalho para acesso direto ao facebook.com e pinterest.comAdicionar Iminent ao navegador Beamrise ( saiba mais ), obtendo emoticons gratuitos nos meus sites favoritos277478419saiba maispoltica de privacidadeAo instalar Beamrise, voc confirma que leu e aceitou a poltica de privacidade e o EULA. Voc tambm aceita que Beamrise desative alguns elementos de programas incompatveis e notifique-o sobre atualizaes e novos contedos disponveis. Desenvolvido por Sien." (Indicator: "facebook.com") "* Der Videochat mit seinen lustigen Smileys wird Ihre Browsing-Erfahrungen verbessern.Beamrise als Standardbrowser festlegenDesktopverknpfungen fr einen direkten Zugang auf facebook.com und pinterest.com erstellenIminent in Beamrise Browser installieren ( mehr dazu ) fr gratis Emoticons auf meinen Lieblingsseiten266387527mehr dazuDatenschutzrichtlinieMit der Installation von Beamrise stimmen Sie der Datenschutzrichtlinie und der EULA zu. Zudem erlauben Sie Beamrise einige Elemente inkompatibler Software zu deaktivieren und Sie ber neue Updates und neuen Inhalt zu informieren. Powered by Sien. Indem Sie Iminent in Beamrise installieren, stimmen Sie der Datenschutzrichtlinie und der EULA zu. it Beamrise: Un modo veloce per navigare sul webPer saperne di pi* Scoprite il meglio che il web vi mette a disposizione. Beamrise veloce come un fulmine e" (Indicator: "facebook.com") "* Migliorate la vostra esperienza sul web con una Videochat divertentissima e migliaia di smileys.Impostate Beamrise come browser predefinitoCreate delle scorciatoie sul desktop per un accesso rapido a facebook.com e pinterest.comAggiungete Iminent al browsers Beamrise ( per saperne di pi ) per ottenere emoticons gratis integrate ai vostri siti web preferit91479437per saperne di pipolitica sulla privacyInstallando Beamrise, confermate di aver letto e compreso la politica sulla privacy ed i termini dellEULA. Inoltre consentite a Beamrise di disattivare alcuni elementi di software incompatibili e di informarvi sui nuovi contenuti disponibili." (Indicator: "facebook.com") "thousands of smileys.Set Beamrise as my default browserCreate desktop shortcuts for direct access tofacebook.comandpinterest.comAdd Iminent to Beamrise ( learn more ) for thousands of free emoticons on my favorite web siteslearn more493352441By installing Beamrise, you acknowledge that you have read and understood the privacy policy and EULA terms. You also agree to let Beamrise disable some elements of incompatible software and notify you of updates and new available content." (Indicator: "facebook.com") "All payment information whether it is by an advertiser or publisher will be through a bank wire transfer or confined to an online transaction gateway on the Site through (PayPal) and governed by their collection practices. Therefore QwertyBox has no other affiliation with (PayPal) except for transactions, nor any affiliation with any third party links or financial facilities. We may gather additional personal or non-personal information in the future and/or change and add additional payment methods." (Indicator: "paypal")2a:T74c,"" wrote 11264 bytes starting with PE header signature to file "%TEMP%\nsuE404.tmp\System.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 14848 bytes starting with PE header signature to file "%TEMP%\nsuE404.tmp\NSISdl.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 16384 bytes starting with PE header signature to file "%TEMP%\nsuE404.tmp\inetc3.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 9728 bytes starting with PE header signature to file "%TEMP%\nsuE404.tmp\nsDialogs.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000d80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 47104 bytes starting with PE header signature to file "C:\Program Files\FLVPlayer\uninst.exe": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000d80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...2b:Tb7a,"C:\Virus.xor.exe" marked "%TEMP%\nsyE39E.tmp" for deletion "C:\Virus.xor.exe" marked "%TEMP%\nsuE404.tmp" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\desktop.ini" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\000[1].gif" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_logo_ad[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_treppenlift_lila_300x169[1].jpg" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\26-2e9702-f30905ea[1]" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\4f1880[1].ico" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\5a7873a1-fd4e-4462-8ab2-32bd729117c6_7[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\93e33485-fea3-4687-a642-2c5dd233522f_12[1].eot" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\973841[1].eot" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA3e3XC[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42ckd[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42eXy[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[2].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61AKN[2].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[1].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[2].png" for deletion "C:\Virus.xor.exe" marked "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA7XCQ3[1].png" for deletion2c:Tb7a,"" opened "%TEMP%\nsyE39E.tmp" with delete access "" opened "%TEMP%\nsuE404.tmp" with delete access "" opened "%TEMP%\nsuE404.tmp\trninj.txt" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\desktop.ini" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\000[1].gif" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_logo_ad[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_treppenlift_lila_300x169[1].jpg" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\26-2e9702-f30905ea[1]" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\4f1880[1].ico" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\5a7873a1-fd4e-4462-8ab2-32bd729117c6_7[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\93e33485-fea3-4687-a642-2c5dd233522f_12[1].eot" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\973841[1].eot" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA3e3XC[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42ckd[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42eXy[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[2].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61AKN[2].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[1].png" with delete access "" opened "C:\Users\VlSMZ1e\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[2].png" with delete access2d:T188d,Found malicious artifacts related to "23.253.126.58" (ASN: 33070, Owner: Rackspace Hosting): ... URL: http://dld.oinst02.eu/installer/Files/799/318/613be09bf82f963642df6daebe0c1/Foofind-Download-Manager_0.3-20140421.exe (AV positives: 4/68 scanned on 11/30/2016 19:39:48) URL: http://sagecreekranchliving.com/favicon.ico (AV positives: 1/68 scanned on 11/30/2016 19:31:13) URL: http://dnsdomainhost.ws/ (AV positives: 2/68 scanned on 11/30/2016 19:23:57) URL: http://level-user.net/hp/?q=xoWEeUMFgwBJTIYmjlwUULgP6692itwtS%2BCeAXs0d8X1mUjhye4Uzuv4hXYHbknGpOjcCqTZLkY7FnNZYgs%2F%2BpqEtRlL9cl8p%2BZAfiMoe99zq1pM%2BjDhJRvMjrpeDbTN9JAAfj1US9nT225uwvcQZ6iwyjigtRw7ApPgOaUx7GNbAn14QlMsvsil1HcPzU%2FsgQfSvPpKijs956gv9VelEijo%2FClYAVr79dt2eCZp%2BEwAV36EA0hqNG7YL%2FH0mhRKI6nHxkrEZ1faCH2F4UiR2PUPjDhGZ7KbSQl4wENsEe580eJiZveyY0TgHlO0%2B9Bb%2B9VDxYRjRL0eSA6zdUhSt7ljBe8J8TgNyCgdNb1l5W20Gkwv%2FCiY0iMeQBpkSENZhFZQAxhvkSQLGHJd2VrcGaH65YYtvdQrTQZOnpBO%2BOsvUg8UMo3nFsad0V78boyeWX (AV positives: 4/68 scanned on 11/30/2016 19:06:41) URL: http://www.nlstorage.info/installmate/php/get_cfg.php?step_id=1&installer_id=502043772fc974.58075031&publisher_id=201&source_id=0&page_id=0&affiliate_id=0&geo_location=US&locale=EN&browser_id=1 (AV positives: 4/68 scanned on 11/30/2016 18:51:22) File SHA256: 36d6eb3cbb642478a29d2456c19351056dc3811656d9373b405f0b36f57cdf19 (AV positives: 48/57 scanned on 11/30/2016 19:41:53) File SHA256: 4ca9863e4e7a9a31c2846dee3aad04439f22d6f63fd002e6bb29bae5b2221037 (AV positives: 46/54 scanned on 11/30/2016 19:08:48) File SHA256: 74e33969a6c5d6fac6961a1d04f29dbc12e5decc8fca7dd55bd969d35c564f55 (AV positives: 46/57 scanned on 11/30/2016 19:06:40) File SHA256: 1196054eaac0fa95c8a641713320d2865d3e71d1c63c30e86a917e497d69be4d (AV positives: 49/57 scanned on 11/30/2016 19:05:17) File SHA256: 834c764f9ed6ae8d8d614827902d7525878ddc0a781abd6b295e3d20b45dbdb3 (AV positives: 46/55 scanned on 11/30/2016 18:51:38) Found malicious artifacts related to "104.207.149.251" (ASN: , Owner: ): ... URL: http://torntvz.net/ping.php (AV positives: 3/68 scanned on 11/18/2016 10:52:26) URL: http://torntvz.net/ (AV positives: 2/68 scanned on 11/15/2016 16:04:27) URL: http://torntvz.net/ping.php?partner=socksharepm&product=smarter&build=18_3 (AV positives: 2/68 scanned on 11/15/2016 16:02:36) URL: http://torntvz.net/ping.php?partner=ap772742-download--55&product=torntv&build=18_3 (AV positives: 2/68 scanned on 11/11/2016 16:50:34) URL: http://torntvz.net/ping.php?partner=putlocker11&product=smarter&build=47c (AV positives: 2/68 scanned on 11/09/2016 19:05:50) File SHA256: 6ecb1303e77a06ca1566c3fc26b1ff5ebd733ff06f2a25009bb7a4cb26ba3ec5 (AV positives: 40/57 scanned on 11/07/2016 14:18:34) File SHA256: 69195c06546aa3fdcd8fbd6d1e1d55fef2db491f136ee893989b4f8bc799ef84 (AV positives: 36/57 scanned on 11/03/2016 05:47:32) File SHA256: ce412f37d187f4697b8924d8f1c77a470f254d9ff2097881e3399aa5fe08d1f4 (AV positives: 30/55 scanned on 10/19/2016 09:56:23) File SHA256: 7c3038a074da7fc11bb46a27a87a0f6e1d2733afe1defcc79851d93b06228f14 (AV positives: 42/56 scanned on 10/13/2016 09:41:43) File SHA256: 8901a3ad72c30f2aa59cb265e0717aefc337c0a42256cdef648257f8ff26f09f (AV positives: 37/58 scanned on 09/03/2016 02:33:32) Found malicious artifacts related to "69.16.175.42" (ASN: 20446, Owner: Highwinds Network Group, Inc.): ... URL: http://dl.geninfocloud.com/21/all/hqv/de/setup.exe (AV positives: 3/68 scanned on 11/30/2016 18:02:45) URL: http://cdn4.porndweller.com/!/s42.js (AV positives: 2/68 scanned on 11/30/2016 16:47:55) URL: http://dl.democlientnet.com/colni/scle8t42/rueodani/setup.exe (AV positives: 4/68 scanned on 11/30/2016 13:18:06) URL: http://download.demogensrv.com/installer/60542/4096/0/0/0/gcontrolappqa.exe (AV positives: 6/68 scanned on 11/30/2016 12:01:19) URL: http://int.cdn.hw.installzone.info/ (AV positives: 1/68 scanned on 11/30/2016 11:06:25) File SHA256: 9f80cd85eb75445e03fd97c4c9932b25b3f9efe0972bc2f4d0242e2b0d2f8a29 (AV positives: 25/56 scanned on 11/30/2016 12:01:26) File SHA256: b13e0e933e5682ccdae8f130b6b2a09a9dfdaf56951f3158020e16f147e2f33c (AV positives: 1/50 scanned on 11/30/2016 05:02:43) File SHA256: 5f06b758258de58e876f6c2944f68b17c504420469fab26c951fe78effe33bff (AV positives: 11/57 scanned on 11/30/2016 05:02:36) File SHA256: 2b3ca8bb6be532f0488d19c812407b9fa7eec04cfbb6192732e32197b1d7c5eb (AV positives: 1/57 scanned on 11/30/2016 05:02:29) File SHA256: 0c9a1a1b46bc40a1b9a062da0f1bd0413fbaaa917bd24a104bd15377d6070748 (AV positives: 1/57 scanned on 11/30/2016 05:02:27) Found malicious artifacts related to "104.130.124.96" (ASN: 19994, Owner: Rackspace Hosting): ... URL: http://dlp.cloudbox101.com/lmKRsAUohbqfu_Gohvw_vd_wPjesvKeq2TKkutjWFKnrHqSVxMzOZ-QB8YCY0vCMWYNepp634N6Sc6taM61dpFZdM6Ol0R3G8ksIuhfTfkvSfwhXJ9K86teK5HWiluUV (AV positives: 5/68 scanned on 11/30/2016 19:57:28) URL: http://dlp.cloudbox101.com/HXlXVCqcWnxdxLESTWa86HV0kfYqqpdUZMG4SseMPWHexMiBiry8V6csoDqIXxFMUnQ1s1VCD7Wi4rWkeGXy6F0q74n6HQJuUvO0d55e4m_wYW4KDOQD_HwqEOwAtagr (AV positives: 4/68 scanned on 11/30/2016 19:57:16) URL: http://dlp.allfiles100.com/pd2/259/Java/446/713/OFjoPY1e (AV positives: 5/68 scanned on 11/30/2016 19:56:36) URL: http://dlp.cloudbox100.com/Qs2apTn-SpVTe0NO1V4ZY3DmRHb5qEs1yN1prJ4VyrF9j-8-unGv8KyjEfRZT77tGwwlAZGIcP_bWlUNIm_rHCB7kHqd1lHUNxI8TJ38t97jjBeqBp-txY4qBZVjbFYD (AV positives: 3/68 scanned on 11/30/2016 19:57:12) URL: http://dlp.cloudbox101.com/o71f2OGVyNHr4PqpCLlUfP7X2R8OAvSvUz5OdUp2_Q-Ve-X7eMGe94AIlRaoPjg4dmfz4XTalaTCuxdb1KmszmlPwG-U2zYmHeDYbVaFP2x51cpOIIbtoKF4WXP_JQ7D (AV positives: 5/68 scanned on 11/30/2016 19:56:38) File SHA256: 6597280239022c5e444dabacc0dc2709a4f8ed1625b1662718c6a723434c14bf (AV positives: 39/55 scanned on 11/30/2016 19:52:16) File SHA256: 4accdf67594ce4e4a72a118470ddc2c601f79b95c4e90a068d1d304af507f372 (AV positives: 51/57 scanned on 11/30/2016 18:35:40) File SHA256: ff65f990d86cae042435adf5f1c70f72e3326c26ea5b26dc3949b70c54b0a486 (AV positives: 53/56 scanned on 11/30/2016 18:29:58) File SHA256: b0790d8d205b17faadde6c30d1ed25b20bbb034967c69dd13bc1963a59ad7f04 (AV positives: 48/56 scanned on 11/30/2016 17:41:58) File SHA256: 880d88c0c60f375e64b5272dbb75d5dc081ceb1b58ab625dc1e2cb377119b520 (AV positives: 51/57 scanned on 11/30/2016 17:28:57)2e:T188d,Found malicious artifacts related to "23.253.126.58" (ASN: 33070, Owner: Rackspace Hosting): ... URL: http://dld.oinst02.eu/installer/Files/799/318/613be09bf82f963642df6daebe0c1/Foofind-Download-Manager_0.3-20140421.exe (AV positives: 4/68 scanned on 11/30/2016 19:39:48) URL: http://sagecreekranchliving.com/favicon.ico (AV positives: 1/68 scanned on 11/30/2016 19:31:13) URL: http://dnsdomainhost.ws/ (AV positives: 2/68 scanned on 11/30/2016 19:23:57) URL: http://level-user.net/hp/?q=xoWEeUMFgwBJTIYmjlwUULgP6692itwtS%2BCeAXs0d8X1mUjhye4Uzuv4hXYHbknGpOjcCqTZLkY7FnNZYgs%2F%2BpqEtRlL9cl8p%2BZAfiMoe99zq1pM%2BjDhJRvMjrpeDbTN9JAAfj1US9nT225uwvcQZ6iwyjigtRw7ApPgOaUx7GNbAn14QlMsvsil1HcPzU%2FsgQfSvPpKijs956gv9VelEijo%2FClYAVr79dt2eCZp%2BEwAV36EA0hqNG7YL%2FH0mhRKI6nHxkrEZ1faCH2F4UiR2PUPjDhGZ7KbSQl4wENsEe580eJiZveyY0TgHlO0%2B9Bb%2B9VDxYRjRL0eSA6zdUhSt7ljBe8J8TgNyCgdNb1l5W20Gkwv%2FCiY0iMeQBpkSENZhFZQAxhvkSQLGHJd2VrcGaH65YYtvdQrTQZOnpBO%2BOsvUg8UMo3nFsad0V78boyeWX (AV positives: 4/68 scanned on 11/30/2016 19:06:41) URL: http://www.nlstorage.info/installmate/php/get_cfg.php?step_id=1&installer_id=502043772fc974.58075031&publisher_id=201&source_id=0&page_id=0&affiliate_id=0&geo_location=US&locale=EN&browser_id=1 (AV positives: 4/68 scanned on 11/30/2016 18:51:22) File SHA256: 36d6eb3cbb642478a29d2456c19351056dc3811656d9373b405f0b36f57cdf19 (AV positives: 48/57 scanned on 11/30/2016 19:41:53) File SHA256: 4ca9863e4e7a9a31c2846dee3aad04439f22d6f63fd002e6bb29bae5b2221037 (AV positives: 46/54 scanned on 11/30/2016 19:08:48) File SHA256: 74e33969a6c5d6fac6961a1d04f29dbc12e5decc8fca7dd55bd969d35c564f55 (AV positives: 46/57 scanned on 11/30/2016 19:06:40) File SHA256: 1196054eaac0fa95c8a641713320d2865d3e71d1c63c30e86a917e497d69be4d (AV positives: 49/57 scanned on 11/30/2016 19:05:17) File SHA256: 834c764f9ed6ae8d8d614827902d7525878ddc0a781abd6b295e3d20b45dbdb3 (AV positives: 46/55 scanned on 11/30/2016 18:51:38) Found malicious artifacts related to "104.207.149.251" (ASN: , Owner: ): ... URL: http://torntvz.net/ping.php (AV positives: 3/68 scanned on 11/18/2016 10:52:26) URL: http://torntvz.net/ (AV positives: 2/68 scanned on 11/15/2016 16:04:27) URL: http://torntvz.net/ping.php?partner=socksharepm&product=smarter&build=18_3 (AV positives: 2/68 scanned on 11/15/2016 16:02:36) URL: http://torntvz.net/ping.php?partner=ap772742-download--55&product=torntv&build=18_3 (AV positives: 2/68 scanned on 11/11/2016 16:50:34) URL: http://torntvz.net/ping.php?partner=putlocker11&product=smarter&build=47c (AV positives: 2/68 scanned on 11/09/2016 19:05:50) File SHA256: 6ecb1303e77a06ca1566c3fc26b1ff5ebd733ff06f2a25009bb7a4cb26ba3ec5 (AV positives: 40/57 scanned on 11/07/2016 14:18:34) File SHA256: 69195c06546aa3fdcd8fbd6d1e1d55fef2db491f136ee893989b4f8bc799ef84 (AV positives: 36/57 scanned on 11/03/2016 05:47:32) File SHA256: ce412f37d187f4697b8924d8f1c77a470f254d9ff2097881e3399aa5fe08d1f4 (AV positives: 30/55 scanned on 10/19/2016 09:56:23) File SHA256: 7c3038a074da7fc11bb46a27a87a0f6e1d2733afe1defcc79851d93b06228f14 (AV positives: 42/56 scanned on 10/13/2016 09:41:43) File SHA256: 8901a3ad72c30f2aa59cb265e0717aefc337c0a42256cdef648257f8ff26f09f (AV positives: 37/58 scanned on 09/03/2016 02:33:32) Found malicious artifacts related to "69.16.175.42" (ASN: 20446, Owner: Highwinds Network Group, Inc.): ... URL: http://dl.geninfocloud.com/21/all/hqv/de/setup.exe (AV positives: 3/68 scanned on 11/30/2016 18:02:45) URL: http://cdn4.porndweller.com/!/s42.js (AV positives: 2/68 scanned on 11/30/2016 16:47:55) URL: http://dl.democlientnet.com/colni/scle8t42/rueodani/setup.exe (AV positives: 4/68 scanned on 11/30/2016 13:18:06) URL: http://download.demogensrv.com/installer/60542/4096/0/0/0/gcontrolappqa.exe (AV positives: 6/68 scanned on 11/30/2016 12:01:19) URL: http://int.cdn.hw.installzone.info/ (AV positives: 1/68 scanned on 11/30/2016 11:06:25) File SHA256: 9f80cd85eb75445e03fd97c4c9932b25b3f9efe0972bc2f4d0242e2b0d2f8a29 (AV positives: 25/56 scanned on 11/30/2016 12:01:26) File SHA256: b13e0e933e5682ccdae8f130b6b2a09a9dfdaf56951f3158020e16f147e2f33c (AV positives: 1/50 scanned on 11/30/2016 05:02:43) File SHA256: 5f06b758258de58e876f6c2944f68b17c504420469fab26c951fe78effe33bff (AV positives: 11/57 scanned on 11/30/2016 05:02:36) File SHA256: 2b3ca8bb6be532f0488d19c812407b9fa7eec04cfbb6192732e32197b1d7c5eb (AV positives: 1/57 scanned on 11/30/2016 05:02:29) File SHA256: 0c9a1a1b46bc40a1b9a062da0f1bd0413fbaaa917bd24a104bd15377d6070748 (AV positives: 1/57 scanned on 11/30/2016 05:02:27) Found malicious artifacts related to "104.130.124.96" (ASN: 19994, Owner: Rackspace Hosting): ... URL: http://dlp.cloudbox101.com/lmKRsAUohbqfu_Gohvw_vd_wPjesvKeq2TKkutjWFKnrHqSVxMzOZ-QB8YCY0vCMWYNepp634N6Sc6taM61dpFZdM6Ol0R3G8ksIuhfTfkvSfwhXJ9K86teK5HWiluUV (AV positives: 5/68 scanned on 11/30/2016 19:57:28) URL: http://dlp.cloudbox101.com/HXlXVCqcWnxdxLESTWa86HV0kfYqqpdUZMG4SseMPWHexMiBiry8V6csoDqIXxFMUnQ1s1VCD7Wi4rWkeGXy6F0q74n6HQJuUvO0d55e4m_wYW4KDOQD_HwqEOwAtagr (AV positives: 4/68 scanned on 11/30/2016 19:57:16) URL: http://dlp.allfiles100.com/pd2/259/Java/446/713/OFjoPY1e (AV positives: 5/68 scanned on 11/30/2016 19:56:36) URL: http://dlp.cloudbox100.com/Qs2apTn-SpVTe0NO1V4ZY3DmRHb5qEs1yN1prJ4VyrF9j-8-unGv8KyjEfRZT77tGwwlAZGIcP_bWlUNIm_rHCB7kHqd1lHUNxI8TJ38t97jjBeqBp-txY4qBZVjbFYD (AV positives: 3/68 scanned on 11/30/2016 19:57:12) URL: http://dlp.cloudbox101.com/o71f2OGVyNHr4PqpCLlUfP7X2R8OAvSvUz5OdUp2_Q-Ve-X7eMGe94AIlRaoPjg4dmfz4XTalaTCuxdb1KmszmlPwG-U2zYmHeDYbVaFP2x51cpOIIbtoKF4WXP_JQ7D (AV positives: 5/68 scanned on 11/30/2016 19:56:38) File SHA256: 6597280239022c5e444dabacc0dc2709a4f8ed1625b1662718c6a723434c14bf (AV positives: 39/55 scanned on 11/30/2016 19:52:16) File SHA256: 4accdf67594ce4e4a72a118470ddc2c601f79b95c4e90a068d1d304af507f372 (AV positives: 51/57 scanned on 11/30/2016 18:35:40) File SHA256: ff65f990d86cae042435adf5f1c70f72e3326c26ea5b26dc3949b70c54b0a486 (AV positives: 53/56 scanned on 11/30/2016 18:29:58) File SHA256: b0790d8d205b17faadde6c30d1ed25b20bbb034967c69dd13bc1963a59ad7f04 (AV positives: 48/56 scanned on 11/30/2016 17:41:58) File SHA256: 880d88c0c60f375e64b5272dbb75d5dc081ceb1b58ab625dc1e2cb377119b520 (AV positives: 51/57 scanned on 11/30/2016 17:28:57)2f:T7dc,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAV4SURBVFhHxZXpT5RXFMav4C7rCIODI5sKwypg45oKtVIVbKvSajVGBQaGxSUyCCjRFLQ24QPTNqKyqNi6oKKWoaFKC6YNNFppUgdjkypuTbBNv/gfPL3nvLzXwWm/tZ0PT+695zzP+d33nZcgqg/UYcOmLSgu3QlbyQ4UlZTxqquIa1r95V6vaT73us0tr83S5pFH3xOLmMQWWatyYK+swr6aA9hbtU9T9X5UVtPqJq57qlJ6PXz6HPeVsqNnYlVIZtbqHIiMN7OQ/c5arFiZjRWrspE1Kve9VstRPd1D66s+OuvS+x61lauZSWwxb/4CJCSlIjElTSlB7knutX/a/52Pa/M06f1XZ8ZL5rz0BRBkiplr8YqIzReYHRfvFfEFEpJTxzx9bGIaMjfZsXxLJTI3V/yropkZG3crHrGFJSkFUXNilSzpS5C9u/E/lc4jtohLSEJkzBylxCWr8Nau40rfDtzFixcvPHTg6DVVe7+qVfqPcaa9+weuDwzeR9bORljrvsDvf/zJtT317Vi6ca9iEVvEWhIRETVbKXn5RmTubGatq25TYfdL3H/wBOe/GuChPf0/4/WSo8goO8GZngEX16m/rLQR/YO/8Lm14yb70tbYFIvYYo78AM2R0UrJ2UVYuuMkq+VqP4cHhx6g0tEhdYW1uaYNj5+NcI/Oi2zHsKSshTM/3Rvmel1TFw41d4/mH2JR0VEsLj6O+GW5ikVsETM3DuGzIlnmGAuScmvwWukZ1qNnz3nAo6cjGHQ9lBd5CLvDiQ+brmt1eYk06wmk21qlv21Mxu7oxHP56kkb9p9DemET5hefQnT6csUjtoiWH6DJHMEyx6Ui/oMjSCk5i/LPbnj87nSRJOtJ3BnSnrL+TK88tyLZdoYzJP2n+u5H7dUfPHFd8xSdRoqtTTLSFI/Ygj7AsHAzy5y6AnH5p2Apbkd3/30e0Oa8jbl5JxEr67H5p/Hu/g4FqTl+A7scX2P3pz0ycwFrDzq5R09Na/f3Q5yJs34Oi+0CYrc2IswcqXjEFhHR0TCaTKzwhbmILurA4j2dCpJT1YHIvLOIsrZLXcSlb4Y83sy9X3/j3g5Hn+oNP32OhWUXEJV/jns0N2LdYcUiHrGFOSIKIcYZrBnLrDAXXkN1Uz9uu57gYs9dhG87h5kFl2X9Kvdu3hnm3m3XI6XqY32YmXcRpQ19o73H2FzbhZnbz4/JmrLsikU8Yotw+dsbQoys0NxPYLQ6pTphzL+G0O2XpTpgLPhytC57BZ0IzetA6LZLL7Vd7vOuaD6Vk7X8q+zXZjoRsnirYhGP2MIUPgvBhlCWYWkRDG/Xw5BzBIbsw1KHtDWH9NGo9Dr13DXqUznZ03NrPua5wbMXKBbxiC3CTGYEBk/3iogtjDNMCAgM8oqILUKMYfDzD/CKiC0MoUZM9fNnWQsLx/yJ2SsqcOvWLfT29SkP+RwOB/vIr2dodXZ1YWhoCHV1dWPm0IyWlhaP2cQWwdNDMGXqNJbT6WSg3V7BZjrTmpv7nvJYrVaMjGj/B2ifmfkG73t7+xgen5DAueHhYYbSZclDZ9pTRs8SWwQFGzB58hRpyvS4NQ1yuVzc1z0EV29ADqM6DXS5JDw+Xs2hByHV1tay3P+bUp5yxBaBQUGYOGkSmpub+ZYFBQVYv3494iwWflIaQj2q0WXcB5EnIyODa5TT59CZMnqOZtDD6N5yu529xBYBAYGYMGGifIW9fFPak8rLyxmuq6GhgYdQj2BUpz3VKavnaO+eo4vTmVb3HPmJLfz8/eE7frxXRGwxzc8PPr6+XhGxxVT59Y8b5+MVEVuMl69fCOEVMdtXvn5vXYDZeVYbf40+Pj6YJP80/g8Ri5jE/gvezqxNR+4KHgAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790952359096,"unified_at":"2026-10-02T14:45:59.096Z","metadata":{"hashes":{"sha256":"30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68","sha1":"251e450d889fdc0d6e3ea6710c1fed66734eb5ac","md5":"0ecbeedc8cf7ef1826a55c2093c105a4","sha512":"b43c9acb16f621caad3270e90c32c268702a50b7a99d5d6274ff881d979855f3e4a37dd2e0a780ecc14e3362787fe03b82153fd353b9c860197a6d878abe4883","ssdeep":"6144:yszkr6M5qN6dNsr6oT7vgRA/t4R0ip6L6BN4hB1dJIqH+5TF74ZOvYJkorRu9d:tS6Ms8d86oTDgRjRTkLGF7Zt","ssdeep_chunks":["6144:yszkr6M","6144:szkr6M5","6144:zkr6M5q","6144:kr6M5qN","6144:r6M5qN6","6144:6M5qN6d","6144:M5qN6dN","6144:5qN6dNs","6144:qN6dNsr","6144:N6dNsr6","6144:6dNsr6o","6144:dNsr6oT","6144:Nsr6oT7","6144:sr6oT7v","6144:r6oT7vg","6144:6oT7vgR","6144:oT7vgRA","6144:T7vgRA/","6144:7vgRA/t","6144:vgRA/t4","6144:gRA/t4R","6144:RA/t4R0","6144:A/t4R0i","6144:/t4R0ip","6144:t4R0ip6","6144:4R0ip6L","6144:R0ip6L6","6144:0ip6L6B","6144:ip6L6BN","6144:p6L6BN4","6144:6L6BN4h","6144:L6BN4hB","6144:6BN4hB1","6144:BN4hB1d","6144:N4hB1dJ","6144:4hB1dJI","6144:hB1dJIq","6144:B1dJIqH","6144:1dJIqH+","6144:dJIqH+5","6144:JIqH+5T","6144:IqH+5TF","6144:qH+5TF7","6144:H+5TF74","6144:+5TF74Z","6144:5TF74ZO","6144:TF74ZOv","6144:F74ZOvY","6144:74ZOvYJ","6144:4ZOvYJk","6144:ZOvYJko","6144:OvYJkor","6144:vYJkorR","6144:YJkorRu","6144:JkorRu9","6144:korRu9d","12288:yszkr6M","12288:szkr6M5","12288:zkr6M5q","12288:kr6M5qN","12288:r6M5qN6","12288:6M5qN6d","12288:M5qN6dN","12288:5qN6dNs","12288:qN6dNsr","12288:N6dNsr6","12288:6dNsr6o","12288:dNsr6oT","12288:Nsr6oT7","12288:sr6oT7v","12288:r6oT7vg","12288:6oT7vgR","12288:oT7vgRA","12288:T7vgRA/","12288:7vgRA/t","12288:vgRA/t4","12288:gRA/t4R","12288:RA/t4R0","12288:A/t4R0i","12288:/t4R0ip","12288:t4R0ip6","12288:4R0ip6L","12288:R0ip6L6","12288:0ip6L6B","12288:ip6L6BN","12288:p6L6BN4","12288:6L6BN4h","12288:L6BN4hB","12288:6BN4hB1","12288:BN4hB1d","12288:N4hB1dJ","12288:4hB1dJI","12288:hB1dJIq","12288:B1dJIqH","12288:1dJIqH+","12288:dJIqH+5","12288:JIqH+5T","12288:IqH+5TF","12288:qH+5TF7","12288:H+5TF74","12288:+5TF74Z","12288:5TF74ZO","12288:TF74ZOv","12288:F74ZOvY","12288:74ZOvYJ","12288:4ZOvYJk","12288:ZOvYJko","12288:OvYJkor","12288:vYJkorR","12288:YJkorRu","12288:JkorRu9","12288:korRu9d","6144:tS6Ms8d","6144:S6Ms8d8","6144:6Ms8d86","6144:Ms8d86o","6144:s8d86oT","6144:8d86oTD","6144:d86oTDg","6144:86oTDgR","6144:6oTDgRj","6144:oTDgRjR","6144:TDgRjRT","6144:DgRjRTk","6144:gRjRTkL","6144:RjRTkLG","6144:jRTkLGF","6144:RTkLGF7","6144:TkLGF7Z","6144:kLGF7Zt"],"imphash":"099c0646ea7282d232219f8807883be0"},"file_info":{"file_name":"Virus.xor","file_type":["peexe","executable"],"file_type_id":"exe","file_size":398840,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499289844000,"last_seen":1664747695000,"last_multi_scan":1664747695000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":17,"malicious_count":9,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"ADWARE/BrowseFox.Gen4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004edca81 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"not-a-virus:AdWare.NSIS.TornTV.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Nsis.Yotoon.deckrr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/CoolMir-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"PUP.Win32.KiewNoy.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AdWare.NSIS.TornTV","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00018238-00001064-0000010C-44979340\n \"\" queries volume information of \"C:\\\" at 00018238-00001064-0000010C-64647953\n \"\" queries volume information of \"%PROGRAMFILES%\\FLVPlayer\\uninst.exe\" at 00018238-00001064-0000010C-64651304","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00018238-00001064-0000010C-44979340\n \"\" queries volume information of \"C:\\\" at 00018238-00001064-0000010C-64647953","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.thawte.com\"\n \"bringsomedata.com\"\n \"dl.newdatastatsserv.com\"\n \"data.infopackinst.com\"\n \"cmpsmarter-downloader.maynemyltf.netdna-cdn.com\"\n \"torrntvz.com\"\n \"bringsomedata.net\"\n \"torntvz.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.253.126.58:80\"\n \"104.207.149.251:80\"\n \"69.16.175.42:80\"\n \"104.130.124.96:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nssE3B3.tmp\"\n \"\" created file \"%TEMP%\\nsuE404.tmp\\load_4.bmp\"\n \"\" created file \"%TEMP%\\nsuE404.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"NSISdl.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"inetc3.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"nsDialogs.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /rs.php?p=hdvidcodec HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: bringsomedata.net\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /colni/scle8t42/rueodani/setup.exe HTTP/1.0\nHost: dl.newdatastatsserv.com\nUser-Agent: NSISDL/1.2 (Mozilla)\nAccept: */*\"\n \"GET /country.asp?st=ssc&uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&bld=18GJ&cnt=z0 HTTP/1.0\nHost: data.infopackinst.com\nUser-Agent: NSISDL/1.2 (Mozilla)\nAccept: */*\"\n \"GET /ping2.asp?uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&gid=14&bundles=HDV:1|SIM:|FM2:|IMI:|V6Y:0|SSC:1|WEX:|CLX:|PMD:1&fmrp=&avdt=|&grid=30112016_30112016&tba=4|ge|fc|sr1&yodt=&bbdt=&imdt=&fmdt=&smdt=&wsdt=&dct=|opb|&qql=0&bld=18GJ&cnt=z0 HTTP/1.1\nUser-Agent: Inetc39 (Mozilla; pm ; FW 4; WinNT 6.1|Windows 7 Home Premium; wd 15022015; ge |w|6|c|4c; sd 120900-115236; fl 0; ie 8|8|8|8; ch 0; ff 1; dbw ff; hb c==|f==|e= px 0 co L2 pm 1)\nHost: data.infopackinst.com\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6AFE0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA\" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=thawte Primary Root CA, OU=\"c 2006 thawte\n Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte\n Inc.\", C=US\" (SHA1: 80:8D:62:64:2B:7D:1C:4A:9A:83:FD:66:7F:7A:2A:9D:24:3F:B1:C7; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US\" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Thawte Code Signing CA - G2, O=\"Thawte\n Inc.\", C=US\" (SHA1: E2:43:90:08:78:6E:43:C6:1D:1E:95:6F:95:1B:DA:31:8A:D6:37:59; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\VlSMZ1e\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\urlmon.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$29","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"\"wireshark.exe\" (Indicator: \"wireshark.exe\")","origin":"File/Memory","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"Adblock Plus for IE\nAdvertisingSupport\nWow6432Node\\AdvertisingSupport\nMalwarebytes' Anti-Malware\nMicrosoft\\Windows\\CurrentVersion\\Uninstall\\Malwarebytes Anti-Malware_is1\nWow6432Node\\Malwarebytes' Anti-Malware\nHitmanPro\nWow6432Node\\HitmanPro\nAVAST Software\nWow6432Node\\AVAST Software\nVMware, Inc.\nVMware\nMicrosoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer\" (Indicator: \"vmware\")\n \"VMware, Inc.\" (Indicator: \"vmware\")\n \"VMware\" (Indicator: \"vmware\")\n \"Sandboxie\" (Indicator: \"sandboxie\")\n \"VMWare\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\WFRUM1NZ\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\313X8YRE\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PNWGXN3G\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\DILVHKQ4\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\desktop.ini\"\n \"\" read file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"NSISdl.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"inetc3.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"uninst.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows Nullsoft Installer self-extracting archive\"\n \"nsDialogs.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"$2a","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"\"\n \"23.253.126.58\"\n \"69.16.175.42\"\n \"104.130.124.96\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2b","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2c","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"NSISdl.dll\" claimed CRC 0 while the actual is CRC 440736\n \"inetc3.dll\" claimed CRC 83503 while the actual is CRC 15373\n \"uninst.exe\" claimed CRC 440736 while the actual is CRC 83503","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Windows\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Chr\" which indicates: \"May attempt to obfuscate specific strings\"\n Found suspicious keyword \"FindWindow\" which indicates: \"May enumerate application windows (if combined with Shell.Application object)\"\n Found suspicious keyword \"Write\" which indicates: \"May write to a file (if combined with Open)\"\n Found suspicious keyword \"Open\" which indicates: \"May open a file\"\n Found suspicious keyword \"ShowWindow\" which indicates: \"May hide the application\"\n Found suspicious keyword \"Shell\" which indicates: \"May run an executable file or a system command\"\n Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegOpenKeyExA\n CopyFileA\n CreateDirectoryA\n CreateFileA\n CreateProcessA\n CreateThread\n DeleteFileA\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetFileAttributesA\n GetFileSize\n GetModuleFileNameA\n GetModuleHandleA\n GetProcAddress\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n LoadLibraryA\n LoadLibraryExA\n Sleep\n WriteFile\n ShellExecuteA\n FindWindowExA\n WSAStartup (Ordinal #115)\n closesocket (Ordinal #3)\n connect (Ordinal #4)\n recv (Ordinal #16)\n send (Ordinal #19)\n socket (Ordinal #23)\n IsDebuggerPresent\n SleepEx\n TerminateProcess\n UnhandledExceptionFilter\n FtpOpenFileA\n HttpQueryInfoA\n HttpSendRequestA\n HttpSendRequestExA\n InternetCloseHandle\n InternetConnectA\n InternetCrackUrlA\n InternetOpenA\n InternetQueryOptionA\n InternetReadFile\n InternetWriteFile\n VirtualAlloc\n VirtualProtect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"Environment Awareness","name":"Reads the registry for VMWare specific artifacts","description":"\"\" (Path: \"HKLM\\SOFTWARE\\VMWARE, INC.\")\n \"\" (Path: \"HKLM\\SOFTWARE\\VMWARE\")","origin":"Registry Access","relevance":5,"id":"registry-56","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY User-Agent (NSIS_Inetc (Mozilla)) - Sometimes used by hostile installers\" (SID: 2011227, Rev: 4, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ETPRO MALWARE TornTV Checkin\" (SID: 2806133, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)\n Detected alert \"ETPRO POLICY TornTV data download starter\" (SID: 2805629, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/50 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/50 Antivirus vendors marked sample as malicious (30% detection rate)\n 4/40 Antivirus vendors marked sample as malicious (10% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: NSIS_Inetc (Mozilla)\n NSISDL/1.2 (Mozilla)\n Inetc39 (Mozilla; pm ; FW 4; WinNT 6.1|Windows 7 Home Premium; wd 15022015; ge |w|6|c|4c; sd 120900-115236; fl 0; ie 8|8|8|8; ch 0; ff 1; dbw ff; hb c==|f==|e= px 0 co L2 pm 1)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2e","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"7468656d65312e786d6cec595d8bdb46147d2ff43f08bd3bfe92fcb1c41b6cd9ceb6d94d42eca4e4716c8fadc98e344633de8d0981923c160aa569e943037deb\" (Indicator: \"bfe\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Reads the registry for VMWare specific artifacts"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"References security related windows services"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":53,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":8,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"583f2da3aac2eda26f41d135","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"Virus.xor","analysis_start_time":"2016-11-30T20:51:20+00:00","indicators_count":{"informative":17,"suspicious":29,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.253.126.58","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"address":"104.207.149.251","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"address":"69.16.175.42","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"address":"104.130.124.96","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"dns_resolutions":[{"domain":"ocsp.thawte.com","address":"23.54.91.27","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"bringsomedata.com","country":"-","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"dl.newdatastatsserv.com","address":"69.16.175.42","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"data.infopackinst.com","address":"104.130.124.96","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"cmpsmarter-downloader.maynemyltf.netdna-cdn.com","country":"-","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"torrntvz.com","country":"-","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"bringsomedata.net","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"domain":"torntvz.net","address":"104.207.149.251","country":"United States","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"http_requests":[{"host":"23.253.126.58","host_ip":"23.253.126.58:80","url":"/rs.php?p=hdvidcodec","method":"GET","header":"GET /rs.php?p=hdvidcodec HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: bringsomedata.net\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"host":"69.16.175.42","host_ip":"69.16.175.42:80","url":"/colni/scle8t42/rueodani/setup.exe","method":"GET","header":"GET /colni/scle8t42/rueodani/setup.exe HTTP/1.0\nHost: dl.newdatastatsserv.com\nUser-Agent: NSISDL/1.2 (Mozilla)\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"host":"104.130.124.96","host_ip":"104.130.124.96:80","url":"/country.asp?st=ssc&uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&bld=18GJ&cnt=z0","method":"GET","header":"GET /country.asp?st=ssc&uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&bld=18GJ&cnt=z0 HTTP/1.0\nHost: data.infopackinst.com\nUser-Agent: NSISDL/1.2 (Mozilla)\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"host":"104.130.124.96","host_ip":"104.130.124.96:80","url":"/ping2.asp?uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&gid=14&bundles=HDV:1|SIM:|FM2:|IMI:|V6Y:0|SSC:1|WEX:|CLX:|PMD:1&fmrp=&avdt=|&grid=30112016_30112016&tba=4|ge|fc|sr1&yodt=&bbdt=&imdt=&fmdt=&smdt=&wsdt=&dct=|opb|&qql=0&bld=18GJ&cnt=z0","method":"GET","header":"GET /ping2.asp?uid=616740571&tuid=3091837&sref=HDV_18-4_0_ff_marmar--def&gid=14&bundles=HDV:1|SIM:|FM2:|IMI:|V6Y:0|SSC:1|WEX:|CLX:|PMD:1&fmrp=&avdt=|&grid=30112016_30112016&tba=4|ge|fc|sr1&yodt=&bbdt=&imdt=&fmdt=&smdt=&wsdt=&dct=|opb|&qql=0&bld=18GJ&cnt=z0 HTTP/1.1\nUser-Agent: Inetc39 (Mozilla; pm ; FW 4; WinNT 6.1|Windows 7 Home Premium; wd 15022015; ge |w|6|c|4c; sd 120900-115236; fl 0; ie 8|8|8|8; ch 0; ff 1; dbw ff; hb c==|f==|e= px 0 co L2 pm 1)\nHost: data.infopackinst.com\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}],"processes":[{"pid":1064,"ppid":0,"name":"Virus.xor.exe","command_line":"","normalized_path":"C:\\Virus.xor.exe","uid":"00018238-00001064","icon":"$2f"}],"all_imported_dlls":["gdi32.dll","usp10.dll","clbcatq.dll","IPHLPAPI.DLL","rasman.dll","pnrpnsp.dll","WSHTCPIP.DLL","advapi32.dll","oleaut32.dll","nsi.dll","urlmon.dll","msasn1.dll","sspicli.dll","NapiNSP.dll","shlwapi.dll","rtutils.dll","ole32.dll","cfgmgr32.dll","propsys.dll","dwmapi.dll","ws2_32.dll","iertutil.dll","wship6.dll","msvcrt.dll","shell32.dll","version.dll","winnsi.dll","slc.dll","imageres.dll","netc3.dll","mshtml.dll","msvcr90.dll","profapi.dll","crypt32.dll","rsaenh.dll","linkinfo.dll","srvcli.dll","cscapi.dll","ntdll.dll","rpcrt4.dll","imm32.dll","uxtheme.dll","riched20.dll","cryptsp.dll","rasapi32.dll","FWPUCLNT.DLL","devobj.dll","nlaapi.dll","comdlg32.dll","cryptbase.dll","Wldap32.dll","System.dll","winrnr.dll","kernel32.dll","mswsock.dll","alogs.dll","msctf.dll","sechost.dll","shfolder.dll","ntshrui.dll","user32.dll","rasadhlp.dll","KernelBase.dll","lpk.dll","setupapi.dll","dnsapi.dll","wininet.dll","comctl32.dll","ntmarta.dll","SensApi.dll","netutils.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"NSISdl.dll","sha256":"dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"System.dll","sha256":"dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"inetc3.dll","sha256":"fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"nsDialogs.dll","sha256":"e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"ping2[1].asp","sha256":"647383afe1a9f023b41d7a45d168fa49cc3356a9a7164aa7392b86ad40386761","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"FLVPlayer.lnk","sha256":"b839e6b09601a90ceca110dcaa7102d67c65bf9c5f504a8d81d65d45d4aa50f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"Uninstall.lnk","sha256":"10ce309465d4764c14f9c7b81e0e97ca15a861f3d9968141fceeeeb22c914cfb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"stage2","sha256":"cbd3cfb9b9f51bbbfbf08759e243f5b3519cbf6ecc219ee95fe7c667e32c0a8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"uninst.exe","sha256":"3b9a24ba812321cab5b2a3eb5e826739ff6ff55d0bf4b5d17ab922ce9431673d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"nssE3B3.tmp","sha256":"81e420fe7974d698a9d2ce35f1845483f994a58783076dfb49e313aa91d09531","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"1clogo.bmp","sha256":"3137cf5d75ac013b7232373df9e1bae243605dd53b0c86e1c9f126fa2f183b38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept.bmp","sha256":"7baca1380f469042514a5fef60dde2361aa47e8bb0fe8e01c1ec175d22c97251","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept0.bmp","sha256":"fdf0d4c5dec50def6b1dd3aae3dce1f07920931eb1300f7887dbd5647410e08c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept1.bmp","sha256":"114c238c17d1cbc30e0d1f30fc5db00f6cfa579d27f755b6494bdcf1687e285b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept2.bmp","sha256":"f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept3.bmp","sha256":"b77cd138ed85e75c1e68d8c4709db2b4bdee1cac79cd56fde3d10f9c2199ebd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"accept_disabled.bmp","sha256":"569192f00ddc6b69100c9b011da239b92a84bdc5e3a28770cec701812e8336ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"back.bmp","sha256":"31a7ec21f242e29ce30a5edb920dcd140965aaa06ea169daec9be8f741db86e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"back_dis.bmp","sha256":"fd3da2ca9def807d9d99643ee25babe556c3f5627a77157ba46937ca74ea39c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"bmidt.txt","sha256":"31c1ffdbeaaef8c4581d3eb096923a8430c54dbbae17b87092235164de52c239","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"brcdt.txt","sha256":"d942d85666d99322d9810ae32a60f9d36981bd22a48e2e835a43c9f429846e72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"close.bmp","sha256":"88e80aba7e4829be6be737104ff63a1649dc353743a5e07a4d4f5b9aa00e6918","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nseE40F.tmp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\System.dll","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Virus.xor.exe","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\system32\\mshtml.dll","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\gCD","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\BMIdt.txt","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\BRCdt.txt","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\Decline.bmp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\Accept.bmp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nssE3B3.tmp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\FLVPlayer","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%USERPROFILE%\\Desktop\\FLVPlayer.lnk","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%PROGRAMFILES%\\FLVPlayer\\FLVPlayer.exe","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\FLVPlayer\\FLVPlayer.lnk","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%PROGRAMFILES%\\FLVPlayer\\uninst.exe","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\FLVPlayer\\Uninstall.lnk","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%PROGRAMFILES%\\FLVPlayer","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%PROGRAMFILES%\\FLVPlayer\\stage2","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"C:\\Users\\VlSMZ1e","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\WFRUM1NZ\\ping2[1].asp","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"path":"%TEMP%\\nsuE404.tmp\\gC0","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!vlsmz1e!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"583f2da3aac2eda26f41d135"}]}]}},"report_ids":{"sandbox_job_ids":["583f2da3aac2eda26f41d135"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious AdWare.NSIS.TornTV Sample 30ffe7ce28f7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 30ffe7ce28f7…. Malware family: AdWare.NSIS.TornTV. Threat score 100/100. 8/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68"}],["$","meta","4",{"property":"og:title","content":"Malicious AdWare.NSIS.TornTV Sample 30ffe7ce28f7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 30ffe7ce28f7…. Malware family: AdWare.NSIS.TornTV. Threat score 100/100. 8/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/30ffe7ce28f7b7a666cb63734a7ae8def4457b261379da28361163ef681c4e68"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious AdWare.NSIS.TornTV Sample 30ffe7ce28f7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 30ffe7ce28f7…. Malware family: AdWare.NSIS.TornTV. Threat score 100/100. 8/26 AV engines flagged this file. 9 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]