24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 72e97227948b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 72e97227948b…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e"],"about":{"@type":"SoftwareApplication","name":"eb7c74c66f801abde07e0d1a72cbec79.exe","applicationCategory":["peexe","executable"],"identifier":"72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":15,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tae0,"" queries volume information of unknown location at 00068810-00002504-0000010C-16353595611 "" queries volume information of "C:\Windows\AppPatch\lwftva.exe" at 00068810-00002504-0000010C-18793883376 "winlogon.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" at 00069922-00000416-0000010C-24169698858 "winlogon.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" at 00069922-00000416-0000010C-24175005654 "winlogon.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" at 00069922-00000416-0000010C-24204289263 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" at 00069978-00003276-0000010C-400524531073 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" at 00069978-00003276-0000010C-400534218060 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" at 00069978-00003276-0000010C-410244487248 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070328-00003376-0000010C-162644858141 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070328-00003376-0000010C-183678825196 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" at 00070328-00003376-0000010C-251607343250 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070404-00003972-0000010C-161739406768 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070404-00003972-0000010C-165011274453 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" at 00070404-00003972-0000010C-226453788524 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070419-00000316-0000010C-164871156368 "conhost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070419-00000316-0000010C-184016501057 "conhost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" at 00070419-00000316-0000010C-245169001970 "svchost.exe" queries volume information of "C:\Windows\System32\sspicli.dll" at 00070430-00001632-0000010C-220286279059 "svchost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" at 00070430-00001632-0000010C-220893848133 "svchost.exe" queries volume information of "\REGISTRY\MACHINE\SOFTWARE\Microsoft" at 00070430-00001632-0000010C-23128222304626:T1426,"GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gacyzuz.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: purycap.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gacyryw.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lymyxid.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lysyfyj.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vowycac.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexyryl.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vowydef.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qetyfuv.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyvyxor.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyxylux.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: gatyfus.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: pupybul.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qedynul.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qegyqaq.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qexylup.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: vocyruk.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: galykes.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: lyryfyd.com Content-Length: 6" "GET /login.php HTTP/1.1 Referer: http://www.google.com User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Host: qekykev.com Content-Length: 6"27:T53e,"" touched "HNetCfg.FwMgr" (Path: "HKCU\CLSID\{304CE942-6E39-40D8-943A-B913C40C9CD4}") "winlogon.exe" touched "NetworkListManager" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "winlogon.exe" touched "Network List Manager" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "winlogon.exe" touched "PSFactoryBuffer" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "svchost.exe" touched "Event System" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{4E14FBA2-2E22-11D1-9964-00C04FBBB345}") "svchost.exe" touched "EventSystemTier2" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{1BE1F766-5536-11D1-B726-00C04FB926AF}") "svchost.exe" touched "Event Subscription" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{7542E960-79C7-11D1-88F9-0080C7D771BF}") "svchost.exe" touched "EventSystem.EventObjectChange" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{D0565000-9DF4-11D1-A281-00C04FCA0AA7}") "svchost.exe" touched "EventSystem.EventObjectChange2" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{BB07BACD-CD56-4E63-A8FF-CBF0355FB9F4}") "dllhost.exe" touched "SHACCT Profile Notification Handler" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{56EA1054-1959-467F-BE3B-A2A787C4B6EA}") "dllhost.exe" touched "PSIProfileNotify" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}")28:T1133,Process "winlogon.exe" (UID: 00069922-00000416) was launched with modified environment variables: "Path, PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, USERPROFILE, TMP, USERNAME" Process "winlogon.exe" (UID: 00069922-00000416) was launched with missing environment variables: "LOCALAPPDATA, USERDOMAIN, LOGONSERVER, HOMEPATH, APPDATA, HOMEDRIVE" Process "conhost.exe" (UID: 00070328-00003376) was launched with modified environment variables: "PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, TMP, USERNAME" Process "conhost.exe" (UID: 00070328-00003376) was launched with missing environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, LOGONSERVER, ALLUSERSPROFILE, ProgramData, HOMEPATH, APPDATA, HOMEDRIVE, USERPROFILE, PUBLIC" Process "conhost.exe" (UID: 00070419-00000316) was launched with modified environment variables: "PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, TMP, USERNAME" Process "conhost.exe" (UID: 00070419-00000316) was launched with missing environment variables: "LOCALAPPDATA, COMPUTERNAME, USERDOMAIN, ALLUSERSPROFILE, ProgramData, APPDATA, USERPROFILE, PUBLIC" Process "svchost.exe" (UID: 00070430-00001632) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Local", COMPUTERNAME="PSPUBWS-PC", USERDOMAIN="NT AUTHORITY", ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", APPDATA="C:\Windows\ServiceProfiles\LocalService\AppData\Roaming", USERPROFILE="C:\Windows\ServiceProfiles\LocalService", PUBLIC="C:\Users\Public"" Process "svchost.exe" (UID: 00070430-00001632) was launched with modified environment variables: "PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, TMP, USERNAME" Process "svchost.exe" (UID: 00070446-00001968) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "explorer.exe" (UID: 00070497-00001428) was launched with new environment variables: "CommonProgramFiles="C:\Program Files\Common Files", LOCALAPPDATA="C:\Users\PSPUBWS\AppData\Local", COMPUTERNAME="PSPUBWS-PC", USERDOMAIN="PSPUBWS-PC", LOGONSERVER="\\PSPUBWS-PC", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", HOMEPATH="\Users\PSPUBWS", APPDATA="C:\Users\PSPUBWS\AppData\Roaming", HOMEDRIVE="C:", USERPROFILE="C:\Users\PSPUBWS", PUBLIC="C:\Users\Public", ProgramFiles="C:\Program Files"" Process "explorer.exe" (UID: 00070497-00001428) was launched with modified environment variables: "Path, PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, TMP, USERNAME" Process "taskhost.exe" (UID: 00070531-00001312) was launched with new environment variables: "LOGONSERVER="\\PSPUBWS-PC", HOMEPATH="\Users\PSPUBWS", HOMEDRIVE="C:"" Process "taskhost.exe" (UID: 00070531-00001312) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "svchost.exe" (UID: 00070585-00001108) was launched with new environment variables: "LOCALAPPDATA="C:\Windows\ServiceProfiles\NetworkService\AppData\Local", COMPUTERNAME="PSPUBWS-PC", USERDOMAIN="WORKGROUP", ALLUSERSPROFILE="C:\ProgramData", ProgramData="C:\ProgramData", APPDATA="C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming", USERPROFILE="C:\Windows\ServiceProfiles\NetworkService", PUBLIC="C:\Users\Public"" Process "svchost.exe" (UID: 00070585-00001108) was launched with modified environment variables: "PROCESSOR_LEVEL, PROCESSOR_REVISION, TEMP, PROCESSOR_IDENTIFIER, TMP, USERNAME" Process "svchost.exe" (UID: 00070657-00000900) was launched with modified environment variables: "Path, LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "svchost.exe" (UID: 00070657-00000900) was launched with missing environment variables: "LOGONSERVER, SESSIONNAME, HOMEPATH, HOMEDRIVE" Process "svchost.exe" (UID: 00070686-00000872) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "svchost.exe" (UID: 00070713-00000748) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP, USERNAME" Process "svchost.exe" (UID: 00071144-00000584) was launched with modified environment variables: "LOCALAPPDATA, TEMP, APPDATA, USERPROFILE, TMP"29:T402,The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa c09, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 94:94:A5:9C:AE:3B:D3:54:DB:A1:C1:94:12:80:DB:8E:46:39:2B:10; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 12:D4:87:2B:C3:EF:01:9E:7E:0B:6F:13:24:80:AE:29:DB:5B:1C:A3; see report for more information)2a:T1093,Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "crl.verisign.com/ThawteTimestampingCA.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://ocsp.verisign.com01" Pattern match: "http://crl.verisign.com/pca3.crl0" Heuristic match: "gacyzuz.com" Pattern match: "http://www.google.com" Heuristic match: "purycap.com" Heuristic match: "gacyryw.com" Heuristic match: "lymyxid.com" Heuristic match: "lysyfyj.com" Heuristic match: "vowycac.com" Heuristic match: "qexyryl.com" Heuristic match: "vowydef.com" Heuristic match: "qetyfuv.com" Heuristic match: "lyvyxor.com" Heuristic match: "lyxylux.com" Heuristic match: "gatyfus.com" Heuristic match: "pupybul.com" Heuristic match: "qedynul.com" Heuristic match: "qegyqaq.com" Heuristic match: "qexylup.com" Heuristic match: "vocyruk.com" Heuristic match: "galykes.com" Heuristic match: "lyryfyd.com" Heuristic match: "qekykev.com" Heuristic match: "vonypom.com" Heuristic match: "vocyzit.com" Heuristic match: "lymysan.com" Heuristic match: "gadyniw.com" Heuristic match: "ww1.lysyfyj.com" Pattern match: "www.gadyniw.com" Heuristic match: "ganyzub.com" Heuristic match: "lyrysor.com" Heuristic match: "purypol.com" Heuristic match: "puzyjoq.com" Heuristic match: "gaqypiz.com" Heuristic match: "lymytux.com" Heuristic match: "vopycom.com" Heuristic match: "pupycag.com" Heuristic match: "vojygut.com" Heuristic match: "lygynud.com" Heuristic match: "puvywav.com" Heuristic match: "lyxymin.com" Heuristic match: "gacyqob.com" Heuristic match: "lyryxij.com" Heuristic match: "vowyzuk.com" Heuristic match: "gadydas.com" Heuristic match: "volybec.com" Heuristic match: "volydot.com" Heuristic match: "puzybep.com" Heuristic match: "vojycif.com" Heuristic match: "lysytyr.com" Heuristic match: "qetyrap.com" Heuristic match: "pupylaq.com" Heuristic match: "gadypuw.com" Heuristic match: "galyvas.com" Heuristic match: "vocybam.com" Heuristic match: "vonyjim.com" Heuristic match: "vocygyk.com" Heuristic match: "qetykol.com" Heuristic match: "vopyret.com" Heuristic match: "qeqykog.com" Heuristic match: "gatyrez.com" Heuristic match: "qeqyqiv.com" Heuristic match: "gadyrab.com" Heuristic match: "lyvyfad.com" Heuristic match: "vocydof.com" Heuristic match: "ganyvoz.com" Heuristic match: "gatyhub.com" Heuristic match: "qetyhyg.com" Heuristic match: "vonygec.com" Heuristic match: "qebyfav.com" Heuristic match: "qetyquq.com" Heuristic match: "purymuq.com" Heuristic match: "pupyjuv.com" Heuristic match: "gadykos.com" Heuristic match: "ww55.gatyhub.com" Heuristic match: "vowygem.com" Heuristic match: "qetynev.com" Heuristic match: "gahyraw.com" Heuristic match: "vojykom.com" Heuristic match: "qegyrol.com" Heuristic match: "vocycuc.com" Heuristic match: "pupymyp.com" Heuristic match: "vonydik.com" Heuristic match: "pumydoq.com" Heuristic match: "vocypyt.com" Heuristic match: "puzytap.com" Heuristic match: "qedyhyl.com" Heuristic match: "gacypyz.com" Heuristic match: "volyrac.com" Heuristic match: "ganycuh.com" Heuristic match: "gatynes.com" Heuristic match: "vopygat.com" Heuristic match: "qegykiq.com" Heuristic match: "gahyqub.com" Heuristic match: "pujywiv.com" Heuristic match: "vofymem.com" Heuristic match: "qexylal.com" Heuristic match: "lyxylor.com" Heuristic match: "lykyjux.com" Heuristic match: "pupyboq.com" Heuristic match: "qexyriq.com" Heuristic match: "gahyhys.com" Heuristic match: "purycul.com" Heuristic match: "vocyrom.com" Heuristic match: "gacyroh.com" Heuristic match: "pumyxep.com" Heuristic match: "puzywuq.com" Heuristic match: "vonyzac.com" Heuristic match: "lygymyn.com" Heuristic match: "vojyjyc.com" Heuristic match: "lyxywij.com" Heuristic match: "vowydic.com" Heuristic match: "volykit.com" Heuristic match: "galykiz.com" Heuristic match: "puzylol.com" Heuristic match: "<.cat"2b:T724,"" queried SystemProcessInformation at 00068810-00002504-00000105-16021616650 "" queried SystemProcessInformation at 00068810-00002504-00000105-16087571256 "" queried SystemProcessInformation at 00068810-00002504-00000105-16150583517 "" queried SystemProcessInformation at 00068810-00002504-00000105-16178065945 "" queried SystemProcessInformation at 00068810-00002504-00000105-20485147313 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-24226721836 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-44116466761 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-44659769738 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-47683086706 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-48573911628 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-49097835021 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-49602257062 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-50128771630 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-50628421451 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-51158911071 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-51688587737 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-52228157465 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-52767436770 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-53308816333 "winlogon.exe" queried SystemProcessInformation at 00069922-00000416-00000105-538332558052c:T80d,"" wrote bytes "4053127758581377186a1377653c14770000000000bf80760000000056cc8076000000007cca807600000000376831756a2c1477d62d147700000000206931750000000029a6807600000000a48d317500000000f70e807600000000" to virtual address "0x768C1000" (part of module "NSI.DLL") "conhost.exe" wrote bytes "4053127758581377186a1377653c14770000000000bf80760000000056cc8076000000007cca807600000000376831756a2c1477d62d147700000000206931750000000029a6807600000000a48d317500000000f70e807600000000" to virtual address "0x768C1000" (part of module "NSI.DLL") "conhost.exe" wrote bytes "5590ff2500002a01" to virtual address "0x01280008" "conhost.exe" wrote bytes "04002401680464122c9c81742404545a032d" to virtual address "0x01240000" "conhost.exe" wrote bytes "8bff558bec8b55105590ff2500002601" to virtual address "0x01250000" "conhost.exe" wrote bytes "5590ff2500001d01" to virtual address "0x75612BA7" "conhost.exe" wrote bytes "0400260168c2a0bb589c8174240463b8db2d" to virtual address "0x01260000" "conhost.exe" wrote bytes "8bff558bec568b75" to virtual address "0x756064C7" "conhost.exe" wrote bytes "0400270168567f5b2f9c81742404d6404a2e" to virtual address "0x01270000" "conhost.exe" wrote bytes "8bff558bec8b55105590ff2500002a01" to virtual address "0x01280000" "conhost.exe" wrote bytes "5590ff2500002b01" to virtual address "0x7560CDE8" "conhost.exe" wrote bytes "04002a01684ff9655a9c81742404bf34052f" to virtual address "0x012A0000" "conhost.exe" wrote bytes "04002b0168124c672e9c81742404a20c762f" to virtual address "0x012B0000" "conhost.exe" wrote bytes "b805010000ba0003" to virtual address "0x771361F8" "conhost.exe" wrote bytes "5590ff2500002601" to virtual address "0x01250008" "conhost.exe" wrote bytes "b805010000ba0003fe7f5590ff2500003101" to virtual address "0x01300000" "conhost.exe" wrote bytes "8bff558bec83ec2c5590ff2500001801" to virtual address "0x01170000" "conhost.exe" wrote bytes "5590ff2500001f01" to virtual address "0x011E0009" "conhost.exe" wrote bytes "0400180168ece06e829c8174240443cb0ff7" to virtual address "0x01180000"2d:T54d,Injected into "winlogon.exe" at 2018-12-8.04:09:00.250 (UID: 00069922-00000416) Injected into "conhost.exe" at 2018-12-8.04:14:00.280 (UID: 00070328-00003376) Injected into "conhost.exe" at 2018-12-8.04:14:00.290 (UID: 00070404-00003972) Injected into "conhost.exe" at 2018-12-8.04:14:00.400 (UID: 00070419-00000316) Injected into "svchost.exe" at 2018-12-8.04:14:00.420 (UID: 00070430-00001632) Injected into "svchost.exe" at 2018-12-8.04:17:01.081 (UID: 00070446-00001968) Injected into "explorer.exe" at 2018-12-8.04:14:00.000 (UID: 00070497-00001428) Injected into "dwm.exe" at 2018-12-8.04:14:00.010 (UID: 00070511-00001404) Injected into "taskhost.exe" at 2018-12-8.04:14:00.000 (UID: 00070531-00001312) Injected into "svchost.exe" at 2018-12-8.04:17:01.081 (UID: 00070557-00001296) Injected into "svchost.exe" at 2018-12-8.04:14:00.310 (UID: 00070585-00001108) Injected into "svchost.exe" at 2018-12-8.04:17:00.741 (UID: 00070610-00001016) Injected into "svchost.exe" at 2018-12-8.04:14:00.000 (UID: 00070657-00000900) Injected into "svchost.exe" at 2018-12-8.04:17:01.081 (UID: 00070686-00000872) Injected into "svchost.exe" at 2018-12-8.04:17:01.081 (UID: 00070713-00000748) Injected into "svchost.exe" at 2018-12-8.04:18:00.360 (UID: 00071098-00000696) Injected into "svchost.exe" at 2018-12-8.04:18:00.731 (UID: 00071144-00000584)2e:Tb64,"" wrote 1024 bytes to a remote process "C:\Windows\System32\winlogon.exe" (Handle: 184) "" wrote 1556 bytes to a remote process "C:\Windows\System32\winlogon.exe" (Handle: 184) "" wrote 334848 bytes to a remote process "C:\Windows\System32\winlogon.exe" (Handle: 184) "" wrote 96 bytes to a remote process "C:\Windows\System32\winlogon.exe" (Handle: 184) "" wrote 338432 bytes to a remote process "C:\Windows\System32\winlogon.exe" (Handle: 184) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\System32\conhost.exe" (Handle: 860) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\VBoxService.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\System32\VBoxService.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\System32\VBoxService.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\System32\VBoxService.exe" (Handle: 860) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 860) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\explorer.exe" (Handle: 860) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\System32\dwm.exe" (Handle: 860) "winlogon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 860) "winlogon.exe" wrote 1556 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 860) "winlogon.exe" wrote 334848 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 860) "winlogon.exe" wrote 96 bytes to a remote process "C:\Windows\System32\taskhost.exe" (Handle: 860)2f:T4e95,Found malicious artifacts related to "35.225.160.245": ... URL: https://krishnagrp.com/ (AV positives: 4/70 scanned on 12/07/2018 17:30:30) URL: http://mdkxmjiwmtga.info/ (AV positives: 2/69 scanned on 12/07/2018 16:38:07) URL: http://hnulmkfbixp.biz/ (AV positives: 2/69 scanned on 12/07/2018 16:35:58) URL: http://mdgxmjiwmtga.info/ (AV positives: 2/69 scanned on 12/07/2018 16:20:05) URL: http://huprousirqebs.info/ (AV positives: 2/69 scanned on 12/07/2018 16:17:16) File SHA256: 9c287fce18f29528fa4c5d1b51df6e361bcca36bad4f680f4f8b93cc965c5642 (AV positives: 40/72 scanned on 12/07/2018 11:35:39) File SHA256: 24eac3b7d3cd7e36572d659619d1f42f827a66e8f08835d194ac72fb0befe895 (AV positives: 52/71 scanned on 12/07/2018 00:53:46) File SHA256: 041a30bbafb012f323217392258cf29ec7d2297ddee42e4a602570b4908e8a90 (AV positives: 54/71 scanned on 12/07/2018 00:37:25) File SHA256: d330a8a42000f10cc16c3795679b672b6dc952350ede2d3fcd096324b639e83c (AV positives: 37/69 scanned on 12/06/2018 23:36:27) File SHA256: bb66acb95a10dc694c79721e43d7c4e83de1affb5e69c371726ede176788cf45 (AV positives: 49/69 scanned on 12/05/2018 16:42:55) File SHA256: 36c4ba8689536fcc0954195aec8d74e639d0ee53eabd4ae5b2ea05981edc421f (Date: 12/05/2018 02:43:09) File SHA256: ec02dc5ed6fa23149caef0d63dcc41e6fabce98290cc0568632a40f1f0c06d73 (Date: 12/04/2018 19:10:13) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: d4687be82024818ced8d7aa7fbec67b16114b54a78c4b13e7d80598d4cd1e57f (Date: 12/01/2018 15:54:32) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) Found malicious artifacts related to "23.253.126.58": ... URL: http://qekynuq.com/get_json (AV positives: 5/66 scanned on 12/07/2018 22:52:56) URL: http://qqaz.info/cjtest/conf.jspv=5&pk=10611&uid%3oJlfosY234JsCWjsLf10SrybubS0QAEk (AV positives: 3/66 scanned on 12/07/2018 22:49:41) URL: http://full-set.link/?q=1jk78R2dRwhLSWOtvqT4lxgGFTPLTAj702gNxX7NdXpvmicCu2DDoq9xmbdDMZORuj%2BghfbFGDtvzbW9ge134n3Okqm63J5b8GWXXWourbWztfhxb%2BBUOJSrlcOJlt%2Bz3DE%2BfMyQFob1Sh%2BI4bOEfypPvublTOIYrGnMgjOIAxP4DBMFdB1XF25tsZWSmfAgq2XInBcH%2FbSRgwLADy8fu0oun%2F4uJ4aLpeM1QfydnO%2BEWeD8m4tx%2Fn2Zut5n0yz75YSwc5M7OLHoMOlU8goeMVLyeuLaUglYWMVKytoD1BvCHcSedgCChiCC8tTl91y0wqsmijGoMA3VJbv0Az2CMzzk6i04ckCIredZJVD%2FlqWwze2r2h70JLvC6P4i (AV positives: 9/66 scanned on 12/07/2018 22:08:49) URL: http://full-set.link/?q=maNsu2LuH9nAEfxhQI2YTS0H2DS3FAz20vlRSXiPQi9175nZzoyWre%2F%2BOpel2a1ygb2XZKVozaXqgBBrwXLOAhro4yxI6j0uhVax77zuHZVYxH0J%2BhrIY%2FWD9apWo0fjC4B3WK5GbuUYM%2B%2BBgk6Tsl4uBTznndH1g6oaNYV8zjlhQzP2kO4KjjhXJhd695Asr2waBx7afdqWSTmwKpRLeUnkBH%2FKzPPTHdAugYC7msjzXvpk%2FluN%2FKnps8fofqXd7RGFngvDxX7gaqyxPnP4wr3S4OiAqDjS4X%2Bzh6jvbHnzxvMb08mh0kw6tVimN5ve9533%2BrCD9ulpsXlfOByoLCpcrR2etzU8B2qiOIj0oglqahkVSjwuxpoElp7kg (AV positives: 9/66 scanned on 12/07/2018 22:06:51) URL: https://6cd66dcf.ddr-cash.net/ (AV positives: 4/69 scanned on 12/07/2018 21:38:01) File SHA256: 8ae540d8795f267a9c8abeea7d2f5138b0abf96406162ae49de5a21a760f4380 (AV positives: 52/68 scanned on 12/07/2018 22:44:34) File SHA256: 295ecd3617ee6ebfce5546cc5857c9b5a2621bc89394dbea88b32121569a1d1d (AV positives: 58/71 scanned on 12/07/2018 21:24:32) File SHA256: 4cf819cfe67b2413b679b6c21b8f442407a11a076a1820463bf56f0b4a4337a7 (AV positives: 58/69 scanned on 12/07/2018 21:24:27) File SHA256: 23e22ae90f9be7786fb1da3cfdd0d6d0e3222a901625b93e6af752541399409f (AV positives: 55/67 scanned on 12/07/2018 21:23:01) File SHA256: b128a5d2e71f5773f913b7e945b0a6ea0c179dbc516323e7a2c4213a2ec42382 (AV positives: 57/70 scanned on 12/07/2018 21:21:55) File SHA256: 6af1d560f432ca17f16b4c9da6d7bf2d123c90e8f38a739dd1873a56ab553897 (Date: 12/07/2018 17:10:02) File SHA256: 342023dba421877c8e6147895d2efe84a9846eae9ce814c673075e64ff981e46 (Date: 12/07/2018 17:01:39) File SHA256: d6d15026e8ae2fe328c792bd94e39fc3e6300d44e4728753af40adb3781dd418 (Date: 12/05/2018 22:48:17) File SHA256: 1b2c17c6957d7e615be424979ff783c8ef403fa0f415047fe11e576eb15dbb4a (Date: 12/05/2018 21:17:21) File SHA256: 4d28f76301244dfbd8c85cedbc2d34f1703f377e6d5042fa7cc8e0de7d8dd3b1 (Date: 12/05/2018 13:02:32) Found malicious artifacts related to "103.224.212.222": ... URL: http://goopet.net/81-%D0%B7%D0%B0%D0%BC%D0%B5%D1%87%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D0%BE-%D0%B7%D0%B0%D0%B1%D0%BE%D1%80-%D0%B8%D0%B7-%D0%BF%D0%BB%D0%B0%D1%81%D1%82%D0%B8%D0%BA%D0%BE%D0%B2%D1%8B%D1%85-%D0%B1%D1%83/%D0%BE%D0%B3%D1%80%D0%B0%D0%B6%D0%B4% (AV positives: 3/66 scanned on 12/07/2018 22:50:32) URL: http://com-securityscan.com/ (AV positives: 4/66 scanned on 12/07/2018 22:44:30) URL: http://zoauanuyaz.org/ (AV positives: 2/70 scanned on 12/07/2018 22:30:11) URL: http://solluxboats.com/ (AV positives: 1/66 scanned on 12/07/2018 22:34:43) URL: http://cygnusnepal.com/ (AV positives: 1/66 scanned on 12/07/2018 22:33:12) File SHA256: 14a6c8fc65d1762f94935d61393d70374f32d0a8acbaf9c21d243ee28333be94 (AV positives: 1/56 scanned on 12/07/2018 17:53:38) File SHA256: 9221cfedfc5e03790f46c7890bca21fcc47c5788d89dab0aa0799c492b6ae78a (AV positives: 1/56 scanned on 12/07/2018 14:49:28) File SHA256: 268b50bd821e7eff1bc60353c46ef3a1e48871671c919836a5615d62fa53de8d (AV positives: 58/69 scanned on 12/07/2018 17:41:49) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: b00d1ca46c6a85e36b40d5f5f595d1d360f760c6564f0c89139ffc05a8d61184 (AV positives: 55/70 scanned on 12/07/2018 15:03:51) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 568ab2b1c2ccf2930699e0a144711ce9ddee51e9104c21b866e6de9e3a2a7bc8 (Date: 12/03/2018 01:54:12) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) Found malicious artifacts related to "217.70.184.38": ... URL: http://happycouple.co/assets/nl/howto_1_1.png (AV positives: 1/66 scanned on 12/07/2018 22:57:29) URL: http://miseadispo.com/banquepopulaire (AV positives: 10/67 scanned on 12/07/2018 22:57:19) URL: http://brothersinhams.com/qsl-cards/20-14fr938-logs-confirmed/312-102sdkdt (AV positives: 8/66 scanned on 12/07/2018 22:24:44) URL: http://brothersinhams.fr/fdc/167-fdc-telegraph/402-fdc-thailand-100th-anniversary-of-tellegraph-service (AV positives: 5/66 scanned on 12/07/2018 22:22:55) URL: http://brothersinhams.com/stories/2-antennas/181-pour-le-funsimplement- (AV positives: 7/66 scanned on 12/07/2018 22:18:37) File SHA256: 50817246ab1bd63dcf358800c92eefce91cc207abb65f1cdaf640ac60cc804c5 (AV positives: 33/59 scanned on 12/07/2018 18:13:05) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/55 scanned on 12/06/2018 06:28:08) File SHA256: e074af54b3cdb81f8987fe8476c87c75e0d38b831b98ddfcabbe553ae783ebe3 (AV positives: 1/58 scanned on 12/05/2018 06:11:50) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15) Found malicious artifacts related to "208.100.26.251": ... URL: http://36f46a0b49.pw/ (AV positives: 1/66 scanned on 12/07/2018 22:52:48) URL: http://ucvqcpq.pw/ (AV positives: 2/66 scanned on 12/07/2018 22:52:38) URL: http://jeffersonpleasance.net/ (AV positives: 1/66 scanned on 12/07/2018 22:51:28) URL: http://gatherservice.net/ (AV positives: 1/66 scanned on 12/07/2018 22:51:25) URL: http://difficultshout.net/ (AV positives: 1/66 scanned on 12/07/2018 22:21:23) File SHA256: ef679a18c40cf28dc0f871ce29b20eaca15aef515295534dc8d91cad26f46415 (AV positives: 57/69 scanned on 12/07/2018 21:22:05) File SHA256: d91a93d92188a5ea35e5ad0b5b9ec1899dc5dd1a0ffa12558d5174382cd2dfa7 (AV positives: 57/69 scanned on 12/07/2018 21:20:19) File SHA256: 79b449e47fc61217a5981d5c3faa6b54bfd831dc7e1c018aea333058ea7102c2 (AV positives: 59/71 scanned on 12/07/2018 16:06:13) File SHA256: 14a90abf5806a406887c42fa0a6e9df8f5d064f5696690300110a0efbd28ccf8 (AV positives: 56/69 scanned on 12/07/2018 16:48:37) File SHA256: 38b69e11e46916a8b6d840befb6abf2f25e2dd2a81ee88be587abdd70461aa8c (AV positives: 58/68 scanned on 12/07/2018 16:37:46) File SHA256: a00ebb3e688739233f69aad1d8d3f8cde6304e2e305b236a29dafe44ff3d7d4e (Date: 12/07/2018 17:57:05) File SHA256: ee6a173abc9b82f9e784ee029ed2abaed2d66d7ecc799c43ec3042cf0b37bb03 (Date: 12/07/2018 17:54:51) File SHA256: b3ee3737c93d313e5ac691ea286ca05c558b0e8bfb80c718826641283068ce5a (Date: 12/05/2018 15:10:13) File SHA256: 36c4ba8689536fcc0954195aec8d74e639d0ee53eabd4ae5b2ea05981edc421f (Date: 12/05/2018 02:43:09) File SHA256: 996d627d9b00f2d340f4ab1b93c1cdec2a4c16c588908efcc794c0a8d3e28cca (Date: 12/05/2018 02:37:55) Found malicious artifacts related to "67.55.121.97": ... URL: http://xvq7q4u3i9aaafr.pwg5p5vd.com/ (AV positives: 5/67 scanned on 12/07/2018 19:39:49) URL: http://rnbbes.pwg5p5vd.com/ (AV positives: 5/67 scanned on 12/07/2018 19:39:36) URL: http://faeriemoans.com/xyc/oods/gdoc/filewords/index.php (AV positives: 4/66 scanned on 12/07/2018 18:16:40) URL: http://dmeneghetti.com/ (AV positives: 4/66 scanned on 12/07/2018 17:21:46) URL: http://f1.storeglobal-best.com/x0108/18/4484/bluestacks-app-player_10.exe (AV positives: 3/66 scanned on 12/07/2018 10:26:13) File SHA256: 04e8d079a996461340a2101a35d7041e0fd3ae19f0b088d409976fa737ada219 (AV positives: 3/58 scanned on 12/07/2018 18:16:44) File SHA256: dc3131206e4a7485f4416ef986c4aa902f236f44d70f0a2ab2759413c64003e9 (AV positives: 3/57 scanned on 12/07/2018 10:26:17) File SHA256: ab0d736ec4449bb56003d36c4d8d618e801be3cd9406685ad36f7b2480c53aa1 (AV positives: 5/60 scanned on 12/07/2018 10:19:53) File SHA256: 2c94f29136febc4977b3b6357005b925515136a5e2fc08f6c93638468b6264e5 (AV positives: 3/59 scanned on 12/07/2018 02:54:46) File SHA256: 61ba55926a9864c0c2dfde9b2e574a2660297d219d4db95cd530b14ecd2fdfcc (AV positives: 3/57 scanned on 12/07/2018 01:51:53) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 768b8e6627dc0d472b6ce02d9f42b2cc720a5e05ccb8cdbcb7165dc3bb1a5ace (Date: 12/02/2018 20:53:31) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) Found malicious artifacts related to "35.231.151.7": ... URL: http://ttpruarjjudvlj.us/ (AV positives: 6/67 scanned on 12/07/2018 21:59:51) URL: http://tevgmqphhtqytj.us/ (AV positives: 1/66 scanned on 12/07/2018 21:52:20) URL: http://xdqzpbcgrvkj.ru/in.php (AV positives: 6/66 scanned on 12/07/2018 21:49:10) URL: http://qtsuphrrkvnixxu.us/ (AV positives: 6/67 scanned on 12/07/2018 21:17:01) URL: http://pehpycdhmnpacdqsp.us/ (AV positives: 2/66 scanned on 12/07/2018 21:07:29) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: ecc12a9bca8c916902d1bbe46f1d0e167594c4857590d0c913e4a7999e4a785f (AV positives: 40/67 scanned on 12/07/2018 14:21:51) File SHA256: 9c287fce18f29528fa4c5d1b51df6e361bcca36bad4f680f4f8b93cc965c5642 (AV positives: 40/71 scanned on 12/07/2018 11:39:38) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 041a30bbafb012f323217392258cf29ec7d2297ddee42e4a602570b4908e8a90 (AV positives: 54/71 scanned on 12/07/2018 00:37:25) File SHA256: ec02dc5ed6fa23149caef0d63dcc41e6fabce98290cc0568632a40f1f0c06d73 (Date: 12/04/2018 19:10:13) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0d74c3f33e09e5ef54d407020b97ef6e273a9692c340f0bc8c3f3f49022998db (Date: 12/01/2018 15:48:53) File SHA256: eb08d00932bc1441c0d80d52e1a3773563e45b6ea30f83bbed58a300728e24b4 (Date: 12/01/2018 14:29:35) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) Found malicious artifacts related to "195.22.4.21": ... URL: http://ariveagain.net/ (AV positives: 4/70 scanned on 12/07/2018 21:58:03) URL: http://sa2.adsnike.com/active.php%20 (AV positives: 3/66 scanned on 12/07/2018 21:57:21) URL: http://christabellelongstaff.net/ (AV positives: 3/66 scanned on 12/07/2018 21:15:40) URL: http://taiborucheng.com/b/opt/408A4FA22B4F3AE9028C285E/ (AV positives: 2/70 scanned on 12/07/2018 20:53:48) URL: http://xsso.presto-ferr.com/f85c842334e1abe79d25d82d24ef5038 (AV positives: 5/66 scanned on 12/07/2018 20:40:31) File SHA256: 5e68906b1dc20f4c84af5a89f5323a23fa5411cb7eece7ea9129cb64eac85d25 (AV positives: 35/71 scanned on 12/07/2018 21:59:06) File SHA256: 4bdc16583b5b1d797fdfa3637555d376e5725cf0718f705278459a43453bc312 (AV positives: 35/70 scanned on 12/07/2018 18:43:11) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: b9233b05e1cc1b6e53a40cbb0b79e27efafb988713775b6ba2e0b7a607707a05 (AV positives: 34/69 scanned on 12/07/2018 10:35:25) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:41) File SHA256: c692f1dea6057958a6f04a52b7dab4fd7113a9ae8832b15909d08de7f6e837dd (Date: 12/05/2018 17:25:33) File SHA256: 74a5662db619b68cc0d4a65d0959728fe6ef31e5f65fb3f927a5539831e6fb06 (Date: 12/05/2018 17:04:40) File SHA256: af3b0a691280734d14b97732b41a88c0dab5db49c498e53911bbf255af0cd7bc (Date: 12/05/2018 16:32:42) File SHA256: fbc10190ef71dea1101962df324fff0e7e664e2ffb54d76b149420d54de2dc0c (Date: 12/04/2018 22:39:39) File SHA256: 8ac7d78c49f9f38fbabbf0734cf6761f99f0c1027fac63c29fd9ff2f62c5de0c (Date: 12/03/2018 21:48:44) Found malicious artifacts related to "107.172.147.54": ... URL: http://www.gadyniw.com/hbt.php?rewrite=NiNmZ/TSPMZ/login.php (AV positives: 5/66 scanned on 12/07/2018 18:03:52) URL: http://gadyniw.com/NiNmZ/TSPMZ/login.php (AV positives: 4/66 scanned on 12/07/2018 18:03:48) URL: http://www.gadyniw.com/hbt.php?rewrite=ZfchZ/login.php (AV positives: 5/66 scanned on 12/07/2018 17:58:14) URL: http://gadyniw.com/ZfchZ/login.php (AV positives: 4/66 scanned on 12/07/2018 17:58:10) URL: http://www.gadyniw.com/hbt.php?rewrite=UXVeZ/login.php (AV positives: 5/66 scanned on 12/07/2018 17:58:07) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:36) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 17e996cad548c9c6d44cf3ba06f5fe516e55347b264264635c97ed93691076d7 (AV positives: 57/70 scanned on 12/05/2018 15:08:16) File SHA256: d5ae5ca71b8ba1ceb71d25637ca2b82fa293330be82b5124d9cd33d5730c0db5 (AV positives: 59/69 scanned on 12/04/2018 13:32:32) File SHA256: 837137b22a85e8c6f179f805a365f950ca36f08c635df35030a50a5c52cf3abc (AV positives: 49/68 scanned on 12/04/2018 09:06:02) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15) Found malicious artifacts related to "91.195.240.46": ... URL: http://ww1.ysbweb.com/ist/scripts/exe_version.php?aid=1003866&cfg=ysb_m3&vkey=211111 (AV positives: 8/70 scanned on 12/07/2018 17:58:15) URL: http://ww1.arbsecret.com/12.jpg (AV positives: 2/66 scanned on 12/07/2018 17:53:37) URL: http://ww1.css-nkp.net/_ld/119/11945_MadeCheat_v2.5.rar (AV positives: 6/67 scanned on 12/07/2018 17:49:08) URL: http://ww1.lysyfyj.com/LkPOZ/login.php (AV positives: 6/67 scanned on 12/07/2018 17:48:10) URL: http://ww1.lysyfyj.com/WnKbZ/login.php (AV positives: 6/67 scanned on 12/07/2018 17:48:07) File SHA256: 14a6c8fc65d1762f94935d61393d70374f32d0a8acbaf9c21d243ee28333be94 (AV positives: 1/56 scanned on 12/07/2018 17:53:41) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:36) File SHA256: d8f22a3727bbb0f7435ea44165a1a1decda96cd0077c48f51a0ac8c19e6b6de6 (AV positives: 56/70 scanned on 12/07/2018 11:53:59) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 605376faec8c9021ff979bdc36316c4cd277bbdd220fa9fa2ea44ad7624f4b3f (AV positives: 54/69 scanned on 12/06/2018 11:48:05) File SHA256: 716d461e82f3f60fd68ea8120021710f36999f5d24330a60e849b01bfac7cdf9 (Date: 11/22/2018 09:54:37) File SHA256: 20212b1a47b8c1b25f174f0b6f6e0ce9a13fd2240b751bd2ea4c319d09c1c52f (Date: 11/22/2018 06:22:33) File SHA256: 40444d815c733d1d77fc7a9c065d854d062fc9d59f02b91b26209fce2d5a7097 (Date: 11/21/2018 01:40:54) File SHA256: 8729166e26d67f34c379cd7ace3fb9a381b4a487823ff2ea3ac478c4898f67ac (Date: 10/18/2018 14:03:47) File SHA256: e642b32bdcd1a7fc190c5334443eb4988eb3965a54f0d605eb89dd45fd5df0a4 (Date: 10/18/2018 01:52:12) Found malicious artifacts related to "23.89.102.68": ... URL: http://lygynud.com/login.php (AV positives: 6/66 scanned on 11/30/2018 02:16:45) URL: http://lygynud.com/ (AV positives: 5/66 scanned on 11/29/2018 12:41:00) URL: http://lygynud.com/index.html (AV positives: 4/66 scanned on 11/26/2018 02:11:12) URL: http://lygynud.com/home.php (AV positives: 5/66 scanned on 11/21/2018 10:27:37) URL: http://23.89.102.68/ (AV positives: 1/67 scanned on 10/19/2018 02:16:08) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 17e996cad548c9c6d44cf3ba06f5fe516e55347b264264635c97ed93691076d7 (AV positives: 57/70 scanned on 12/05/2018 15:08:15) File SHA256: d5ae5ca71b8ba1ceb71d25637ca2b82fa293330be82b5124d9cd33d5730c0db5 (AV positives: 59/69 scanned on 12/04/2018 13:32:32) File SHA256: 837137b22a85e8c6f179f805a365f950ca36f08c635df35030a50a5c52cf3abc (AV positives: 49/68 scanned on 12/04/2018 09:06:03) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15)30:T4e95,Found malicious artifacts related to "35.225.160.245": ... URL: https://krishnagrp.com/ (AV positives: 4/70 scanned on 12/07/2018 17:30:30) URL: http://mdkxmjiwmtga.info/ (AV positives: 2/69 scanned on 12/07/2018 16:38:07) URL: http://hnulmkfbixp.biz/ (AV positives: 2/69 scanned on 12/07/2018 16:35:58) URL: http://mdgxmjiwmtga.info/ (AV positives: 2/69 scanned on 12/07/2018 16:20:05) URL: http://huprousirqebs.info/ (AV positives: 2/69 scanned on 12/07/2018 16:17:16) File SHA256: 9c287fce18f29528fa4c5d1b51df6e361bcca36bad4f680f4f8b93cc965c5642 (AV positives: 40/72 scanned on 12/07/2018 11:35:39) File SHA256: 24eac3b7d3cd7e36572d659619d1f42f827a66e8f08835d194ac72fb0befe895 (AV positives: 52/71 scanned on 12/07/2018 00:53:46) File SHA256: 041a30bbafb012f323217392258cf29ec7d2297ddee42e4a602570b4908e8a90 (AV positives: 54/71 scanned on 12/07/2018 00:37:25) File SHA256: d330a8a42000f10cc16c3795679b672b6dc952350ede2d3fcd096324b639e83c (AV positives: 37/69 scanned on 12/06/2018 23:36:27) File SHA256: bb66acb95a10dc694c79721e43d7c4e83de1affb5e69c371726ede176788cf45 (AV positives: 49/69 scanned on 12/05/2018 16:42:55) File SHA256: 36c4ba8689536fcc0954195aec8d74e639d0ee53eabd4ae5b2ea05981edc421f (Date: 12/05/2018 02:43:09) File SHA256: ec02dc5ed6fa23149caef0d63dcc41e6fabce98290cc0568632a40f1f0c06d73 (Date: 12/04/2018 19:10:13) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: d4687be82024818ced8d7aa7fbec67b16114b54a78c4b13e7d80598d4cd1e57f (Date: 12/01/2018 15:54:32) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) Found malicious artifacts related to "23.253.126.58": ... URL: http://qekynuq.com/get_json (AV positives: 5/66 scanned on 12/07/2018 22:52:56) URL: http://qqaz.info/cjtest/conf.jspv=5&pk=10611&uid%3oJlfosY234JsCWjsLf10SrybubS0QAEk (AV positives: 3/66 scanned on 12/07/2018 22:49:41) URL: http://full-set.link/?q=1jk78R2dRwhLSWOtvqT4lxgGFTPLTAj702gNxX7NdXpvmicCu2DDoq9xmbdDMZORuj%2BghfbFGDtvzbW9ge134n3Okqm63J5b8GWXXWourbWztfhxb%2BBUOJSrlcOJlt%2Bz3DE%2BfMyQFob1Sh%2BI4bOEfypPvublTOIYrGnMgjOIAxP4DBMFdB1XF25tsZWSmfAgq2XInBcH%2FbSRgwLADy8fu0oun%2F4uJ4aLpeM1QfydnO%2BEWeD8m4tx%2Fn2Zut5n0yz75YSwc5M7OLHoMOlU8goeMVLyeuLaUglYWMVKytoD1BvCHcSedgCChiCC8tTl91y0wqsmijGoMA3VJbv0Az2CMzzk6i04ckCIredZJVD%2FlqWwze2r2h70JLvC6P4i (AV positives: 9/66 scanned on 12/07/2018 22:08:49) URL: http://full-set.link/?q=maNsu2LuH9nAEfxhQI2YTS0H2DS3FAz20vlRSXiPQi9175nZzoyWre%2F%2BOpel2a1ygb2XZKVozaXqgBBrwXLOAhro4yxI6j0uhVax77zuHZVYxH0J%2BhrIY%2FWD9apWo0fjC4B3WK5GbuUYM%2B%2BBgk6Tsl4uBTznndH1g6oaNYV8zjlhQzP2kO4KjjhXJhd695Asr2waBx7afdqWSTmwKpRLeUnkBH%2FKzPPTHdAugYC7msjzXvpk%2FluN%2FKnps8fofqXd7RGFngvDxX7gaqyxPnP4wr3S4OiAqDjS4X%2Bzh6jvbHnzxvMb08mh0kw6tVimN5ve9533%2BrCD9ulpsXlfOByoLCpcrR2etzU8B2qiOIj0oglqahkVSjwuxpoElp7kg (AV positives: 9/66 scanned on 12/07/2018 22:06:51) URL: https://6cd66dcf.ddr-cash.net/ (AV positives: 4/69 scanned on 12/07/2018 21:38:01) File SHA256: 8ae540d8795f267a9c8abeea7d2f5138b0abf96406162ae49de5a21a760f4380 (AV positives: 52/68 scanned on 12/07/2018 22:44:34) File SHA256: 295ecd3617ee6ebfce5546cc5857c9b5a2621bc89394dbea88b32121569a1d1d (AV positives: 58/71 scanned on 12/07/2018 21:24:32) File SHA256: 4cf819cfe67b2413b679b6c21b8f442407a11a076a1820463bf56f0b4a4337a7 (AV positives: 58/69 scanned on 12/07/2018 21:24:27) File SHA256: 23e22ae90f9be7786fb1da3cfdd0d6d0e3222a901625b93e6af752541399409f (AV positives: 55/67 scanned on 12/07/2018 21:23:01) File SHA256: b128a5d2e71f5773f913b7e945b0a6ea0c179dbc516323e7a2c4213a2ec42382 (AV positives: 57/70 scanned on 12/07/2018 21:21:55) File SHA256: 6af1d560f432ca17f16b4c9da6d7bf2d123c90e8f38a739dd1873a56ab553897 (Date: 12/07/2018 17:10:02) File SHA256: 342023dba421877c8e6147895d2efe84a9846eae9ce814c673075e64ff981e46 (Date: 12/07/2018 17:01:39) File SHA256: d6d15026e8ae2fe328c792bd94e39fc3e6300d44e4728753af40adb3781dd418 (Date: 12/05/2018 22:48:17) File SHA256: 1b2c17c6957d7e615be424979ff783c8ef403fa0f415047fe11e576eb15dbb4a (Date: 12/05/2018 21:17:21) File SHA256: 4d28f76301244dfbd8c85cedbc2d34f1703f377e6d5042fa7cc8e0de7d8dd3b1 (Date: 12/05/2018 13:02:32) Found malicious artifacts related to "103.224.212.222": ... URL: http://goopet.net/81-%D0%B7%D0%B0%D0%BC%D0%B5%D1%87%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D0%BD%D0%BE-%D0%B7%D0%B0%D0%B1%D0%BE%D1%80-%D0%B8%D0%B7-%D0%BF%D0%BB%D0%B0%D1%81%D1%82%D0%B8%D0%BA%D0%BE%D0%B2%D1%8B%D1%85-%D0%B1%D1%83/%D0%BE%D0%B3%D1%80%D0%B0%D0%B6%D0%B4% (AV positives: 3/66 scanned on 12/07/2018 22:50:32) URL: http://com-securityscan.com/ (AV positives: 4/66 scanned on 12/07/2018 22:44:30) URL: http://zoauanuyaz.org/ (AV positives: 2/70 scanned on 12/07/2018 22:30:11) URL: http://solluxboats.com/ (AV positives: 1/66 scanned on 12/07/2018 22:34:43) URL: http://cygnusnepal.com/ (AV positives: 1/66 scanned on 12/07/2018 22:33:12) File SHA256: 14a6c8fc65d1762f94935d61393d70374f32d0a8acbaf9c21d243ee28333be94 (AV positives: 1/56 scanned on 12/07/2018 17:53:38) File SHA256: 9221cfedfc5e03790f46c7890bca21fcc47c5788d89dab0aa0799c492b6ae78a (AV positives: 1/56 scanned on 12/07/2018 14:49:28) File SHA256: 268b50bd821e7eff1bc60353c46ef3a1e48871671c919836a5615d62fa53de8d (AV positives: 58/69 scanned on 12/07/2018 17:41:49) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: b00d1ca46c6a85e36b40d5f5f595d1d360f760c6564f0c89139ffc05a8d61184 (AV positives: 55/70 scanned on 12/07/2018 15:03:51) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 568ab2b1c2ccf2930699e0a144711ce9ddee51e9104c21b866e6de9e3a2a7bc8 (Date: 12/03/2018 01:54:12) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) Found malicious artifacts related to "217.70.184.38": ... URL: http://happycouple.co/assets/nl/howto_1_1.png (AV positives: 1/66 scanned on 12/07/2018 22:57:29) URL: http://miseadispo.com/banquepopulaire (AV positives: 10/67 scanned on 12/07/2018 22:57:19) URL: http://brothersinhams.com/qsl-cards/20-14fr938-logs-confirmed/312-102sdkdt (AV positives: 8/66 scanned on 12/07/2018 22:24:44) URL: http://brothersinhams.fr/fdc/167-fdc-telegraph/402-fdc-thailand-100th-anniversary-of-tellegraph-service (AV positives: 5/66 scanned on 12/07/2018 22:22:55) URL: http://brothersinhams.com/stories/2-antennas/181-pour-le-funsimplement- (AV positives: 7/66 scanned on 12/07/2018 22:18:37) File SHA256: 50817246ab1bd63dcf358800c92eefce91cc207abb65f1cdaf640ac60cc804c5 (AV positives: 33/59 scanned on 12/07/2018 18:13:05) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 7da7df6b2ae25a2b32a494dacea2c51b02b173dcb020c79f4df47a92fb497274 (AV positives: 1/55 scanned on 12/06/2018 06:28:08) File SHA256: e074af54b3cdb81f8987fe8476c87c75e0d38b831b98ddfcabbe553ae783ebe3 (AV positives: 1/58 scanned on 12/05/2018 06:11:50) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15) Found malicious artifacts related to "208.100.26.251": ... URL: http://36f46a0b49.pw/ (AV positives: 1/66 scanned on 12/07/2018 22:52:48) URL: http://ucvqcpq.pw/ (AV positives: 2/66 scanned on 12/07/2018 22:52:38) URL: http://jeffersonpleasance.net/ (AV positives: 1/66 scanned on 12/07/2018 22:51:28) URL: http://gatherservice.net/ (AV positives: 1/66 scanned on 12/07/2018 22:51:25) URL: http://difficultshout.net/ (AV positives: 1/66 scanned on 12/07/2018 22:21:23) File SHA256: ef679a18c40cf28dc0f871ce29b20eaca15aef515295534dc8d91cad26f46415 (AV positives: 57/69 scanned on 12/07/2018 21:22:05) File SHA256: d91a93d92188a5ea35e5ad0b5b9ec1899dc5dd1a0ffa12558d5174382cd2dfa7 (AV positives: 57/69 scanned on 12/07/2018 21:20:19) File SHA256: 79b449e47fc61217a5981d5c3faa6b54bfd831dc7e1c018aea333058ea7102c2 (AV positives: 59/71 scanned on 12/07/2018 16:06:13) File SHA256: 14a90abf5806a406887c42fa0a6e9df8f5d064f5696690300110a0efbd28ccf8 (AV positives: 56/69 scanned on 12/07/2018 16:48:37) File SHA256: 38b69e11e46916a8b6d840befb6abf2f25e2dd2a81ee88be587abdd70461aa8c (AV positives: 58/68 scanned on 12/07/2018 16:37:46) File SHA256: a00ebb3e688739233f69aad1d8d3f8cde6304e2e305b236a29dafe44ff3d7d4e (Date: 12/07/2018 17:57:05) File SHA256: ee6a173abc9b82f9e784ee029ed2abaed2d66d7ecc799c43ec3042cf0b37bb03 (Date: 12/07/2018 17:54:51) File SHA256: b3ee3737c93d313e5ac691ea286ca05c558b0e8bfb80c718826641283068ce5a (Date: 12/05/2018 15:10:13) File SHA256: 36c4ba8689536fcc0954195aec8d74e639d0ee53eabd4ae5b2ea05981edc421f (Date: 12/05/2018 02:43:09) File SHA256: 996d627d9b00f2d340f4ab1b93c1cdec2a4c16c588908efcc794c0a8d3e28cca (Date: 12/05/2018 02:37:55) Found malicious artifacts related to "67.55.121.97": ... URL: http://xvq7q4u3i9aaafr.pwg5p5vd.com/ (AV positives: 5/67 scanned on 12/07/2018 19:39:49) URL: http://rnbbes.pwg5p5vd.com/ (AV positives: 5/67 scanned on 12/07/2018 19:39:36) URL: http://faeriemoans.com/xyc/oods/gdoc/filewords/index.php (AV positives: 4/66 scanned on 12/07/2018 18:16:40) URL: http://dmeneghetti.com/ (AV positives: 4/66 scanned on 12/07/2018 17:21:46) URL: http://f1.storeglobal-best.com/x0108/18/4484/bluestacks-app-player_10.exe (AV positives: 3/66 scanned on 12/07/2018 10:26:13) File SHA256: 04e8d079a996461340a2101a35d7041e0fd3ae19f0b088d409976fa737ada219 (AV positives: 3/58 scanned on 12/07/2018 18:16:44) File SHA256: dc3131206e4a7485f4416ef986c4aa902f236f44d70f0a2ab2759413c64003e9 (AV positives: 3/57 scanned on 12/07/2018 10:26:17) File SHA256: ab0d736ec4449bb56003d36c4d8d618e801be3cd9406685ad36f7b2480c53aa1 (AV positives: 5/60 scanned on 12/07/2018 10:19:53) File SHA256: 2c94f29136febc4977b3b6357005b925515136a5e2fc08f6c93638468b6264e5 (AV positives: 3/59 scanned on 12/07/2018 02:54:46) File SHA256: 61ba55926a9864c0c2dfde9b2e574a2660297d219d4db95cd530b14ecd2fdfcc (AV positives: 3/57 scanned on 12/07/2018 01:51:53) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 768b8e6627dc0d472b6ce02d9f42b2cc720a5e05ccb8cdbcb7165dc3bb1a5ace (Date: 12/02/2018 20:53:31) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) Found malicious artifacts related to "35.231.151.7": ... URL: http://ttpruarjjudvlj.us/ (AV positives: 6/67 scanned on 12/07/2018 21:59:51) URL: http://tevgmqphhtqytj.us/ (AV positives: 1/66 scanned on 12/07/2018 21:52:20) URL: http://xdqzpbcgrvkj.ru/in.php (AV positives: 6/66 scanned on 12/07/2018 21:49:10) URL: http://qtsuphrrkvnixxu.us/ (AV positives: 6/67 scanned on 12/07/2018 21:17:01) URL: http://pehpycdhmnpacdqsp.us/ (AV positives: 2/66 scanned on 12/07/2018 21:07:29) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: ecc12a9bca8c916902d1bbe46f1d0e167594c4857590d0c913e4a7999e4a785f (AV positives: 40/67 scanned on 12/07/2018 14:21:51) File SHA256: 9c287fce18f29528fa4c5d1b51df6e361bcca36bad4f680f4f8b93cc965c5642 (AV positives: 40/71 scanned on 12/07/2018 11:39:38) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 041a30bbafb012f323217392258cf29ec7d2297ddee42e4a602570b4908e8a90 (AV positives: 54/71 scanned on 12/07/2018 00:37:25) File SHA256: ec02dc5ed6fa23149caef0d63dcc41e6fabce98290cc0568632a40f1f0c06d73 (Date: 12/04/2018 19:10:13) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0d74c3f33e09e5ef54d407020b97ef6e273a9692c340f0bc8c3f3f49022998db (Date: 12/01/2018 15:48:53) File SHA256: eb08d00932bc1441c0d80d52e1a3773563e45b6ea30f83bbed58a300728e24b4 (Date: 12/01/2018 14:29:35) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) Found malicious artifacts related to "195.22.4.21": ... URL: http://ariveagain.net/ (AV positives: 4/70 scanned on 12/07/2018 21:58:03) URL: http://sa2.adsnike.com/active.php%20 (AV positives: 3/66 scanned on 12/07/2018 21:57:21) URL: http://christabellelongstaff.net/ (AV positives: 3/66 scanned on 12/07/2018 21:15:40) URL: http://taiborucheng.com/b/opt/408A4FA22B4F3AE9028C285E/ (AV positives: 2/70 scanned on 12/07/2018 20:53:48) URL: http://xsso.presto-ferr.com/f85c842334e1abe79d25d82d24ef5038 (AV positives: 5/66 scanned on 12/07/2018 20:40:31) File SHA256: 5e68906b1dc20f4c84af5a89f5323a23fa5411cb7eece7ea9129cb64eac85d25 (AV positives: 35/71 scanned on 12/07/2018 21:59:06) File SHA256: 4bdc16583b5b1d797fdfa3637555d376e5725cf0718f705278459a43453bc312 (AV positives: 35/70 scanned on 12/07/2018 18:43:11) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: b9233b05e1cc1b6e53a40cbb0b79e27efafb988713775b6ba2e0b7a607707a05 (AV positives: 34/69 scanned on 12/07/2018 10:35:25) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:41) File SHA256: c692f1dea6057958a6f04a52b7dab4fd7113a9ae8832b15909d08de7f6e837dd (Date: 12/05/2018 17:25:33) File SHA256: 74a5662db619b68cc0d4a65d0959728fe6ef31e5f65fb3f927a5539831e6fb06 (Date: 12/05/2018 17:04:40) File SHA256: af3b0a691280734d14b97732b41a88c0dab5db49c498e53911bbf255af0cd7bc (Date: 12/05/2018 16:32:42) File SHA256: fbc10190ef71dea1101962df324fff0e7e664e2ffb54d76b149420d54de2dc0c (Date: 12/04/2018 22:39:39) File SHA256: 8ac7d78c49f9f38fbabbf0734cf6761f99f0c1027fac63c29fd9ff2f62c5de0c (Date: 12/03/2018 21:48:44) Found malicious artifacts related to "107.172.147.54": ... URL: http://www.gadyniw.com/hbt.php?rewrite=NiNmZ/TSPMZ/login.php (AV positives: 5/66 scanned on 12/07/2018 18:03:52) URL: http://gadyniw.com/NiNmZ/TSPMZ/login.php (AV positives: 4/66 scanned on 12/07/2018 18:03:48) URL: http://www.gadyniw.com/hbt.php?rewrite=ZfchZ/login.php (AV positives: 5/66 scanned on 12/07/2018 17:58:14) URL: http://gadyniw.com/ZfchZ/login.php (AV positives: 4/66 scanned on 12/07/2018 17:58:10) URL: http://www.gadyniw.com/hbt.php?rewrite=UXVeZ/login.php (AV positives: 5/66 scanned on 12/07/2018 17:58:07) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:36) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 17e996cad548c9c6d44cf3ba06f5fe516e55347b264264635c97ed93691076d7 (AV positives: 57/70 scanned on 12/05/2018 15:08:16) File SHA256: d5ae5ca71b8ba1ceb71d25637ca2b82fa293330be82b5124d9cd33d5730c0db5 (AV positives: 59/69 scanned on 12/04/2018 13:32:32) File SHA256: 837137b22a85e8c6f179f805a365f950ca36f08c635df35030a50a5c52cf3abc (AV positives: 49/68 scanned on 12/04/2018 09:06:02) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15) Found malicious artifacts related to "91.195.240.46": ... URL: http://ww1.ysbweb.com/ist/scripts/exe_version.php?aid=1003866&cfg=ysb_m3&vkey=211111 (AV positives: 8/70 scanned on 12/07/2018 17:58:15) URL: http://ww1.arbsecret.com/12.jpg (AV positives: 2/66 scanned on 12/07/2018 17:53:37) URL: http://ww1.css-nkp.net/_ld/119/11945_MadeCheat_v2.5.rar (AV positives: 6/67 scanned on 12/07/2018 17:49:08) URL: http://ww1.lysyfyj.com/LkPOZ/login.php (AV positives: 6/67 scanned on 12/07/2018 17:48:10) URL: http://ww1.lysyfyj.com/WnKbZ/login.php (AV positives: 6/67 scanned on 12/07/2018 17:48:07) File SHA256: 14a6c8fc65d1762f94935d61393d70374f32d0a8acbaf9c21d243ee28333be94 (AV positives: 1/56 scanned on 12/07/2018 17:53:41) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:36) File SHA256: d8f22a3727bbb0f7435ea44165a1a1decda96cd0077c48f51a0ac8c19e6b6de6 (AV positives: 56/70 scanned on 12/07/2018 11:53:59) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 605376faec8c9021ff979bdc36316c4cd277bbdd220fa9fa2ea44ad7624f4b3f (AV positives: 54/69 scanned on 12/06/2018 11:48:05) File SHA256: 716d461e82f3f60fd68ea8120021710f36999f5d24330a60e849b01bfac7cdf9 (Date: 11/22/2018 09:54:37) File SHA256: 20212b1a47b8c1b25f174f0b6f6e0ce9a13fd2240b751bd2ea4c319d09c1c52f (Date: 11/22/2018 06:22:33) File SHA256: 40444d815c733d1d77fc7a9c065d854d062fc9d59f02b91b26209fce2d5a7097 (Date: 11/21/2018 01:40:54) File SHA256: 8729166e26d67f34c379cd7ace3fb9a381b4a487823ff2ea3ac478c4898f67ac (Date: 10/18/2018 14:03:47) File SHA256: e642b32bdcd1a7fc190c5334443eb4988eb3965a54f0d605eb89dd45fd5df0a4 (Date: 10/18/2018 01:52:12) Found malicious artifacts related to "23.89.102.68": ... URL: http://lygynud.com/login.php (AV positives: 6/66 scanned on 11/30/2018 02:16:45) URL: http://lygynud.com/ (AV positives: 5/66 scanned on 11/29/2018 12:41:00) URL: http://lygynud.com/index.html (AV positives: 4/66 scanned on 11/26/2018 02:11:12) URL: http://lygynud.com/home.php (AV positives: 5/66 scanned on 11/21/2018 10:27:37) URL: http://23.89.102.68/ (AV positives: 1/67 scanned on 10/19/2018 02:16:08) File SHA256: 7f6cfa957d7427d912b2c3adcd5d0437cd6e45d6497818e50d31174f529eaece (AV positives: 53/69 scanned on 12/07/2018 16:30:37) File SHA256: 570979d046a284a731b1de70b1127b1ab523ded4dca7f7bf140edc6609c12d41 (AV positives: 56/70 scanned on 12/07/2018 08:06:40) File SHA256: 17e996cad548c9c6d44cf3ba06f5fe516e55347b264264635c97ed93691076d7 (AV positives: 57/70 scanned on 12/05/2018 15:08:15) File SHA256: d5ae5ca71b8ba1ceb71d25637ca2b82fa293330be82b5124d9cd33d5730c0db5 (AV positives: 59/69 scanned on 12/04/2018 13:32:32) File SHA256: 837137b22a85e8c6f179f805a365f950ca36f08c635df35030a50a5c52cf3abc (AV positives: 49/68 scanned on 12/04/2018 09:06:03) File SHA256: ba5984e28db96a8f6bf09e944b74d9166893237a109b080faaafac2300d8ac9e (Date: 12/03/2018 13:00:14) File SHA256: 0944e5cfecd2f5ef228d62453e755b73005b1a47b2b1f6496bb863238081c613 (Date: 11/30/2018 19:58:46) File SHA256: b445012ebea9efba32b77911ef4b7cb45ee3e712927b42f0facbe4af5e81e0a9 (Date: 11/30/2018 01:49:05) File SHA256: 7a0b174640e0bb7eea02515535a7e6cf1f224069162d9e69fde188eccd02e76b (Date: 11/28/2018 15:42:49) File SHA256: f0f1f85674951bff4a0166c5467cb4d6c6d1de657e1ecaa330a44d9353ed6eec (Date: 11/28/2018 14:53:15)31:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AjnkQkQkRkBGQAREZEQGQARkBEBGZkQmREQERAJEZkJEQGRARmRkRGQkRkAEREQAAGRmZARmRGZGRkZAZCZARAJEJEZEJEZEQGZmZEZARmRmZGRERGZkZGQGZGRAZkZGRGRGZGQEJAJGQEREQARAREZGQkRAQARkQGRERkQmRGQAREREQEJEZCRARmZEBkBkQEAkQAREAkRkQkQEBEZCZkAERkRkRGZERCREAAAEJkREREBEREREQEBCREZGZmRCREAARkZkRGRARERkJEJkQAJERCQCQGRkRGZAZGREAEZkREBAZGQERmZEREAEQkQGREQAQEZkZGQkZGQEJmQCZEQERERGRkZGQEZCREQARCRkBAREZkRkREREQERkBEZEZAACZkJkBGQkBABEZAQERERABABCQEZERCRERCZkJkZERGRARCRGREQmZkAERkBEZERABEBmRGQEBGQCRGRkREAABEZGQEQEBEQmQERARABEQmQGRABEZkREAEQARCQkQGZEAkJERAJEBkZEZEQEQkRAAEJEQAQABGRkZAZABkREZABEREBEJGZkBmREQkBkRkRkREBAAEQERGRABEQEQAJGZkBGZEBAREZGRARERkZEREAEBGQCZmZEREZmZkRGZGREQCREZERkRCZGZEAAJEREZABARkQEQkQABERkJAQEAAN6rAADlpwAAmr4AAKGrAAAWswAAEKEAAMDvAABfswAA6aoAAEfpAAD8qwAAceAAAIr8AACqvAAATv4AALj6AAAuuwAALqYAALigAABmvgAAt7YAAD7pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==32:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AjnkQkQkRkBGQAREZEQGQARkBEBGZkQmREQERAJEZkJEQGRARmRkRGQkRkAEREQAAGRmZARmRGZGRkZAZCZARAJEJEZEJEZEQGZmZEZARmRmZGRERGZkZGQGZGRAZkZGRGRGZGQEJAJGQEREQARAREZGQkRAQARkQGRERkQmRGQAREREQEJEZCRARmZEBkBkQEAkQAREAkRkQkQEBEZCZkAERkRkRGZERCREAAAEJkREREBEREREQEBCREZGZmRCREAARkZkRGRARERkJEJkQAJERCQCQGRkRGZAZGREAEZkREBAZGQERmZEREAEQkQGREQAQEZkZGQkZGQEJmQCZEQERERGRkZGQEZCREQARCRkBAREZkRkREREQERkBEZEZAACZkJkBGQkBABEZAQERERABABCQEZERCRERCZkJkZERGRARCRGREQmZkAERkBEZERABEBmRGQEBGQCRGRkREAABEZGQEQEBEQmQERARABEQmQGRABEZkREAEQARCQkQGZEAkJERAJEBkZEZEQEQkRAAEJEQAQABGRkZAZABkREZABEREBEJGZkBmREQkBkRkRkREBAAEQERGRABEQEQAJGZkBGZEBAREZGRARERkZEREAEBGQCZmZEREZmZkRGZGREQCREZERkRCZGZEAAJEREZABARkQEQkQABERkJAQEAAN6rAADlpwAAmr4AAKGrAAAWswAAEKEAAMDvAABfswAA6aoAAEfpAAD8qwAAceAAAIr8AACqvAAATv4AALj6AAAuuwAALqYAALigAABmvgAAt7YAAD7pAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790337815234,"unified_at":"2026-09-25T12:03:35.234Z","metadata":{"hashes":{"sha256":"72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e","sha1":"cab0e0925479ae7f2dac4c0529e5811f1d12e563","md5":"eb7c74c66f801abde07e0d1a72cbec79","sha512":"698043ad2aeed8b23e010fb9242248ab86db4082dc2ac47965a6ab04560609fbc4007d8ff96302eb4a71aa002c28698bdb5518eefbe51b5f9249817666f84423","ssdeep":"6144:RrRaTyDOnlo7eM+mlkWgRXOqobzWjozm2ulYM6Y:5sTbzu1glovW4EH6Y","ssdeep_chunks":["6144:RrRaTyD","6144:rRaTyDO","6144:RaTyDOn","6144:aTyDOnl","6144:TyDOnlo","6144:yDOnlo7","6144:DOnlo7e","6144:Onlo7eM","6144:nlo7eM+","6144:lo7eM+m","6144:o7eM+ml","6144:7eM+mlk","6144:eM+mlkW","6144:M+mlkWg","6144:+mlkWgR","6144:mlkWgRX","6144:lkWgRXO","6144:kWgRXOq","6144:WgRXOqo","6144:gRXOqob","6144:RXOqobz","6144:XOqobzW","6144:OqobzWj","6144:qobzWjo","6144:obzWjoz","6144:bzWjozm","6144:zWjozm2","6144:Wjozm2u","6144:jozm2ul","6144:ozm2ulY","6144:zm2ulYM","6144:m2ulYM6","6144:2ulYM6Y","12288:RrRaTyD","12288:rRaTyDO","12288:RaTyDOn","12288:aTyDOnl","12288:TyDOnlo","12288:yDOnlo7","12288:DOnlo7e","12288:Onlo7eM","12288:nlo7eM+","12288:lo7eM+m","12288:o7eM+ml","12288:7eM+mlk","12288:eM+mlkW","12288:M+mlkWg","12288:+mlkWgR","12288:mlkWgRX","12288:lkWgRXO","12288:kWgRXOq","12288:WgRXOqo","12288:gRXOqob","12288:RXOqobz","12288:XOqobzW","12288:OqobzWj","12288:qobzWjo","12288:obzWjoz","12288:bzWjozm","12288:zWjozm2","12288:Wjozm2u","12288:jozm2ul","12288:ozm2ulY","12288:zm2ulYM","12288:m2ulYM6","12288:2ulYM6Y","6144:5sTbzu1","6144:sTbzu1g","6144:Tbzu1gl","6144:bzu1glo","6144:zu1glov","6144:u1glovW","6144:1glovW4","6144:glovW4E","6144:lovW4EH","6144:ovW4EH6","6144:vW4EH6Y"],"imphash":"a1477f62efa130779fcb2868cf890b42"},"file_info":{"file_name":"eb7c74c66f801abde07e0d1a72cbec79.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":223040,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1543933020000,"last_seen":1628860809000,"last_multi_scan":1628860809000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["shiz","sinkhole"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":20,"suspicious_count":21,"malicious_count":15,"total":56},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Carberp.lTi3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Injector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Carberp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Packy.4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Shiz.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Shiz.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Packy.4 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Shiz.NBX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Carberp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 002c1daa1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Carberp.apr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Carberp.wbzpw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.6405","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/ZXC-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"SMG.Heur!gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Spy/W32.Carberp.223040","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"BKDR_SHIZ.SMA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"BKDR_SHIZ.SMA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.SHeur3.COJK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Ibank","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Shiz.Win32.1197","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Injects into explorer"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Injects into remote processes"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the windows installation date"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"dllhost.exe\" at 00081230-00001768-00000105-318251730841","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"svchost.exe\" queries volume information of \"C:\\\" at 00070557-00001296-0000010C-161876336880\n \"svchost.exe\" queries volume information of \"C:\\\" at 00070657-00000900-0000010C-137190486565\n \"svchost.exe\" queries volume information of \"C:\\\" at 00070686-00000872-0000010C-140236802123","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"gacyzuz.com\"\n \"purycap.com\"\n \"gacyryw.com\"\n \"lymyxid.com\"\n \"lysyfyj.com\"\n \"vowycac.com\"\n \"qexyryl.com\"\n \"vowydef.com\"\n \"qetyfuv.com\"\n \"lyvyxor.com\"\n \"lyxylux.com\"\n \"gatyfus.com\"\n \"pupybul.com\"\n \"qedynul.com\"\n \"qegyqaq.com\"\n \"qexylup.com\"\n \"vocyruk.com\"\n \"galykes.com\"\n \"lyryfyd.com\"\n \"qekykev.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"35.225.160.245:80\"\n \"23.253.126.58:80\"\n \"103.224.212.222:80\"\n \"217.70.184.38:80\"\n \"208.100.26.251:80\"\n \"67.55.121.97:80\"\n \"35.231.151.7:80\"\n \"195.22.4.21:80\"\n \"107.172.147.54:80\"\n \"91.195.240.46:80\"\n \"23.89.102.68:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"conhost.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\24C2B580a\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\%WINDIR%\\system32!config!systemprofile!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\%WINDIR%\\system32!config!systemprofile!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\%WINDIR%\\system32!config!systemprofile!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$28","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"OLLYDBG\"\n \"\" searching for class \"____AVP.Root\"\n \"winlogon.exe\" searching for class \"OLLYDBG\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"conhost.exe\" (UID: 00069978-00003276)\n Spawned process \"dllhost.exe\" with commandline \"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}\" (UID: 00081230-00001768)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"conhost.exe\" (UID: 00069978-00003276)\n Spawned process \"dllhost.exe\" with commandline \"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}\" (UID: 00081230-00001768)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$29","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"conhost.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"lwftva.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"lastalive1.dat\" has type \"data\"\n \"24C2B7E0a\" has type \"ASCII text\"\n \"lastalive0.dat\" has type \"data\"\n \"24c2b722a\" has type \"ASCII text with no line terminators\"\n \"Security.evtx\" has type \"MS Windows Vista Event Log 26 chunks (no. 25 in use) next record no. 2431 DIRTY\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\lwftva.exe\"\n \"\" touched file \"%WINDIR%\\AppPatch\\lwftva.exe:Zone.Identifier\"\n \"\" touched file \"%WINDIR%\\System32\\drivers\\ntfs.sys\"\n \"winlogon.exe\" touched file \"%WINDIR%\\AppPatch\\lwftva.exe\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"winlogon.exe\" touched file \"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"winlogon.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"svchost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"dllhost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data\n .data with unusual entropies 7.98506836298\n 7.98506836298","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"winlogon.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"dllhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"winlogon.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"conhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"svchost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"dwm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"taskhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/66 reputation engines marked \"http://gacyzuz.com\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"lwftva.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"winlogon.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\"; Key: \"USERINIT\"; Value: \"%WINDIR%\\system32\\userinit.exe,%WINDIR%\\apppatch\\lwftva.exe,\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 35.225.160.245 on port 80 is sent without HTTP header\n TCP traffic to 23.253.126.58 on port 80 is sent without HTTP header\n TCP traffic to 103.224.212.222 on port 80 is sent without HTTP header\n TCP traffic to 217.70.184.38 on port 80 is sent without HTTP header\n TCP traffic to 208.100.26.251 on port 80 is sent without HTTP header\n TCP traffic to 67.55.121.97 on port 80 is sent without HTTP header\n TCP traffic to 35.231.151.7 on port 80 is sent without HTTP header\n TCP traffic to 195.22.4.21 on port 80 is sent without HTTP header\n TCP traffic to 107.172.147.54 on port 80 is sent without HTTP header\n TCP traffic to 91.195.240.46 on port 80 is sent without HTTP header\n TCP traffic to 23.89.102.68 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" (Type: \"FileHandle\")\n \"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"winlogon.exe\" had access to \"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\eb7c74c66f801abde07e0d1a72cbec79.exe\" marked \"%TEMP%\\AF74.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Program Files\\AVG\\AVG9\\dfncfg.dat\" with delete access\n \"\" opened \"%WINDIR%\\apppatch\\lwftva.exe_\" with delete access\n \"\" opened \"C:\\eb7c74c66f801abde07e0d1a72cbec79.exe\" with delete access\n \"\" opened \"%TEMP%\\AF74.tmp\" with delete access\n \"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\edbtmp.log\" with delete access\n \"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\res1.log\" with delete access\n \"svchost.exe\" opened \"%WINDIR%\\system32\\CatRoot2\\res2.log\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"DnsQuery_UTF8@DNSAPI.DLL\" in \"svchost.exe\"\n \"DnsQuery_A@DNSAPI.DLL\" in \"svchost.exe\"\n \"DnsQuery_W@DNSAPI.DLL\" in \"svchost.exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"winlogon.exe\" (Access type: \"SETVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"winlogon.exe\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"eb7c74c66f801abde07e0d1a72cbec79.exe.bin\" claimed CRC 1089211097 while the actual is CRC 233582\n \"lwftva.exe\" claimed CRC 1327586118 while the actual is CRC 233582","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"eb7c74c66f801abde07e0d1a72cbec79.exe.bin\" has an entrypoint in section \".HEYeA\"\n \"lwftva.exe\" has an entrypoint in section \".HEYeA\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegOpenKeyA\n RegCreateKeyExA\n GetFileAttributesA\n IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n DisconnectNamedPipe\n GetCommandLineW\n GetProcAddress\n GetStartupInfoW\n GetTempFileNameW\n CreateThread\n connect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2c","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"conhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"svchost.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"eb7c74c66f801abde07e0d1a72cbec79.exe.bin\" claims program is from Sat Sep 14 03:16:00 1996\n \"lwftva.exe\" claims program is from Sat Sep 14 03:16:00 1996","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%WINDIR%\\AppPatch\\lwftva.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 2.\" (SID: 2016873, Rev: 5, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN X-Malware-Sinkhole Header in HTTP Response\" (SID: 2024378, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Unsupported/Fake Windows NT Version 5.0\" (SID: 2016879, Rev: 4, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN Possible Compromised Host Sinkhole Cookie Value Snkz\" (SID: 2018141, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/66 reputation engines marked \"http://gacyzuz.com\" as malicious (4% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/65 Antivirus vendors marked sample as malicious (89% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/65 Antivirus vendors marked sample as malicious (89% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/70 Antivirus vendors marked spawned process \"conhost.exe\" (PID: 3276) as malicious (classified as \"malicious.moderate.ml\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"%TEMP%\\AF74.tmp\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00070497-00001428)","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"$2d","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 11 (or more) hosts in at least 5 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\n Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2f","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$30","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"svchost.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Accesses potentially sensitive information from local browsers"},{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 112 domains and 112 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}]},"activity":{"stats":{"process_count":20,"spawned_processes_count":20,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":82,"files_deleted_count":0,"registry_keys_created_count":9,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":112,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["shiz","sinkhole"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"5c068c5b7ca3e1662551a224","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Shiz.A.gen","contacted_countries":["AUS","DEU","FRA","PRT","USA","VGB"],"submit_name":"eb7c74c66f801abde07e0d1a72cbec79.exe","analysis_start_time":"2018-12-07T23:42:14+00:00","indicators_count":{"informative":20,"suspicious":30,"malicious":19},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"35.225.160.245","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"23.253.126.58","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"103.224.212.222","port":80,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"217.70.184.38","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"208.100.26.251","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"67.55.121.97","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"35.231.151.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"195.22.4.21","port":80,"protocol":"TCP","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"107.172.147.54","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"91.195.240.46","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"address":"23.89.102.68","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"dns_resolutions":[{"domain":"gacypyz.com","address":"23.253.126.58","country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Arbor Networks Security Engineering & Response Team","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gacyqob.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gacyroh.com","address":"104.239.157.210","country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Arbor Networks Security Engineering & Response Team","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","registrar_creation_date":"2018-01-17T15:54:35+00:00","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gacyryw.com","address":"23.253.126.58","country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Arbor Networks Security Engineering & Response Team","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gacyzuz.com","address":"35.225.160.245","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gadydas.com","address":"23.253.126.58","country":"United States","registrar_name":"GANDI SAS","registrar_organization":"Arbor Networks Security Engineering & Response Team","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gadykos.com","address":"23.253.126.58","country":"United States","registrar_name":"Gandi SAS","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","registrar_creation_date":"2018-01-29T20:49:16+00:00","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gadyniw.com","address":"107.172.147.54","country":"United States","registrar_name":"XINNET TECHNOLOGY CORPORATION","registrar_organization":"duanyong","registrar_creation_date":"2018-06-07T18:27:24+00:00","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gadypuw.com","address":"23.253.126.58","country":"United States","registrar_name":"Gandi SAS","registrar_name_servers":"NS1.ARBOR-SINKHOLE.NET","registrar_creation_date":"2018-03-21T21:06:52+00:00","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gadyrab.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gahyhys.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gahyqub.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gahyraw.com","address":"108.59.12.101","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"galykes.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"galykiz.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"galyvas.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"ganycuh.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"ganyvoz.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"ganyzub.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gaqypiz.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gatyfus.com","address":"67.55.121.97","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gatyhub.com","address":"146.148.34.125","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gatynes.com","address":"199.191.50.185","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"gatyrez.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lygymyn.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lygynud.com","address":"23.89.102.68","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lykyjux.com","address":"50.63.202.82","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lymysan.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lymytux.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lymyxid.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyryfyd.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyrysor.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyryxij.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lysyfyj.com","address":"103.224.212.222","country":"Australia","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lysytyr.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyvyfad.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyvyxor.com","address":"208.100.26.251","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyxylor.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyxylux.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyxymin.com","address":"217.70.184.38","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"lyxywij.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pujywiv.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pumydoq.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pumyxep.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupyboq.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupybul.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupycag.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupyjuv.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupylaq.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"pupymyp.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"purycap.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"purycul.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"purymuq.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"purypol.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puvywav.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puzybep.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puzyjoq.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puzylol.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puzytap.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"puzywuq.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qebyfav.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qedyhyl.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qedynul.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qegykiq.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qegyqaq.com","address":"35.231.151.7","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qegyrol.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qekykev.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qeqykog.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qeqyqiv.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetyfuv.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetyhyg.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetykol.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetynev.com","address":"178.32.208.147","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetyquq.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qetyrap.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qexylal.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qexylup.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qexyriq.com","address":"50.63.202.77","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"qexyryl.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocybam.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocycuc.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocydof.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocygyk.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocypyt.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocyrom.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocyruk.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vocyzit.com","address":"195.22.4.21","country":"Portugal","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vofymem.com","address":"50.63.202.76","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vojycif.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vojygut.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vojyjyc.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vojykom.com","address":"54.72.9.51","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"volybec.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"volydot.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"volykit.com","address":"50.63.202.85","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"volyrac.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vonydik.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vonygec.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vonyjim.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vonypom.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vonyzac.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vopycom.com","address":"217.70.184.38","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vopygat.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vopyret.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vowycac.com","address":"217.70.184.38","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vowydef.com","address":"217.70.184.38","country":"France","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vowydic.com","address":"104.239.157.210","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vowygem.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"vowyzuk.com","address":"23.253.126.58","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"ww1.lysyfyj.com","address":"91.195.240.46","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"ww55.gatyhub.com","address":"199.191.50.21","country":"Virgin Islands (BRITISH)","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"domain":"www.gadyniw.com","address":"107.172.147.54","country":"United States","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"http_requests":[{"host":"gacyzuz.com","host_ip":"35.225.160.245:80","url":"/login.php","method":"GET","header":"GET /login.php HTTP/1.1\nReferer: http://www.google.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: gacyzuz.com\nContent-Length: 6","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"host":"gatyfus.com","host_ip":"67.55.121.97:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nReferer: http://www.google.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: gatyfus.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"host":"gadyniw.com","host_ip":"107.172.147.54:80","url":"/hbt.php?rewrite=login.php","method":"GET","header":"GET /hbt.php?rewrite=login.php HTTP/1.1\nReferer: http://www.google.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: gadyniw.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"host":"lygynud.com","host_ip":"23.89.102.68:80","url":"/index.html","method":"GET","header":"GET /index.html HTTP/1.1\nReferer: http://www.google.com\nUser-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)\nHost: lygynud.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}],"processes":[{"pid":2504,"ppid":0,"name":"eb7c74c66f801abde07e0d1a72cbec79.exe","command_line":"","sha256":"72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e","normalized_path":"C:\\eb7c74c66f801abde07e0d1a72cbec79.exe","uid":"00068810-00002504","icon":"$31"},{"pid":416,"ppid":2504,"name":"winlogon.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\winlogon.exe","parent_uid":"00068810-00002504","uid":"00069922-00000416"},{"pid":3376,"ppid":416,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00069922-00000416","uid":"00070328-00003376"},{"pid":3972,"ppid":416,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00069922-00000416","uid":"00070404-00003972"},{"pid":316,"ppid":416,"name":"conhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\conhost.exe","parent_uid":"00069922-00000416","uid":"00070419-00000316"},{"pid":1632,"ppid":416,"name":"svchost.exe","command_line":"-k LocalServiceAndNoImpersonation","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070430-00001632"},{"pid":1968,"ppid":416,"name":"svchost.exe","command_line":"-k NetworkServiceNetworkRestricted","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070446-00001968"},{"pid":1428,"ppid":416,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00069922-00000416","uid":"00070497-00001428"},{"pid":1404,"ppid":416,"name":"dwm.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\dwm.exe","parent_uid":"00069922-00000416","uid":"00070511-00001404"},{"pid":1312,"ppid":416,"name":"taskhost.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\taskhost.exe","parent_uid":"00069922-00000416","uid":"00070531-00001312"},{"pid":1296,"ppid":416,"name":"svchost.exe","command_line":"-k LocalServiceNoNetwork","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070557-00001296"},{"pid":1108,"ppid":416,"name":"svchost.exe","command_line":"-k NetworkService","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070585-00001108"},{"pid":1016,"ppid":416,"name":"svchost.exe","command_line":"-k LocalService","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070610-00001016"},{"pid":900,"ppid":416,"name":"svchost.exe","command_line":"-k netsvcs","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070657-00000900"},{"pid":872,"ppid":416,"name":"svchost.exe","command_line":"-k LocalSystemNetworkRestricted","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070686-00000872"},{"pid":748,"ppid":416,"name":"svchost.exe","command_line":"-k LocalServiceNetworkRestricted","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00070713-00000748"},{"pid":696,"ppid":416,"name":"svchost.exe","command_line":"-k RPCSS","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00071098-00000696"},{"pid":584,"ppid":416,"name":"svchost.exe","command_line":"-k DcomLaunch","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00069922-00000416","uid":"00071144-00000584"},{"pid":1768,"ppid":584,"name":"dllhost.exe","command_line":"/Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}","sha256":"f7ad4b09afb301ce46df695b22114331a57d52e6d4163ff74787bf68ccf44c78","normalized_path":"%WINDIR%\\System32\\dllhost.exe","parent_uid":"00071144-00000584","uid":"00081230-00001768"},{"pid":3276,"ppid":0,"name":"conhost.exe","command_line":"","sha256":"b3bbcd2ff46233d6f64776b83048f58c8459e76327ad77a2132b471d389fe04c","normalized_path":"%WINDIR%\\System32\\conhost.exe","uid":"00069978-00003276","icon":"$32"}],"all_imported_dlls":["wkscli.dll","kernel32.dll","wsock32.dll","ws2_32.dll","rtutils.dll","nlaapi.dll","wintrust.dll","pnrpnsp.dll","winrnr.dll","npmproxy.dll","KernelBase.dll","user32.dll","lpk.dll","sspicli.dll","Wldap32.dll","iertutil.dll","usp10.dll","shlwapi.dll","MpClient.dll","profapi.dll","rpcss.dll","psapi.dll","netutils.dll","gdi32.dll","ole32.dll","uxtheme.dll","version.dll","WinSCard.dll","rasapi32.dll","cryptsp.dll","rsaenh.dll","cryptbase.dll","netapi32.dll","srvcli.dll","wininet.dll","netprofm.dll","es.dll","clbcatq.dll","SensApi.dll","dbghelp.dll","dhcpcsvc6.dll","msvcrt.dll","msctf.dll","urlmon.dll","ntdll.dll","shell32.dll","imm32.dll","FirewallAPI.dll","dnsapi.dll","ntmarta.dll","mswsock.dll","crypt32.dll","samcli.dll","dhcpcsvc.dll","shacct.dll","userenv.dll","WSHTCPIP.DLL","NapiNSP.dll","advapi32.dll","sechost.dll","nsi.dll","RpcRtRemote.dll","rpcrt4.dll","msasn1.dll","comctl32.dll","wship6.dll","MsMpLics.dll","winnsi.dll","rasman.dll","rasadhlp.dll","FWPUCLNT.DLL","cryptsvc.dll","dwmapi.dll","oleaut32.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"24C2B7E0a","sha256":"dc7e59168529b7e4c6a44218f85878a209343c7c71535112ddb6032bddedf30c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"24c2b722a","sha256":"b081400c05e8effc773dc99fecabc88df65d812555028200ea262d6a65f964bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"lwftva.exe","sha256":"d9913aa4d388eaf47078d2e9c5c32e59cf24d08c91e1451350d66bd12a523e09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"lastalive1.dat","sha256":"9452318fa3a7a441acea8377d7c38dd2df077019e44418c846d6550b993fae47","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"lastalive0.dat","sha256":"8368c57b83e67ebddc1f06f6272209c9c33f95c112df469b72f55b5ddd66daf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"Security.evtx","sha256":"bc46e79b391dd6e8007a6af2a3c23059befaf53f0c4f19a61a3212f205d141de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"files_written":[{"path":"C:\\°° 0ÐP°ðÀpð p€0° Ð@ÀÀ`À ``0","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%PROGRAMFILES%\\Windows Defender\\MsMpLics.dll","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"pipe\\acsipc_server","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%ALLUSERSPROFILE%\\PrevxCSI\\csidb.csi","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"C:\\eb7c74c66f801abde07e0d1a72cbec79.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\AppPatch\\lwftva.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\drivers\\ntfs.sys","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\AppPatch\\lwftva.exe","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\system32\\drivers\\etc\\hosts.ics","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\FA6.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\1B77.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\20CA.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\20D5.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\20EA.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\20F5.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\2128.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\2183.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\21CB.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\2908.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\291D.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\2946.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%APPDATA%\\24C2B7E0a","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\4AF6.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\4BF1.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\4BFC.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\50EB.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\51E6.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\en-US\\conhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\804C.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8CBE.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8CD3.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8F69.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8F6A.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8F6B.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Temp\\8F76.tmp","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\catdb","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\edb.chk","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\catroot2\\edb.log","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%APPDATA%\\24c2b722a","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\ega.cpi","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\es.dll","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\000F7F8FAB2D96E6F8CBD5C9A3B4EC90","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\070E0202839D9D67350CD2613E78E416","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3130B1871A126520A8C47861EFE3ED4D","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\4CA77D36767B6202D4786BF3D1EC5242","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6525274CBC2077D43D7D17A33C868C4F","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\696F3DE637E6DE85B458996D49D759AD","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7396C420A8E1BC1DA97F1AF0D10BAD21","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7B2238AACCEDC3F1FFE8E7EB5F575EC9","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8156185507A8E41FBCA1AE02BEF08EF2","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A4B782275DC1682E4DC39E697A49B151","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AE1425687AA803AA0F6E35ADA1152297","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C1F94CD5CA263ECFB1A4BAB1B832C909","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINLOGON\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SESSION MANAGER\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WINLOGON_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\WINLOGON_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\24C2B232A\\24C2B232A","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\24C2B580a","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!windows!system32!config!systemprofile!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5c068c5b7ca3e1662551a224"}]}]}},"report_ids":{"sandbox_job_ids":["5c068c5b7ca3e1662551a224"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 72e97227948b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 72e97227948b…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 72e97227948b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 72e97227948b…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/72e97227948b8a6254e2717c0318115042c1c070abb2825a0a9fdff1fbd98f1e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 72e97227948b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 72e97227948b…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 15 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]