24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T492,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ab036a9c324a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab036a9c324a…. Malware family: Trojan.Generic. Threat score 100/100. 22/24 AV engines flagged this file. 16 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0"],"about":{"@type":"SoftwareApplication","name":"Document_HM901417.exe","applicationCategory":["peexe","executable"],"identifier":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":24},"behavioralIndicators":{"malicious":16,"suspicious":32},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1d30,"GET / HTTP/1.1 Accept: text/*, application/* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.36 (KHTML, like Gecko) Chrome/44.0.2456.82 Safari/535.36 Host: icanhazip.com Cache-Control: no-cache" "HTTP/1.1 200 OK Server: nginx Date: Fri, 16 Oct 2015 12:13:37 GMT Content-Type: text/plain; charset=UTF-8 Content-Length: 15 Connection: close X-RTFM: Learn about this site at http://bit.ly/icanhazip-faq and don't abuse the service X-BECOME-A-RACKER: If you're reading this, apply here: http://rackertalent.com/ Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET" "GET /?ocid=iehp HTTP/1.1 Accept: */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1kZSIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZW4tdXMiLCJDb3VudHJ5Q29kZSI6IkRFIn19LCJFeHBpcnlUaW1lIjo2MzU5MTEzNzAyMTcwNzcyNjAsIlZlcnNpb24iOjF90; marketPref=de-de; _EDGE_V=1; MUID=36424C65E6E166DB0A524B2AE7ED673A; Sample=29; _SS=SID=00; _chartbeat2=CmpDtNaNX9ID0sski.1424004229919.1431939910060.0000000000000001 Connection: Keep-Alive Host: www.msn.com" "HTTP/1.1 302 Found Cache-Control: no-cache, no-store, no-transform Pragma: no-cache Content-Length: 152 Content-Type: text/html; charset=utf-8 Expires: -1 Location: http://www.msn.com/de-de/?ocid=iehp Vary: User-Agent Server: Microsoft-IIS/8.5 Set-Cookie: MSPAuth=; domain=.msn.com; expires=Wed, 14-Oct-2015 12:15:56 GMT; path=/; HttpOnly Set-Cookie: MSPProf=; domain=.msn.com; expires=Wed, 14-Oct-2015 12:15:56 GMT; path=/; HttpOnly Set-Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1kZSIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZW4tdXMiLCJDb3VudHJ5Q29kZSI6IlVTIn19LCJFeHBpcnlUaW1lIjo2MzYxMjIxNjk1Njg4MjA5NjMsIlZlcnNpb24iOjF90; domain=msn.com; expires=Sun, 16-Oct-2016 12:15:56 GMT; path=/; HttpOnly Set-Cookie: marketPref=de-de; domain=msn.com; expires=Sun, 16-Oct-2016 12:15:56 GMT; path=/; HttpOnly Access-Control-Allow-Origin: * X-AspNetMvc-Version: 5.2 X-AppVersion: 2.0.5763.29238 X-Activity-Id: 8095b129-c825-4314-a6f8-de3de4462777 X-Az: {did:f08db8f3b6194a418d4507ddba3fea60, rid: 8, sn: eastus-hp, dt: 2015-10-05T18:10:53.9879344Z, bt: 2015-10-13T00:15:24.5557784Z} X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN X-UA-Compatible: IE=Edge;chrome=1 X-Powered-By: ASP.NET Access-Control-Allow-Methods: HEAD,GET,OPTIONS X-XSS-Protection: 1 X-MSEdge-Ref: Ref A: 8095B129C8254314A6F8DE3DE4462777 Ref B: 9817B" "GET /de-de/?ocid=iehp HTTP/1.1 Accept: */* Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Cookie: PreferencesMsn=eyJIb21lUGFnZSI6eyJTdHJpcGVzIjpbXSwiTWVTdHJpcGVNb2R1bGVzIjpbXSwiTWFya2V0Q29uZmlndXJhdGlvbiI6eyJNYXJrZXQiOiJkZS1kZSIsIlN1cHByZXNzUHJvbXB0IjpmYWxzZSwiUHJlZmVycmVkTGFuZ3VhZ2VDb2RlIjoiZW4tdXMiLCJDb3VudHJ5Q29kZSI6IlVTIn19LCJFeHBpcnlUaW1lIjo2MzYxMjIxNjk1Njg4MjA5NjMsIlZlcnNpb24iOjF90; marketPref=de-de; _EDGE_V=1; MUID=36424C65E6E166DB0A524B2AE7ED673A; Sample=29; _SS=SID=00; _chartbeat2=CmpDtNaNX9ID0sski.1424004229919.1431939910060.0000000000000001 Connection: Keep-Alive Host: www.msn.com" "HTTP/1.1 200 OK Cache-Control: no-cache, no-store, no-transform Pragma: no-cache Content-Length: 53588 Content-Type: text/html; charset=utf-8 Content-Encoding: gzip Expires: -1 Vary: User-Agent Server: Microsoft-IIS/8.5 Set-Cookie: MSPAuth=; domain=.msn.com; expires=Wed, 14-Oct-2015 12:15:56 GMT; path=/; HttpOnly Set-Cookie: MSPProf=; domain=.msn.com; expires=Wed, 14-Oct-2015 12:15:56 GMT; path=/; HttpOnly Set-Cookie: DefaultLocation=ZGUtZGV8MzguNjI4fC05MC4yMDB8U2FpbnQgTG91aXN8TU98VmVyZWluaWd0ZSBTdGFhdGVuIHZvbiBBbWVyaWthfFVTfHwuMDA1; domain=www.msn.com; expires=Mon, 19-Oct-2015 12:15:56 GMT; path=/; HttpOnly Access-Control-Allow-Origin: * X-AspNetMvc-Version: 5.2 X-AppVersion: 2.0.5763.29238 X-Activity-Id: a2874523-7f97-4c8e-88cf-593bf0cd24e9 X-Az: {did:f08db8f3b6194a418d4507ddba3fea60, rid: 192, sn: eastus-hp, dt: 2015-10-09T15:03:48.6268922Z, bt: 2015-10-13T00:15:24.5557784Z} X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN X-UA-Compatible: IE=Edge;chrome=1 X-Powered-By: ASP.NET Access-Control-Allow-Methods: HEAD,GET,OPTIONS X-XSS-Protection: 1 X-MSEdge-Ref: Ref A: A28745237F974C8E88CF593BF0CD24E9 Ref B: FF0C443B0C84B6DF068959E9FA0B1016 Ref C: Fri Oct 16 05:15:56 2015 PST Date: Fri, 16 Oct 2015 12:15:56 GMT" "GET /de-de/homepage/_sc/css/6670b51d-562514/direction=ltr.locales=de-de.themes=start.dpi=resolution1x/86-eb2c87-e7435c42/47-e2d9a0-2a21d229/9b-34443b-68ddb2ab/cc-8262d3-ae53777e/21-742659-4da0aefe/78-fd52e7-78384465/d8-77a653-a169329a/7f-d7938c-3f6f3868/7c-708702-354b4712/bb-87838f-e3cb8dfd/b5-8be003-5960eecb/4c-2074f2-b663ebe2/88-9ed380-36a17fee/b9-afe498-b5681d36/finance-css-d0-9c6a48be6cdd3088c324f6d9424822-c16bd114/60-65fa40-c171b3a4/ce-d13d8c-91cdfbc1?ver=2.0.5763.29238&fdhead=ushpcombo30,al-ar-tb,al-bn-tb,hp-2hmodule,muidflt58cf,muidflt59cf,d-thshldie1,d-thshldie2&ocid=iehp&csopd=20151014152508 HTTP/1.1 Accept: */* Referer: http://www.msn.com/de-de/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static-hp-eus.s-msn.com Connection: Keep-Alive" "HTTP/1.1 200 OK Content-Type: text/css; charset=utf-8 Content-Encoding: gzip Last-Modified: Wed, 14 Oct 2015 15:31:03 GMT Vary: Accept-Encoding Server: Microsoft-IIS/8.5 Access-Control-Allow-Origin: * X-AspNetMvc-Version: 5.2 X-AppVersion: 2.0.5763.29238 X-Activity-Id: 00000000-e7bf-484f-879b-d339e51d7793 X-Az: {did:f08db8f3b6194a418d4507ddba3fea60, rid: 74, sn: eastus-hp, dt: 2015-10-05T18:09:26.8050237Z, bt: 2015-10-13T00:15:24.5557784Z} X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN X-S1: 2015-10-14T15:31:03 X-S2: 2015-10-14T15:31:03 Timing-Allow-Origin: * X-Powered-By: ASP.NET Access-Control-Allow-Methods: HEAD,GET,OPTIONS X-XSS-Protection: 1 Content-Length: 18773 Cache-Control: public, no-transform, max-age=31374853 Expires: Thu, 13 Oct 2016 15:30:24 GMT Date: Fri, 16 Oct 2015 12:16:11 GMT Connection: keep-alive" "GET /sc/c9/44f363.eot? HTTP/1.1 Accept: */* Referer: http://www.msn.com/de-de/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static-hp-eus.s-msn.com Connection: Keep-Alive" "GET /_h/804ff984/webcore/externalscripts/jquery/jquery-1.11.1.min.js HTTP/1.1 Accept: */* Referer: http://www.msn.com/de-de/?ocid=iehp Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Accept-Encoding: gzip, deflate Host: static-hp-eus.s-msn.com Connection: Keep-Alive"26:Tff1,"HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: image/gif Expires: -1 Last-Modified: Tue, 13 Oct 2015 00:51:08 GMT Accept-Ranges: bytes ETag: "7cffa73f515d11:0" Server: Microsoft-IIS/8.5 S: CH1AMPA08326 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD Access-Control-Max-Age: 21600 Date: Fri, 16 Oct 2015 12:16:31 GMT Content-Length: 42" with no payload "POST /c.gif? HTTP/1.1 Accept: */* Origin: http://www.msn.com Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: otf.msn.com Content-Length: 2303 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /c.gif? HTTP/1.1 Accept: */* Origin: http://www.msn.com Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: otf.msn.com Content-Length: 452 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /c.gif? HTTP/1.1 Accept: */* Origin: http://www.msn.com Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: otf.msn.com Content-Length: 383 Connection: Keep-Alive Cache-Control: no-cache" with no payload "HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/plain Expires: -1 Server: Microsoft-IIS/8.5 S: CH1AMPA08326 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD Access-Control-Max-Age: 21600 Date: Fri, 16 Oct 2015 12:16:32 GMT Content-Length: 0" with no payload "POST /c.gif? HTTP/1.1 Accept: */* Origin: http://www.msn.com Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: otf.msn.com Content-Length: 451 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /c.gif? HTTP/1.1 Accept: */* Origin: http://www.msn.com Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: otf.msn.com Content-Length: 2305 Connection: Keep-Alive Cache-Control: no-cache" with no payload "HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/plain Expires: -1 Server: Microsoft-IIS/8.5 S: CH1AMPA08319 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD Access-Control-Max-Age: 21600 Date: Fri, 16 Oct 2015 12:16:33 GMT Content-Length: 0" with no payload "HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/plain Expires: -1 Server: Microsoft-IIS/8.5 S: CH1AMPA08313 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD Access-Control-Max-Age: 21600 Date: Fri, 16 Oct 2015 12:16:33 GMT Content-Length: 0" with no payload "HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-Type: text/plain Expires: -1 Server: Microsoft-IIS/8.5 S: CH1AMPA08326 Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, GET, OPTIONS, HEAD Access-Control-Max-Age: 21600 Date: Fri, 16 Oct 2015 12:16:33 GMT Content-Length: 0" with no payload27:T5e3,"milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")28:T522,"milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "milkyhit.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")29:T463,"milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "milkyhit.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")2a:T7c1,"milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")2b:T723,"milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "milkyhit.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "milkyhit.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2c:T529,"" touched file "C:\Windows\system32\tzres.dll" "" touched file "C:\Windows\system32\en-US\tzres.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "milkyhit.exe" touched file "C:\Windows\system32\tzres.dll" "milkyhit.exe" touched file "C:\Windows\system32\en-US\tzres.dll.mui" "milkyhit.exe" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Local\Microsoft\Windows\Temporary Internet Files" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Roaming\Microsoft\Windows\Cookies" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Local\Microsoft\Windows\History" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "milkyhit.exe" touched file "C:\Users\HlXzWeJ\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "milkyhit.exe" touched file "C:\Windows\system32\rsaenh.dll" "milkyhit.exe" touched file "C:\Windows\system32\en-US\urlmon.dll.mui" "milkyhit.exe" touched file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "milkyhit.exe" touched file "C:\Windows\System32\msxml3r.dll"2d:T5182,Found malicious artifacts related to "64.182.208.182" (ASN: , Owner: ): ... URL: http://icanhazip.com/ (AV positives: 1/65 scanned on 08/02/2017 20:33:50) URL: http://icanhazip.com/favicon.ico (AV positives: 1/65 scanned on 07/27/2017 06:37:47) URL: http://icanhazip.com:443/ (AV positives: 1/65 scanned on 07/23/2017 09:38:14) URL: http://64.182.208.182/ (AV positives: 1/65 scanned on 07/13/2017 09:20:22) URL: https://icanhazip.com/ (AV positives: 1/65 scanned on 06/28/2017 15:42:09) File SHA256: b32a19c7711d3ebf361e04aa8d033982819a51c917c05823d2827b6a38c6d92c (AV positives: 53/65 scanned on 10/02/2017 04:32:11) File SHA256: c78baecb28506763d9139693439791350a6e254de9a5fc49444dc921389df9e0 (AV positives: 51/63 scanned on 10/02/2017 03:30:30) File SHA256: a98cc46c88300c12917c9247d2d6ad0afd3713e00432305bff972b2ddc078fc8 (AV positives: 52/65 scanned on 10/02/2017 03:00:54) File SHA256: c91c3f3c5595bd9871ba742cb78a47201384d6634390c526a702a61dee53aeef (AV positives: 53/65 scanned on 10/02/2017 02:15:31) File SHA256: 5843ec50d8df1fdb9ee6b06597951ad1e8ff3d126a058d02a3375a66e07380dc (AV positives: 51/65 scanned on 10/02/2017 01:24:14) File SHA256: 9e72e130898ab79c26c264775ec2ceccce514a823212f8131af9a44477c38091 (Scanned on 08/11/2017 18:45:04) File SHA256: b11134ca77b225979c0be956b457f35b1ab0e9f77b5e61a717e784e3871a64fa (Scanned on 08/07/2017 09:29:51) File SHA256: 735be454002a46289fcd92cc9cf60f687625c6f40d60df7a0d93fc3d9c7e1668 (Scanned on 07/31/2017 20:16:10) File SHA256: acc6e26546cb2b85ed5594db1c422991bea42a947f712c8b47c36fa7f6d14fef (Scanned on 07/29/2017 20:02:20) File SHA256: 24a1b9833b7c90586499ede4bb3a0987f08d5e54075ffd734df11860aa72d291 (Scanned on 07/07/2017 15:25:25) Found malicious artifacts related to "93.185.4.90" (ASN: , Owner: ): ... URL: http://93.185.4.90/ (AV positives: 4/64 scanned on 09/29/2017 05:10:43) URL: http://93.185.4.90/ETK3/TEQUILABOOMBOOM/41/5/1/MEBEFEBFEBEFJ/ (AV positives: 5/65 scanned on 06/15/2017 09:36:28) URL: http://93.185.4.90/ETK3/TEQUILABOOMBOOM/41/5/1/MEBEFEBFEBEFJ (AV positives: 6/64 scanned on 06/12/2017 12:42:19) URL: http://93.185.4.90/ETK3/TEQUILABOOMBOOM/0/51-SP3/0/MEBEFEBFEBEFJ (AV positives: 7/64 scanned on 06/12/2017 12:38:58) URL: http://93.185.4.90:12326/ (AV positives: 5/64 scanned on 04/14/2017 04:01:48) File SHA256: 4757dce25c19d5918b1ab51a34ff8cf3575dd445e1c3472c38ffe2ee94c9298e (Scanned on 02/28/2017 11:40:51) File SHA256: 7db368409ab7921078b1332d0d6abb0e47edd82889f692d8ee9ce70bb7a9f708 (AV positives: 1/57 scanned on 04/05/2016 20:59:21) File SHA256: 95b5202e13e7fde68b551d7f181bee5c1cf271c9e1ba9c3349ec3001457edaed (Scanned on 11/09/2015 21:18:56) File SHA256: 17dcb2573660125cec0c89297345601c9602e04bcf780b81e339981743e4b2da (Scanned on 10/31/2015 21:15:31) File SHA256: abaaf872dcab24e9a1883e7d6caa5dee9b9ebcb860cf03816afb966623e2839c (Scanned on 09/15/2015 23:13:17) File SHA256: bd46df569eda66e35683a203944cbb121fb9042f57bf876b876fb773bde634d6 (Scanned on 09/08/2015 22:56:35) File SHA256: 3e241bfe5dfd93d481c3f41c12accefee2a045a4c30c4e1b6bbed4777c8289e7 (AV positives: 36/57 scanned on 08/25/2015 05:05:52) File SHA256: 8443dea450193eb1b3c239f1ad1bc3cd63048f6e53e3f33d6fe38312f71baffd (AV positives: 39/57 scanned on 08/25/2015 04:56:44) File SHA256: ce6cff60c91531d9e01c4e357d074bc45ac1d1af37a6e6ff93768c81d5934b16 (AV positives: 33/57 scanned on 08/25/2015 04:45:46) File SHA256: 1144bb6cb239632f20d34dc6c7278ffd19e2ab1f933324a35f5b9c3fda1b5447 (AV positives: 40/57 scanned on 08/25/2015 04:44:20) Found malicious artifacts related to "173.216.247.74" (ASN: , Owner: ): ... URL: http://173.216.247.74/ (AV positives: 2/64 scanned on 09/14/2017 06:45:27) URL: http://173.216.247.74/1906uk21/im-a-dyreza-bot_W617808.DEADBEEF/ (AV positives: 2/65 scanned on 09/03/2017 08:45:36) URL: http://173.216.247.74/kon12.zip (AV positives: 2/65 scanned on 08/31/2017 23:35:29) URL: http://173.216.247.74/plant2.zip (AV positives: 2/65 scanned on 08/31/2017 22:54:05) URL: http://173.216.247.74/cuteg12.zip (AV positives: 3/65 scanned on 08/31/2017 22:11:47) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: 7d24d9515c041fb72bd10ea3818dc9c402c559af8323e7e0847965e90d595460 (Scanned on 11/20/2016 23:24:40) File SHA256: a0dc591727158ad3ac9ecb94beec0c49655031faf9026cba16bcafbb9b361c8b (Scanned on 11/20/2016 00:01:46) File SHA256: a9576b89d7ee8774131f0003fa3cff03f136a19424fb1d6085a9486b0ca0e105 (Scanned on 11/19/2016 23:49:44) File SHA256: f35f66dfee7889a2f484a102e14b7410aa05c276d5f731da787f242adc83e2cf (AV positives: 40/53 scanned on 10/26/2015 02:48:31) File SHA256: 17692db60fe52da49aed61307b6eed698867992bce99db87167f6cd3d99f9bd2 (AV positives: 44/55 scanned on 10/25/2015 21:02:37) File SHA256: 2000ed064c8d9913590bf6d985665a3a6bbf52a876ba808b783529281125d361 (AV positives: 45/56 scanned on 10/25/2015 07:11:20) File SHA256: 5834c1f9317cf1e4ccfab020df5e1c1d4fab2c3847c01266397baf11029f253d (AV positives: 42/56 scanned on 10/22/2015 23:29:10) File SHA256: 6453a266be0cae1cb938dcc076051546f08d34da2d62504ab26c2fd2912418aa (AV positives: 42/56 scanned on 10/22/2015 23:23:41) Found malicious artifacts related to "77.48.30.156" (ASN: , Owner: ): ... URL: http://77.48.30.156/ (AV positives: 3/65 scanned on 08/19/2017 21:24:21) URL: http://77.48.30.156/r1.zip (AV positives: 4/65 scanned on 08/09/2017 16:17:44) URL: http://77.48.30.156/arhA12.zip (AV positives: 5/65 scanned on 08/05/2017 12:57:50) URL: http://77.48.30.156/arhA13.zip (AV positives: 5/65 scanned on 08/05/2017 12:53:26) URL: http://77.48.30.156/ek11.zip (AV positives: 5/65 scanned on 07/02/2017 23:59:31) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: da8064a104a0ed9fcd114f8979b6d5927ba63f81c568779299d93cf165bb51a6 (Scanned on 11/20/2016 03:15:18) File SHA256: a9576b89d7ee8774131f0003fa3cff03f136a19424fb1d6085a9486b0ca0e105 (Scanned on 11/19/2016 23:49:44) File SHA256: e20c19b19a2b888a9fc17a186899fd8b081d5aa4d36ba166c1b23d110a068bed (Scanned on 11/19/2016 22:21:28) File SHA256: 83345056b7178281fd36c5650151b84ffc840cfe2ed94fca14d03c79457ff932 (AV positives: 10/57 scanned on 10/01/2015 17:10:03) File SHA256: f5460d3f0d5828b5c6b77a088574ba7eaada0ac9c2a9cf95780794f79cc3b919 (AV positives: 44/57 scanned on 10/01/2015 17:36:10) File SHA256: 7b9e7ea5bec9b97c192ca5bb4fc9b474ea611660498ac2242dd749df513def4c (AV positives: 35/57 scanned on 10/01/2015 15:23:11) File SHA256: 4ae20a680707eba92d953bc2f04b1645869b2ec2b26136de6edfbf28999d09da (AV positives: 34/56 scanned on 10/01/2015 08:58:01) File SHA256: 0c4f73d75d53512b5c1e499c2503a8f5b61684d8ad569d1d1c713d97725eed93 (AV positives: 44/57 scanned on 10/01/2015 02:43:58) Found malicious artifacts related to "77.95.195.68" (ASN: , Owner: ): ... URL: http://77.95.195.68/ (AV positives: 4/65 scanned on 09/01/2017 21:16:20) URL: http://77.95.195.68/ek11.zip (AV positives: 4/65 scanned on 07/02/2017 07:57:30) URL: http://77.95.195.68/kon13.zip (AV positives: 5/64 scanned on 05/02/2017 19:24:37) URL: http://77.95.195.68/pice12.zip (AV positives: 5/64 scanned on 04/15/2017 07:50:02) URL: http://77.95.195.68/data3.zip (AV positives: 5/64 scanned on 04/15/2017 07:49:55) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: da8064a104a0ed9fcd114f8979b6d5927ba63f81c568779299d93cf165bb51a6 (Scanned on 11/20/2016 03:15:18) File SHA256: e20c19b19a2b888a9fc17a186899fd8b081d5aa4d36ba166c1b23d110a068bed (Scanned on 11/19/2016 22:21:28) File SHA256: c1dfcff5972b7bcbfebcb40ed747f54c1a5051460c5d47aaecae5c08f52a317d (Scanned on 11/16/2016 13:15:47) File SHA256: f3a495814450aff12d508ed83f68fea0f0c7b51a2bcc7d46da19806d1eb805dc (AV positives: 17/55 scanned on 07/08/2015 06:20:52) File SHA256: 3e575d3a8024fa83b72551c937d68a4712442deafd6479173365c0dd40d74754 (AV positives: 13/56 scanned on 07/08/2015 03:21:11) File SHA256: 1b885aa6b7b7214dbf39136dbf1a805cab819baba5962f2c765dbf03d175f854 (AV positives: 8/56 scanned on 07/08/2015 00:09:05) File SHA256: 527f6b5901022ce03e6ee22dd64091edef54688a9146ee33a2c572f7e40e79a8 (AV positives: 7/55 scanned on 07/07/2015 18:40:47) File SHA256: a67968b221460b49bf5423c874d9e18d44660a2fac93b0cd0c24246084999974 (AV positives: 34/56 scanned on 07/07/2015 17:38:53) Found malicious artifacts related to "37.57.144.177" (ASN: , Owner: ): ... URL: http://37.57.144.177/ (AV positives: 6/64 scanned on 10/01/2017 19:22:39) URL: https://37.57.144.177/l28.zip (AV positives: 5/64 scanned on 09/22/2017 14:22:37) URL: http://37.57.144.177/l27.zip (AV positives: 6/65 scanned on 08/31/2017 08:51:55) URL: http://37.57.144.177/r1.zip (AV positives: 6/65 scanned on 08/09/2017 16:17:47) URL: http://37.57.144.177/arhA13.zip (AV positives: 6/65 scanned on 08/05/2017 13:10:30) File SHA256: c44499da1b248b408b44afe09b64d7070995b8bdeaa71079664acb3ae8cdc3cc (AV positives: 56/65 scanned on 10/02/2017 06:11:06) File SHA256: 79dd5a7bf654cb96ea39b4b961ebe719c0e5b2de685045da68a9290c776123e5 (AV positives: 50/64 scanned on 10/02/2017 05:17:05) File SHA256: b736f48719a36a029084aa964fee9655e823dfecd6eb4e5acafc69955746c878 (AV positives: 55/65 scanned on 10/01/2017 20:40:00) File SHA256: bcce6e568920fec40b5e2a536231b425b0a5e348d2efd5880d452eeb490afde3 (AV positives: 52/65 scanned on 10/01/2017 20:37:01) File SHA256: dba779fa1c7e223e13c5dc1b3492be4ff855b2dc6e22e06d4b9406e14523ae75 (AV positives: 54/65 scanned on 10/01/2017 20:35:25) File SHA256: 39d545d9ef9590c1c66818ec6e7e4ed57fe37f60973da437e43be55b582fd238 (Scanned on 07/18/2017 13:50:01) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: da8064a104a0ed9fcd114f8979b6d5927ba63f81c568779299d93cf165bb51a6 (Scanned on 11/20/2016 03:15:18) File SHA256: e20c19b19a2b888a9fc17a186899fd8b081d5aa4d36ba166c1b23d110a068bed (Scanned on 11/19/2016 22:21:28) Found malicious artifacts related to "68.55.59.145" (ASN: , Owner: ): ... URL: https://68.55.59.145/imf2.png (AV positives: 4/64 scanned on 09/22/2017 14:19:03) URL: https://68.55.59.145/l28.zip (AV positives: 5/64 scanned on 09/22/2017 14:18:03) URL: http://68.55.59.145/ (AV positives: 4/65 scanned on 08/30/2017 04:10:30) URL: http://68.55.59.145/r1.zip (AV positives: 4/65 scanned on 08/09/2017 16:17:46) URL: http://68.55.59.145/ek11.zip (AV positives: 5/65 scanned on 07/02/2017 07:57:32) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: acb3c41b4c9d67a0fd31481ae5dd5d752d675960819cf872e9af456d98676a1e (Scanned on 11/22/2016 10:35:57) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: da8064a104a0ed9fcd114f8979b6d5927ba63f81c568779299d93cf165bb51a6 (Scanned on 11/20/2016 03:15:18) File SHA256: e20c19b19a2b888a9fc17a186899fd8b081d5aa4d36ba166c1b23d110a068bed (Scanned on 11/19/2016 22:21:28) File SHA256: edf47fbeaa17747b97b3c22699f3a0bd7605b685abb9e8fb3d53f47215d4000c (AV positives: 42/57 scanned on 10/21/2015 11:39:58) File SHA256: 904395155abac117635666cc6207fe59d237ab4c01fdf8baf6ae79ad073899e6 (AV positives: 42/56 scanned on 10/20/2015 17:57:32) File SHA256: a8d5ac738d15700604714d0b5ea5809aefb9750a54e741c34302ea1e7bd10301 (AV positives: 42/57 scanned on 10/20/2015 16:29:10) File SHA256: fa29b57c320194af11b9fb39c6f741e66fb988a5be711419cc6163c82d5970c0 (AV positives: 44/57 scanned on 10/20/2015 05:30:59) File SHA256: 0f1d6d35cc4a6e25f1545b782f7d46e2d3d7af05f0ff1ca5de996b0f5c8eee18 (AV positives: 44/57 scanned on 10/18/2015 04:24:51) Found malicious artifacts related to "95.143.141.50" (ASN: , Owner: ): ... URL: http://95.143.141.50/zikam77.png (AV positives: 4/65 scanned on 08/31/2017 06:33:33) URL: http://95.143.141.50/ (AV positives: 4/65 scanned on 08/20/2017 13:16:28) URL: http://95.143.141.50/r1.zip (AV positives: 6/65 scanned on 08/09/2017 16:17:49) URL: http://95.143.141.50/ek11.zip (AV positives: 5/65 scanned on 07/02/2017 07:57:31) URL: http://95.143.141.50/st.zip (AV positives: 5/65 scanned on 06/26/2017 22:08:59) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: acb3c41b4c9d67a0fd31481ae5dd5d752d675960819cf872e9af456d98676a1e (Scanned on 11/22/2016 10:35:57) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: da8064a104a0ed9fcd114f8979b6d5927ba63f81c568779299d93cf165bb51a6 (Scanned on 11/20/2016 03:15:18) File SHA256: 1280a3e0f85b8915e5a671bdf26462c6e2ffaa38cb07b7214a7be9fec90c4f3f (Scanned on 11/19/2016 23:58:09) File SHA256: 69045c376e764ad7b73d5d64f2afacb2197c9f9cab41f6c0e67a88dcef26cea6 (AV positives: 1/55 scanned on 08/13/2015 12:47:46) File SHA256: e0f3798950d8089a4ec121eef9ecdf203d435a2e202dd548f5fad2b0270baa5e (AV positives: 10/57 scanned on 08/13/2015 11:07:15) File SHA256: 2e4658d439016fc4ab318872eece0821f1463257c670e8216ee334456d510db0 (AV positives: 37/57 scanned on 08/13/2015 07:01:00) File SHA256: d5e30010eb0ff9b93e49fffe11b0b0f2e6347a5d2250c791dd3808f61a2f5b96 (AV positives: 31/57 scanned on 08/13/2015 05:56:31) File SHA256: 993d19b64f3af77725a5320acf973b820014ce14ae34f54788e04bd70d574f59 (AV positives: 38/57 scanned on 08/13/2015 05:41:24) Found malicious artifacts related to "194.228.203.19" (ASN: , Owner: ): ... URL: https://194.228.203.19/imf2.png (AV positives: 3/64 scanned on 09/22/2017 14:19:01) URL: https://194.228.203.19/pikp13.png (AV positives: 4/64 scanned on 09/22/2017 14:14:02) URL: http://194.228.203.19/ (AV positives: 3/65 scanned on 08/20/2017 13:13:13) URL: http://194.228.203.19/r1.zip (AV positives: 3/65 scanned on 08/09/2017 16:17:42) URL: http://194.228.203.19/l22.zip (AV positives: 4/65 scanned on 08/05/2017 12:58:00) File SHA256: c98e1126ffb947bdc415809a4bee72df0174b14ca6afacbe04e88bdbca83cb84 (Scanned on 07/02/2017 16:33:26) File SHA256: 514e936f17b31c9cd84dbbf53b060c240e5420681a884c4525b9ebed1d21261a (Scanned on 03/14/2017 17:20:01) File SHA256: 40f8d55dde2c62bd88f6d3a03851910b7e217b18711cf80e7167248bcb3fec40 (Scanned on 11/23/2016 13:15:06) File SHA256: acb3c41b4c9d67a0fd31481ae5dd5d752d675960819cf872e9af456d98676a1e (Scanned on 11/22/2016 10:35:57) File SHA256: a7f6d64cf72788fa182e8f82aa0d22cbc4f7e80005bbcde177061061ec677e67 (Scanned on 11/22/2016 05:16:06) File SHA256: 31f2968627723ced7e1b8def048616c87f7e413ef7544145618c0ee0cd81750f (AV positives: 37/57 scanned on 08/10/2015 10:16:21) File SHA256: c81962bb22b11ce3534ff75cb508f4867924704c5c3e98ab6454bde8272c4cea (AV positives: 35/55 scanned on 08/10/2015 09:37:27) File SHA256: 5957d166e1078d369c93e19c718a8f219d031b4cb93099b76dfafe160ecc5e00 (AV positives: 39/56 scanned on 08/10/2015 08:51:11) File SHA256: f6ddd4b00f17eba3c5b33076cd5f9e1793d90b2d954f19131a6c5bc8fa7b5b33 (AV positives: 35/56 scanned on 08/10/2015 07:55:02) File SHA256: e23ff39f8e54fc77208776acd3a3ba8f59132cee8e3777f0f23d7e62c439d245 (AV positives: 36/56 scanned on 08/10/2015 04:41:06) Found malicious artifacts related to "87.249.142.189" (ASN: , Owner: ): ... URL: http://87.249.142.189/zikam77.png (AV positives: 4/65 scanned on 08/31/2017 11:45:24) URL: http://87.249.142.189/saxi3.zip (AV positives: 4/65 scanned on 08/31/2017 04:46:46) URL: http://87.249.142.189/ (AV positives: 3/65 scanned on 08/20/2017 13:21:05) URL: http://87.249.142.189/r1.zip (AV positives: 4/65 scanned on 08/09/2017 16:17:41) URL: http://87.249.142.189/arhA13.zip (AV positives: 5/65 scanned on 08/05/2017 13:11:58) File SHA256: c98e1126ffb947bdc415809a4bee72df0174b14ca6afacbe04e88bdbca83cb84 (Scanned on 07/02/2017 16:33:26) File SHA256: 4ccca7bce64fe6371790ae756f8b2b11ac1a0ea53630fdb8b51bab7a745a8278 (Scanned on 11/19/2016 23:50:28) File SHA256: ecbd02e04b51894fcb82d468b2a2965c949700c13c656b859485671e321a3959 (Scanned on 11/18/2016 18:02:01) File SHA256: 619f20c5cc8fff4e88ad36317c459b5602edb74c1778c8d956a43be0e08a4df3 (Scanned on 11/18/2016 09:56:11) File SHA256: af2241e1437f57f0f91801585b8243e4e8130def31b02d801f502a584fef0711 (Scanned on 11/17/2016 09:18:19) File SHA256: f383beb171d7c6fcb2d739fdcac9ad7c7f03db127a43cc7fe19749b8b92559b3 (AV positives: 10/57 scanned on 10/05/2015 00:22:59) File SHA256: 31813470eacfd5278e83867a26fda354a048f4d68064b4f09e88e49979e2d732 (AV positives: 42/57 scanned on 10/04/2015 21:09:04) File SHA256: 76657ab52ac60a20e7422aae9817b0ada99317acb374093ddd5a055724f3e869 (AV positives: 42/57 scanned on 10/04/2015 03:02:24) File SHA256: 58b5c06ff9a211ef24e68e23a0918df0a275d7b0749a09143a6edb50ed9ca9ee (AV positives: 42/57 scanned on 10/04/2015 02:55:27) File SHA256: 4869ef270be41ba4fe897dc24f00e11d6edb437a2ec988bf6065d0b8e1c644b7 (AV positives: 10/57 scanned on 10/03/2015 11:31:35) Found malicious artifacts related to "85.135.104.170" (ASN: , Owner: ): ... URL: http://85.135.104.170/ (AV positives: 4/65 scanned on 08/24/2017 08:39:48) URL: http://85.135.104.170/r1.zip (AV positives: 5/65 scanned on 08/09/2017 16:17:45) URL: http://85.135.104.170/l22.zip (AV positives: 6/65 scanned on 08/05/2017 13:11:15) URL: http://85.135.104.170/arhA12.zip (AV positives: 6/65 scanned on 08/05/2017 13:11:12) URL: http://85.135.104.170/arhA13.zip (AV positives: 3/65 scanned on 08/05/2017 13:10:32) File SHA256: c98e1126ffb947bdc415809a4bee72df0174b14ca6afacbe04e88bdbca83cb84 (Scanned on 07/02/2017 16:33:26) File SHA256: 4ccca7bce64fe6371790ae756f8b2b11ac1a0ea53630fdb8b51bab7a745a8278 (Scanned on 11/19/2016 23:50:28) File SHA256: ecbd02e04b51894fcb82d468b2a2965c949700c13c656b859485671e321a3959 (Scanned on 11/18/2016 18:02:01) File SHA256: 619f20c5cc8fff4e88ad36317c459b5602edb74c1778c8d956a43be0e08a4df3 (Scanned on 11/18/2016 09:56:11) File SHA256: af2241e1437f57f0f91801585b8243e4e8130def31b02d801f502a584fef0711 (Scanned on 11/17/2016 09:18:19) File SHA256: 68ef9503ec77da29ac8d2ea68aac3acbc2e6ba6c3499bb5976c08b22a81565a4 (AV positives: 45/57 scanned on 09/26/2015 10:33:08) File SHA256: ad7c99f8feb94b98f323eeeeea0ab1e242c3482ff3bd10624f1df92209f9555e (AV positives: 45/57 scanned on 09/26/2015 01:05:53) File SHA256: db6caeb267f681b48d389daaa1078cfb0ae33f851565af1e18d5b4da9507640d (AV positives: 10/57 scanned on 09/25/2015 16:37:17) File SHA256: 8bdfbd860a1540d9d15ab053fa789ca2d41dd57e1abbc13126dbb7d1103c6b4c (AV positives: 43/57 scanned on 09/25/2015 23:22:57) File SHA256: b18186bc8bfa235d55418fc70daa4000eebf3189fbdf0f2974173db9a7b38070 (AV positives: 38/57 scanned on 09/25/2015 08:38:29) Found malicious artifacts related to "76.84.81.120" (ASN: , Owner: ): ... URL: http://76.84.81.120/ (AV positives: 5/64 scanned on 09/14/2017 06:45:21) URL: http://76.84.81.120/r1.zip (AV positives: 4/65 scanned on 08/09/2017 16:17:44) URL: http://76.84.81.120/l22.zip (AV positives: 5/65 scanned on 08/05/2017 12:57:59) URL: http://76.84.81.120/arhA12.zip (AV positives: 3/65 scanned on 08/05/2017 11:00:07) URL: http://76.84.81.120/ek11.zip (AV positives: 5/65 scanned on 07/02/2017 23:59:50) File SHA256: c98e1126ffb947bdc415809a4bee72df0174b14ca6afacbe04e88bdbca83cb84 (Scanned on 07/02/2017 16:33:26) File SHA256: 4ccca7bce64fe6371790ae756f8b2b11ac1a0ea53630fdb8b51bab7a745a8278 (Scanned on 11/19/2016 23:50:28) File SHA256: ecbd02e04b51894fcb82d468b2a2965c949700c13c656b859485671e321a3959 (Scanned on 11/18/2016 18:02:01) File SHA256: 619f20c5cc8fff4e88ad36317c459b5602edb74c1778c8d956a43be0e08a4df3 (Scanned on 11/18/2016 09:56:11) File SHA256: af2241e1437f57f0f91801585b8243e4e8130def31b02d801f502a584fef0711 (Scanned on 11/17/2016 09:18:19) File SHA256: 09135db7f8147802aa4a937d33e36827bf872f6ee378e8fc0a7d9ed97ecc1c97 (AV positives: 41/57 scanned on 10/17/2015 05:37:37) File SHA256: 128abdb1a00e3673e2f766766b6a6402c7958e09aba649b2e9d1a044ea931488 (AV positives: 41/57 scanned on 10/12/2015 01:38:14) File SHA256: d69d888eed09e467d037d8e8a6d26eeb2a6badd30215d204b21dbf0db8ccac3b (AV positives: 42/57 scanned on 10/11/2015 21:51:12) File SHA256: 5db145b045a3721cc7a46fa8e8e36ab696e1187b5f08a4d0b34f7336aa119d3b (AV positives: 43/57 scanned on 10/10/2015 21:03:29) File SHA256: 3514a737511a77188a686fd0312dd6133a175edd713822c654cbcd4b323b8731 (AV positives: 43/57 scanned on 10/10/2015 16:49:55)2e:T284b,"vboxvideo.inf" (Indicator: "vbox") "2021-09-23 17:24:20, Error DISM DISM Driver Manager: PID=2312 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_54dffbe2252403f6\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vbox") "2021-09-23 17:24:20, Error DISM DISM Driver Manager: PID=2312 Failed opening driver package for x86: INF Name='C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_54dffbe2252403f6\vboxguest.inf' - CDriverPackage::OpenDm" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest")2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAP////////////////AAAAD//4/////////////wAAAA//GB////////////8AAAAP/4fx////////////AAAAD//4h3///////////wAAAA////cf//////////8AAAAP////8f//////94+PAAAAD/////H3GP//8Rj4/wAAAA//////H/+BERiId/8AAAAP/////xj/9x//////AAAAD//////x/3H//////wAAAA//////8/8f//////8AAAAP//////8R////////AAAAD///////Ef///////wAAAA///////xj///////8AAAAP//////+Z////////AAAAD///////kf///////wAAAA//////+Jj///////8AAAAP//////d/////////AAAAD//////3eP///////wAAAA///////xf///////8AAAAIiIiIiIiIiI//iIiIAREREREREREREREXiIiIiAEREXERdxF3ERERF4h3d38BERHxEffx9xEREReHd3f/ARER/4Hx8fhxEREXj///8AEREfHx8fH4cRERF4///wABERHx8fHx9xEREReP//8AARER/4H/if/xEREXj/8AAAERGZERGREZERERF4//AAAJmZmYiIiIiIiIiIj/AAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAAAAAAAAAAAAAAAAAQAAAAMAAAAHAAAADwAAAB8AAAA//AAAfw==30:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAP////////////////AAAAD//4/////////////wAAAA//GB////////////8AAAAP/4fx////////////AAAAD//4h3///////////wAAAA////cf//////////8AAAAP////8f//////94+PAAAAD/////H3GP//8Rj4/wAAAA//////H/+BERiId/8AAAAP/////xj/9x//////AAAAD//////x/3H//////wAAAA//////8/8f//////8AAAAP//////8R////////AAAAD///////Ef///////wAAAA///////xj///////8AAAAP//////+Z////////AAAAD///////kf///////wAAAA//////+Jj///////8AAAAP//////d/////////AAAAD//////3eP///////wAAAA///////xf///////8AAAAIiIiIiIiIiI//iIiIAREREREREREREREXiIiIiAEREXERdxF3ERERF4h3d38BERHxEffx9xEREReHd3f/ARER/4Hx8fhxEREXj///8AEREfHx8fH4cRERF4///wABERHx8fHx9xEREReP//8AARER/4H/if/xEREXj/8AAAERGZERGREZERERF4//AAAJmZmYiIiIiIiIiIj/AAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAAAAAAAAAAAAAAAAAQAAAAMAAAAHAAAADwAAAB8AAAA//AAAfw==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790335036724,"unified_at":"2026-09-25T11:17:16.724Z","metadata":{"hashes":{"sha256":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","sha1":"dbf17f6087a3fdd013cee33e6183136c79cf0d14","md5":"99a65db1393a13ced779568526e947ef","sha512":"5e9b98884cd6d54018c0eeb0c42a6e9fc57d23141994e0b4052388f5a28da84343bdd2a9dab21c9401adbe853ae6080a5b94152ccf93990530620cfc345560a4","ssdeep":"384:+3AZEG4GwiWhRtr64ViTG0D1h4NIoGBjCbhL+bXQoNRnH/JJGtpBQvUZBWgfUsDU:+3lG4GwVcS5GBzbXQ+nfyt/QsZBWgvD","ssdeep_chunks":["384:+3AZEG4","384:3AZEG4G","384:AZEG4Gw","384:ZEG4Gwi","384:EG4GwiW","384:G4GwiWh","384:4GwiWhR","384:GwiWhRt","384:wiWhRtr","384:iWhRtr6","384:WhRtr64","384:hRtr64V","384:Rtr64Vi","384:tr64ViT","384:r64ViTG","384:64ViTG0","384:4ViTG0D","384:ViTG0D1","384:iTG0D1h","384:TG0D1h4","384:G0D1h4N","384:0D1h4NI","384:D1h4NIo","384:1h4NIoG","384:h4NIoGB","384:4NIoGBj","384:NIoGBjC","384:IoGBjCb","384:oGBjCbh","384:GBjCbhL","384:BjCbhL+","384:jCbhL+b","384:CbhL+bX","384:bhL+bXQ","384:hL+bXQo","384:L+bXQoN","384:+bXQoNR","384:bXQoNRn","384:XQoNRnH","384:QoNRnH/","384:oNRnH/J","384:NRnH/JJ","384:RnH/JJG","384:nH/JJGt","384:H/JJGtp","384:/JJGtpB","384:JJGtpBQ","384:JGtpBQv","384:GtpBQvU","384:tpBQvUZ","384:pBQvUZB","384:BQvUZBW","384:QvUZBWg","384:vUZBWgf","384:UZBWgfU","384:ZBWgfUs","384:BWgfUsD","384:WgfUsDU","768:+3AZEG4","768:3AZEG4G","768:AZEG4Gw","768:ZEG4Gwi","768:EG4GwiW","768:G4GwiWh","768:4GwiWhR","768:GwiWhRt","768:wiWhRtr","768:iWhRtr6","768:WhRtr64","768:hRtr64V","768:Rtr64Vi","768:tr64ViT","768:r64ViTG","768:64ViTG0","768:4ViTG0D","768:ViTG0D1","768:iTG0D1h","768:TG0D1h4","768:G0D1h4N","768:0D1h4NI","768:D1h4NIo","768:1h4NIoG","768:h4NIoGB","768:4NIoGBj","768:NIoGBjC","768:IoGBjCb","768:oGBjCbh","768:GBjCbhL","768:BjCbhL+","768:jCbhL+b","768:CbhL+bX","768:bhL+bXQ","768:hL+bXQo","768:L+bXQoN","768:+bXQoNR","768:bXQoNRn","768:XQoNRnH","768:QoNRnH/","768:oNRnH/J","768:NRnH/JJ","768:RnH/JJG","768:nH/JJGt","768:H/JJGtp","768:/JJGtpB","768:JJGtpBQ","768:JGtpBQv","768:GtpBQvU","768:tpBQvUZ","768:pBQvUZB","768:BQvUZBW","768:QvUZBWg","768:vUZBWgf","768:UZBWgfU","768:ZBWgfUs","768:BWgfUsD","768:WgfUsDU","384:+3lG4Gw","384:3lG4GwV","384:lG4GwVc","384:G4GwVcS","384:4GwVcS5","384:GwVcS5G","384:wVcS5GB","384:VcS5GBz","384:cS5GBzb","384:S5GBzbX","384:5GBzbXQ","384:GBzbXQ+","384:BzbXQ+n","384:zbXQ+nf","384:bXQ+nfy","384:XQ+nfyt","384:Q+nfyt/","384:+nfyt/Q","384:nfyt/Qs","384:fyt/QsZ","384:yt/QsZB","384:t/QsZBW","384:/QsZBWg","384:QsZBWgv","384:sZBWgvD"],"imphash":"ad5f10e235dd5eafffc3ab06ac684966"},"file_info":{"file_name":"Document_HM901417.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":36352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1506925831000,"last_seen":1719933303000,"last_multi_scan":1719933303000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","banker","crypt","downloader","dyre","dyreza","spam","upatre"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":24,"suspicious_count":32,"malicious_count":16,"total":72},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Upatre.cmck","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Upatre.MU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2529552","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Upatre-7491797-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Upatre.NH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2529552 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Waski.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:TrojanDownloader/Upatre.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004c75411 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.mpJr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.wv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Upatre.efhcfx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dyreza-GF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2529552","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.PSBP-3847","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dropper.OP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Downloader.Upatre.Win32.41645","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"icanhazip.com\"\n \"www.msn.com\"\n \"static-hp-eus.s-msn.com\"\n \"ads1.msads.net\"\n \"img-s-msn-com.akamaized.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.238.136.31:80\"\n \"93.185.4.90:13543\"\n \"68.70.242.203:443\"\n \"109.86.226.85:443\"\n \"24.220.92.193:443\"\n \"176.36.251.208:443\"\n \"173.216.240.56:443\"\n \"69.163.81.211:443\"\n \"216.254.231.11:443\"\n \"204.79.197.203:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabBE8B.tmp\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarBE8C.tmp\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD30F.tmp\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD310.tmp\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabF01E.tmp\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarF01F.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$25","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"milkyhit.exe\" loaded module \"URLMON.DLL\" at base 775E0000\n \"milkyhit.exe\" loaded module \"VERSION.DLL\" at base 753F0000\n \"milkyhit.exe\" loaded module \"C:\\WINDOWS\\SYSTEM32\\FWPUCLNT.DLL\" at base 73F90000\n \"milkyhit.exe\" loaded module \"CRYPT32.DLL\" at base 75F40000\n \"milkyhit.exe\" loaded module \"USERENV.DLL\" at base 75460000\n \"milkyhit.exe\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 775C0000\n \"milkyhit.exe\" loaded module \"WINTRUST.DLL\" at base 76080000\n \"milkyhit.exe\" loaded module \"CRYPTSP.DLL\" at base 75880000\n \"milkyhit.exe\" loaded module \"CREDSSP.DLL\" at base 75520000\n \"milkyhit.exe\" loaded module \"C:\\WINDOWS\\SYSTEM32\\SCHANNEL.DLL\" at base 75690000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"C:\\Windows\\system32\\riched32.dll\" at 6DD50000\n \"milkyhit.exe\" loaded module \"C:\\Windows\\system32\\riched32.dll\" at 6DD50000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CoInternetCreateSecurityManager@urlmon.dll\"\n \"CoInternetCreateZoneManager@urlmon.dll\"\n \"CoInternetIsFeatureEnabledForUrl@urlmon.dll\"\n \"GetUserNameExW@SspiCli.dll\"\n \"DnsFree@dnsapi.DLL\"\n \"NamespaceCallout@fwpuclnt.dll\"\n \"CertOpenStore@CRYPT32.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"WinVerifyTrust@wintrust.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"milkyhit.exe\" (UID: 00498062-00002400)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00498062-00002400-77D1228D-504813\n LookupAccountNameLocalW@SECHOST.DLL at 00498062-00002400-77D1228D-512774","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"LogMilky.txt\" has type \"data\"\n \"milkyhit.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceW@SECHOST.DLL at 00498062-00002400-77D1228D-508070\n OpenServiceW@SECHOST.DLL at 00498062-00002400-77D1228D-508935\n OpenServiceW@SECHOST.DLL at 00498062-00002400-77D1228D-513422","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"milkyhit.exe\" at 00498062-00002400-77CF61F8-507212","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"milkyhit.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.25499303371","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")\n \"milkyhit.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$26","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Windows\\win.ini\"\n \"milkyhit.exe\" read file \"C:\\Windows\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"milkyhit.exe\" created file \"C:\\Windows\\system32\\en-US\\urlmon.dll.mui\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\icanhazip_com[1].txt\"\n \"milkyhit.exe\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"milkyhit.exe\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"\n \"milkyhit.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"milkyhit.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.3.0.61\"\n \"209.126.97.199\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.238.136.31 on port 80 is sent without HTTP header\n TCP traffic to 68.70.242.203 on port 443 is sent without HTTP header\n TCP traffic to 109.86.226.85 on port 443 is sent without HTTP header\n TCP traffic to 24.220.92.193 on port 443 is sent without HTTP header\n TCP traffic to 176.36.251.208 on port 443 is sent without HTTP header\n TCP traffic to 173.216.240.56 on port 443 is sent without HTTP header\n TCP traffic to 69.163.81.211 on port 443 is sent without HTTP header\n TCP traffic to 216.254.231.11 on port 443 is sent without HTTP header\n TCP traffic to 204.79.197.203 on port 80 is sent without HTTP header\n TCP traffic to 23.61.66.128 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.36 (KHTML, like Gecko) Chrome/44.0.2456.82 Safari/535.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"milkyhit.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabBE8B.tmp\" for deletion\n \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarBE8C.tmp\" for deletion\n \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD30F.tmp\" for deletion\n \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD310.tmp\" for deletion\n \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabF01E.tmp\" for deletion\n \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarF01F.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabBE8B.tmp\" with delete access\n \"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarBE8C.tmp\" with delete access\n \"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD30F.tmp\" with delete access\n \"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD310.tmp\" with delete access\n \"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabF01E.tmp\" with delete access\n \"milkyhit.exe\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarF01F.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"milkyhit.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"milkyhit.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"milkyhit.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"milkyhit.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"milkyhit.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"milkyhit.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"milkyhit.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoA\n GetModuleHandleA\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")\n \"milkyhit.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/56 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/56 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 36352 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\milkyhit.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"milkyhit.exe\" (PID: 00002400)\n \"\" wrote 52 bytes to a foreign process \"milkyhit.exe\" (PID: 00002400)\n \"\" wrote 4 bytes to a foreign process \"milkyhit.exe\" (PID: 00002400)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 20 (or more) hosts in at least 4 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.36 (KHTML, like Gecko) Chrome/44.0.2456.82 Safari/535.36\n Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"icanhazip.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 93.185.4.90 on port 13543","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"milkyhit.exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$29","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00498062-00002400-77D1228D-512901","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2a","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2b","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"milkyhit.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0.exe.bin\" was detected as \"Microsoft visual C 2.0\"\n \"milkyhit.exe\" was detected as \"Microsoft visual C 2.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"milkyhit.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"milkyhit.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/63 reputation engines marked \"http://bit.ly/icanhazip-faq\" as malicious (1% detection rate)\n 1/64 reputation engines marked \"https://is.gd\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"milkyhit.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"milkyhit.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"milkyhit.exe\" called \"OpenService\" to access the \"rasman\" service\n \"milkyhit.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"milkyhit.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"milkyhit.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"milkyhit.exe\" called \"OpenService\" to access the \"CryptSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"milkyhit.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"milkyhit.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"\n \"milkyhit.exe\" called \"ControlService\" and sent control code \"0X400\" to the service \"CryptSvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%TEMP%\\milkyhit.exe\", Handle: 180)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"milkyhit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"69/79 Antivirus vendors marked dropped file \"milkyhit.exe\" as malicious (classified as \"Trojan.Upatre\" with 87% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"69/79 Antivirus vendors marked spawned process \"milkyhit.exe\" (PID: 3656) as malicious (classified as \"Trojan.Upatre\" with 87% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.614CB815.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"milkyhit.exe\" (UID: 00000000-00003404) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"milkyhit.exe\" (UID: 00000000-00003404) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"dismhost.exe\" (UID: 00000000-00002312) was launched with modified environment variables: \"CommonProgramFiles, LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, TEMP, APPDATA, USERPROFILE, TMP, ProgramFiles\"\n Process \"dismhost.exe\" (UID: 00000000-00002312) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432, LOGONSERVER, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"milkyhit.exe\" (UID: 00000000-00003404)\n Spawned process \"dismhost.exe\" with commandline \"{F4631671-1342-4428-8B70-A4F381E6F7BE}\" (UID: 00000000-00002312)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"Application-304991.exe\" connecting to \"\\ThemeApiPort\"\n \"milkyhit.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"~{w4sG\"\n \"~Z}[\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"milkyhit.exe\" (Access type: \"CREATE\"; Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"milkyhit.exe\" (Access type: \"CREATE\"; Path: \"SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Application-304991.exe\" opened \"\\Device\\KsecDD\"\n \"milkyhit.exe\" opened \"\\Device\\KsecDD\"\n \"dismhost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dismhost.exe.614CB815.bin\" claimed CRC 141269 while the actual is CRC 100166\n \"milkyhit.exe\" claimed CRC 100166 while the actual is CRC 141269","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Application-304991.exe\" wrote bytes \"711176017a3b7501ab8b02007f950200fc8c0200729602006cc805001ecd72017d267201\" to virtual address \"0x75F407E4\" (part of module \"USER32.DLL\")\n \"Application-304991.exe\" wrote bytes \"c0df64771cf96377ccf863770d64657700000000c011067500000000fc3e067500000000e0130675000000009457047625e06477c6e0647700000000bc6a037600000000cf3106750000000093190476000000002c32067500000000\" to virtual address \"0x757A1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"Application-304991.exe\" allocated memory in \"%TEMP%\\milkyhit.exe\"","origin":"API Call","mitre_attack_id":"T1055.012","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 29 domains and 29 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":35,"imported_dlls_count":151,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":63,"files_deleted_count":0,"registry_keys_created_count":10,"registry_keys_modified_count":0,"registry_keys_deleted_count":8,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":56,"dns_resolutions_count":31,"contacted_urls_count":217,"http_requests_count":217},"behavior_tags":["backdoor","banker","crypt","downloader","dyre","dyreza","spam","upatre"],"sample_flags":["Network Traffic","Extracted Files","User Comment","Multi-Process"],"sandbox_reports":[{"id":"614cb68e7a98716f021c7945","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Upatre","contacted_countries":["CZE","SRB","USA"],"submit_name":"Application-304991.exe","analysis_start_time":"2021-09-23T17:17:09+00:00","indicators_count":{"informative":19,"suspicious":27,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"59d1da477ca3e16a14532036","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Upatre","contacted_countries":["CZE","UKR","USA"],"submit_name":"Application-304991.exe","analysis_start_time":"2017-10-02T08:19:23+00:00","indicators_count":{"informative":14,"suspicious":20,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5593c9a10e316d227bba99c4","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Gen","contacted_countries":["AND","CZE","POL","SVK","UKR","USA"],"submit_name":"Document_HM901417.exe","analysis_start_time":"2015-07-01T06:06:31+00:00","indicators_count":{"informative":10,"suspicious":23,"malicious":12},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"5593c97d0e316d6b7e050e37","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["BRA","CZE","DEU","IRL","UKR","USA"],"submit_name":"Document_HM901417.exe","analysis_start_time":"2015-10-16T07:11:49+00:00","indicators_count":{"informative":11,"suspicious":25,"malicious":12},"tags":["Network Traffic","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.238.136.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"93.185.4.90","port":13543,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"68.70.242.203","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"109.86.226.85","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"24.220.92.193","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"176.36.251.208","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"173.216.240.56","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"69.163.81.211","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"216.254.231.11","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"204.79.197.203","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.61.66.128","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.61.72.182","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.3.98.56","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"24.33.131.116","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"65.55.2.6","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"68.67.152.174","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"68.67.152.255","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"83.169.59.64","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"213.9.42.202","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"80.237.180.28","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"85.114.159.98","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"217.79.188.11","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"205.185.208.100","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"46.51.186.44","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"185.93.1.27","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"104.174.123.66","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.61.13.90","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"80.82.201.88","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"131.253.40.50","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"184.86.240.226","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"168.63.138.84","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"191.234.5.80","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.235.40.249","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"23.23.154.127","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"31.13.74.1","port":80,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"31.13.74.7","port":443,"protocol":"TCP","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"address":"64.182.208.182","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"93.185.4.90","port":13541,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"173.216.247.74","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"77.48.30.156","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"77.95.195.68","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"37.57.144.177","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"68.55.59.145","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"95.143.141.50","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"194.228.203.19","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"87.249.142.189","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"85.135.104.170","port":443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"76.84.81.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"address":"104.18.7.156","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"93.185.4.90","port":13542,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"173.248.31.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"173.248.31.6","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"173.243.255.79","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"69.9.204.114","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"188.255.239.34","port":443,"protocol":"TCP","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"address":"76.28.92.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"dns_resolutions":[{"domain":"static-hp-eus.s-msn.com","address":"23.61.66.128","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"asn.advolution.de","address":"213.9.42.202","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"msnad.nuggad.net","address":"80.82.201.88","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ad9.adfarm1.adition.com","address":"85.114.159.98","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"c.bing.com","address":"131.253.40.50","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"cdn.asn.advolution.de","address":"205.185.208.100","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"b.scorecardresearch.com","address":"184.86.240.226","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ping.chartbeat.net","address":"23.23.154.127","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"otf.msn.com","address":"168.63.138.84","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"api.bing.com","address":"191.234.5.80","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"imagesrv.adition.com","address":"217.79.188.11","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"m.adnxs.com","address":"68.67.152.174","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"www.msn.com","address":"204.79.197.203","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"img-s-msn-com.akamaized.net","address":"23.3.98.56","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"static.xx.fbcdn.net","address":"31.13.66.5","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"rad.msn.com","address":"65.55.2.6","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"icanhazip.com","address":"104.238.136.31","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"domain":"c.msn.com","address":"131.253.40.50","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"cdn.adspirit.de","address":"185.93.1.22","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"simyo.adclear.net","address":"46.51.186.44","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ib.adnxs.com","address":"68.67.152.255","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"lidl.adspirit.de","address":"80.237.180.28","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"www.facebook.com","address":"31.13.74.1","country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"dps.bing.com","address":"204.79.197.200","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ads1.msads.net","address":"23.61.72.182","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"www.bing.com","address":"204.79.197.200","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"static.chartbeat.com","address":"23.235.40.249","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ads.heias.com","address":"83.169.59.64","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"img.s-msn.com","address":"23.61.13.90","country":"United States","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"domain":"ic-407c0c00-0ac7b9-windowsupdate48.s.loris.llnwd.net","address":"69.28.170.99","ttl":54,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Limelight Networks","registrar_name_servers":"DNS11.LLNWD.NET","registrar_creation_date":"2002-07-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"domain":"ic-407c0c00-1475e2-windowsupdate48.s.loris.llnwd.net","address":"69.28.170.96","ttl":30,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"Limelight Networks","registrar_name_servers":"DNS11.LLNWD.NET","registrar_creation_date":"2002-07-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"http_requests":[{"host":"icanhazip.com","host_ip":"104.238.136.31:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"host":"","host_ip":"192.168.56.14:49230","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.msn.com","host_ip":"204.79.197.203:80","url":"/?ocid=iehp","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.msn.com","host_ip":"204.79.197.203:80","url":"/de-de/?ocid=iehp","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/de-de/homepage/_sc/css/6670b51d-562514/direction=ltr.locales=de-de.themes=start.dpi=resolution1x/86-eb2c87-e7435c42/47-e2d9a0-2a21d229/9b-34443b-68ddb2ab/cc-8262d3-ae53777e/21-742659-4da0aefe/78-fd52e7-78384465/d8-77a653-a169329a/7f-d7938c-3f6f3868/7c-708702-354b4712/bb-87838f-e3cb8dfd/b5-8be003-5960eecb/4c-2074f2-b663ebe2/88-9ed380-36a17fee/b9-afe498-b5681d36/finance-css-d0-9c6a48be6cdd3088c324f6d9424822-c16bd114/60-65fa40-c171b3a4/ce-d13d8c-91cdfbc1?ver=2.0.5763.29238&fdhead=ushpcombo30,al-ar-tb,al-bn-tb,hp-2hmodule,muidflt58cf,muidflt59cf,d-thshldie1,d-thshldie2&ocid=iehp&csopd=20151014152508","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/sc/c9/44f363.eot?","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/_h/804ff984/webcore/externalscripts/jquery/jquery-1.11.1.min.js","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/sc/9b/e151e5.gif","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"ads1.msads.net","host_ip":"23.61.72.182:80","url":"/library/8.4/dapmsn.js","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/de-de/homepage/_sc/js/6670b51d-abb715a9/direction=ltr.locales=de-de.themes=start.dpi=resolution1x/2c-b16882-1a55e7c5/b8-cfe050-8501a167/dd-523c53-68ddb2ab/24-9b9fbd-dd1c81bc/46-943949-68ddb2ab/33-28105f-f59cfe6/f4-1712c6-2943fc34/67-a0d3e0-68ddb2ab/finance-js-45-93ed8bb3fb55a96556fc791616b51e-e5780970/4b-e635f6-f30905ea?ver=2.0.5763.29238&fdhead=ushpcombo30,al-ar-tb,al-bn-tb,hp-2hmodule,muidflt58cf,muidflt59cf,d-thshldie1,d-thshldie2&ocid=iehp&csopd=20151014152508","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvMC0.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=178&y=427","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBiwNf.img?m=6&o=true&u=true&n=true&w=30&h=30","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvjQS.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv2ab.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"rad.msn.com","host_ip":"65.55.2.6:80","url":"/ADSAdClient31.dll?GetSAd=&DPJS=8.4&VWS=1&ID=36424C65E6E166DB0A524B2AE7ED673A&MUID=36424C65E6E166DB0A524B2AE7ED673A&AP=1402&PG=MSNDEDE12&PVGUID=a28745237f974c8e88cf593bf0cd24e9&PROVIDERID=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"m.adnxs.com","host_ip":"68.67.152.174:80","url":"/ttj?is_premium=0&member=280&inv_code=MSNDEDE12&imp_id=098a53126aef4fc6b886d3fe7c2b57a5&cb=286476360&reserve_encr=0007022TVNgzh8Cq6CeS1gyFn0yCAjOOg1vjwV3OY41U-FROCbw&size=728x90&promo_sizes=970x250&providerid=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"rad.msn.com","host_ip":"65.55.2.6:80","url":"/ADSAdClient31.dll?GetSAd=&DPJS=8.4&VWS=1&ID=36424C65E6E166DB0A524B2AE7ED673A&MUID=36424C65E6E166DB0A524B2AE7ED673A&AP=1089&PG=MSNDEDE1A&PVGUID=a28745237f974c8e88cf593bf0cd24e9&PROVIDERID=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"ib.adnxs.com","host_ip":"68.67.152.255:80","url":"/bounce?%2Fttj%3Fis_premium%3D0%26member%3D280%26inv_code%3DMSNDEDE12%26imp_id%3D098a53126aef4fc6b886d3fe7c2b57a5%26cb%3D286476360%26reserve_encr%3D0007022TVNgzh8Cq6CeS1gyFn0yCAjOOg1vjwV3OY41U-FROCbw%26size%3D728x90%26promo_sizes%3D970x250%26providerid%3D7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"rad.msn.com","host_ip":"65.55.2.6:80","url":"/ADSAdClient31.dll?GetSAd=&DPJS=8.4&VWS=1&ID=36424C65E6E166DB0A524B2AE7ED673A&MUID=36424C65E6E166DB0A524B2AE7ED673A&AP=1089&PG=MSNDEDE1B&PVGUID=a28745237f974c8e88cf593bf0cd24e9&PROVIDERID=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"rad.msn.com","host_ip":"65.55.2.6:80","url":"/ADSAdClient31.dll?GetSAd=&DPJS=8.4&VWS=1&ID=36424C65E6E166DB0A524B2AE7ED673A&MUID=36424C65E6E166DB0A524B2AE7ED673A&AP=1089&PG=MSNDEDE1D&PVGUID=a28745237f974c8e88cf593bf0cd24e9&PROVIDERID=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"rad.msn.com","host_ip":"65.55.2.6:80","url":"/ADSAdClient31.dll?GetSAd=&DPJS=8.4&VWS=1&ID=36424C65E6E166DB0A524B2AE7ED673A&MUID=36424C65E6E166DB0A524B2AE7ED673A&AP=1089&PG=MSNDEDE1C&PVGUID=a28745237f974c8e88cf593bf0cd24e9&PROVIDERID=7HD66FC","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"asn.advolution.de","host_ip":"213.9.42.202:80","url":"/00010c2d1000009ec/?rnd=0.4517302892397137","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"lidl.adspirit.de","host_ip":"80.237.180.28:80","url":"/adframe.php?pid=236&ord=168378368","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"imagesrv.adition.com","host_ip":"217.79.188.11:80","url":"/js/adition.js","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"ad9.adfarm1.adition.com","host_ip":"85.114.159.98:80","url":"/js?wp_id=3336250&kid=1420371&prf[adition_env]=ms","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"lidl.adspirit.de","host_ip":"80.237.180.28:80","url":"/adframe.php?&ref=http%3A%2F%2Fwww.msn.com%2Fde-de%2F%3Focid%3Diehp&pid=236&ord=168378368","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"cdn.asn.advolution.de","host_ip":"205.185.208.100:80","url":"/cr/00065fd1/1.gif","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"simyo.adclear.net","host_ip":"46.51.186.44:80","url":"/acv/A2398114/acv?ts=1444997775&campaign=BAC-add2&att=644-471-68653-60474-417745-msnde","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"lidl.adspirit.de","host_ip":"80.237.180.28:80","url":"/adview.php?tz=1444997776369011&pid=236&kid=1864&wmid=10585&sid=6&nvc=1&target=-","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA61Ofl.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuTVz.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1760&y=792","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvp6N.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1369&y=938","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBg3ODX.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42ckd.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB46JmN.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfwagm.img?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jpg&x=752&y=162","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAcN2Ks.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAa1xJF.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfu2jd.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=641&y=268","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBgErSP.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvaQT.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=668&y=572","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img.s-msn.com","host_ip":"23.61.13.90:80","url":"/tenant/amp/entityid/AA3DGHW.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvnlm.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=383&y=155","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvbUm.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static-hp-eus.s-msn.com","host_ip":"23.61.66.128:80","url":"/sc/2b/a5ea21.ico","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvlkv.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA61AKN.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfts9Q.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=986&y=766","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBku71Y.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvK2m.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img.s-msn.com","host_ip":"23.61.13.90:80","url":"/tenant/amp/entityid/BB8AdqN.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42pjY.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img.s-msn.com","host_ip":"23.61.13.90:80","url":"/tenant/amp/entityid/BBjBl9m.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAft0s0.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg&x=221&y=606","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfw2wO.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=667&y=473","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42hwF.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuxxw.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBaKjMp.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"msnad.nuggad.net","host_ip":"80.82.201.88:80","url":"/bk?nuggn=2072193066&nuggrid=nugghost.Homepage&nuggtg=Homepage&nuggl=http%3a%2f%2fdps.bing.com%2fAI%2fApi%2fv1%2fUserRest.svc%2fProvider%2f542E32AC-EB2A-4A0D-A430-FCB3DEBDBD25%2fUser%2fnil%2fSegment%2fNUGGVARS%2fgif%3fmeta%3dnuggad&random=444997774471","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvoqb.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=778&y=389","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA3e3XC.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvA1N.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=404&y=107","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAdAVrM.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv34V.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=640&y=320","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA54rQj.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuW4E.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=378&y=654","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"dps.bing.com","host_ip":"204.79.197.200:80","url":"/AI/Api/v1/UserRest.svc/Provider/542E32AC-EB2A-4A0D-A430-FCB3DEBDBD25/User/nil/Segment/102;145;108;115;122;126;129;137;139;142;249;233;241;238;266;253;213;229;308;309;310;210;212;231;236;239;243;267;292;293;339;341;348;355;999/gif?meta=nuggad","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftnue.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=472&y=134","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42x3V.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvXbR.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=1882&y=895","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvCRc.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA3e1pt.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfw7rd.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvaUl.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=431&y=181","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuYZ3.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvr06.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBiJi1J.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=592&y=519","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAag599.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"imagesrv.adition.com","host_ip":"217.79.188.11:80","url":"/js/acb/uid.html","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAbVvCa.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAbYRNq.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAbZ98R.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA3dXJH.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBg8EuY.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=963&y=625","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBhWLDH.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA8DrLq.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=1037&y=517","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvPYP.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=382&y=379","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvV0o.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=811&y=611","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvXvn.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=543&y=293","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuDDq.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42hvg.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfsMPM.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA9GNjr.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfunlm.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=492&y=490","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv60x.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=514&y=160","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv4b9.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=325&y=216","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA8GDem.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuyDv.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=391&y=305","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB1CcOi.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuW2i.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=1253&y=386","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvwdl.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=340&y=266","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfu6D2.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=887&y=728","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfumW2.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=370&y=297","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBm7qDo.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfveIc.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=1130&y=635","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftAVv.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42hvs.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv5Vf.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=411&y=97","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvm7g.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvbEd.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuTNi.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAbyinC.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfu4C1.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfmPzy.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvgRW.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42eYr.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvCkf.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftPnv.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA9UBR2.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfraIB.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfqHfo.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoar2.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BBknxwo.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvDI8.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftCcH.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=426&y=287","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"c.msn.com","host_ip":"131.253.40.50:80","url":"/c.gif?udc=true&rid=a28745237f974c8e88cf593bf0cd24e9&rnd=635805945565756570&rf=&tp=http%253A%252F%252Fwww.msn.com%252Fde-de%252F%253Focid%253Diehp&di=108&lng=de-de&cv.product=prime&pn=startpage&activityId=a28745237f974c8e88cf593bf0cd24e9&d.dgk=midlevel.pc.ms.ie8&d.imd=0","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfsNKu.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=318&y=134","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAdEQrC.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuv6d.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=462&y=352","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftiSR.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=442&y=155","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftp5m.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoUg5.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfekFU.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=1248&y=667","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfsPqA.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"c.bing.com","host_ip":"131.253.40.50:80","url":"/c.gif?udc=true&rid=a28745237f974c8e88cf593bf0cd24e9&rnd=635805945565756570&rf=&tp=http%253A%252F%252Fwww.msn.com%252Fde-de%252F%253Focid%253Diehp&di=108&lng=de-de&cv.product=prime&pn=startpage&activityId=a28745237f974c8e88cf593bf0cd24e9&d.dgk=midlevel.pc.ms.ie8&d.imd=0&ctsa=mr&CtsSyncId=987C716A6B6B4191BD4C60A8D45B6527&RedC=c.msn.com&MXFR=36424C65E6E166DB0A524B2AE7ED673A","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA6SFRQ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfsPm2.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=255&y=325","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA42EP9.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfml1v.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=419&y=265","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoOO8.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"c.msn.com","host_ip":"131.253.40.50:80","url":"/c.gif?udc=true&rid=a28745237f974c8e88cf593bf0cd24e9&rnd=635805945565756570&rf=&tp=http%253A%252F%252Fwww.msn.com%252Fde-de%252F%253Focid%253Diehp&di=108&lng=de-de&cv.product=prime&pn=startpage&activityId=a28745237f974c8e88cf593bf0cd24e9&d.dgk=midlevel.pc.ms.ie8&d.imd=0&ctsa=mr&CtsSyncId=987C716A6B6B4191BD4C60A8D45B6527&MUID=36424C65E6E166DB0A524B2AE7ED673A","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuG70.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB5zDwX.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfulv7.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftX5a.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB8xWM6.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=937&y=758","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoSYl.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA61ILp.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfqu1v.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftx1l.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA58NQj.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoShL.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfpl59.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA429NP.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfqvFf.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoLgE.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=590&y=445","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoCYe.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfsfPm.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB6CiHz.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfuUH1.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfisnI.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.bing.com","host_ip":"204.79.197.200:80","url":"/profile/history/msnframed","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfihSy.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=505&y=803","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"b.scorecardresearch.com","host_ip":"184.86.240.226:80","url":"/b?c1=2&c2=3000001&rn=1444997792297&c7=http%3A%2F%2Fwww.msn.com%2Fde-de%2F%3Focid%3Diehp&c8=MSN+Deutschland+%E2%80%93+mit+Hotmail+Nachfolger+Outlook+und+Messenger+Skype&c9=","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvst5.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvaiD.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"otf.msn.com","host_ip":"168.63.138.84:80","url":"/c.gif?evt=impr&js=1&rid=a28745237f974c8e88cf593bf0cd24e9&cts=1444997792297&clid=36424C65E6E166DB0A524B2AE7ED673A&rf=&cu=http%3A%2F%2Fwww.msn.com%2Fde-de%2F%3Focid%3Diehp&scr=1022x613&bh=395&bw=763&dv.Title1=MSN+Deutschland+%E2%80%93+mit+Hotmail+Nachfolger+Outlook+und+Messenger+Skype&viewType=size4column&di=108&mkt=de-de&pn=startpage&su=http%253A%252F%252Fwww.msn.com%252Fde-de%252F%253Focid%253Diehp&pid=startpage&mv=15&cv.product=prime&flightid=ushpcombo30%2Cal-ar-tb%2Cal-bn-tb%2Chp-2hmodule%2Cmuidflt58cf%2Cmuidflt59cf%2Cd-thshldie1%2Cd-thshldie2&exa=ushpcombo30%2Cal-ar-tb%2Cal-bn-tb%2Chp-2hmodule%2Cmuidflt58cf%2Cmuidflt59cf%2Cd-thshldie1%2Cd-thshldie2&activityId=a28745237f974c8e88cf593bf0cd24e9&cvs=Browser&subcvs=homepage&st.dpt=&st.sdpt=&cv.partner=&cv.publcat=&cv.author=&cv.entityId=&cv.entitySrc=&cv.parentId=&provid=&ar=0&d.dgk=midlevel.pc.ms.ie8&d.imd=0&tmpl=infopane%3A0%3Bcat%3A0%3Bst%3A0%3BIP%3ACookie%3BRV%3ACookie%3BEP%3A0&isStaticPage=False&pgIdx=&pgTot=&pp=False","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftKwL.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA3vOVA.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv7QV.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvbXJ.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.bing.com","host_ip":"204.79.197.200:80","url":"/s/as/1436447/de.js?_=1444997770881","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB95RJn.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftJ1i.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfrzlW.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"api.bing.com","host_ip":"191.234.5.80:80","url":"/qsonhs.aspx?form=PRDEDE&q=","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAft9Xo.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"otf.msn.com","host_ip":"168.63.138.84:80","url":"/c.gif?","method":"POST","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfroqe.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/BB72BOJ.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"static.chartbeat.com","host_ip":"23.235.40.249:80","url":"/js/chartbeat.js","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfpnjT.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAeEUsy.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfoXeG.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.bing.com","host_ip":"204.79.197.200:80","url":"/rms/rms%20answers%20SearchHistory%20MsnHistory/jc/fdc92814/a0348fbc.js","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfmrHe.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfh131.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfcj1n.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfeDKp.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfdLF0.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfbF8f.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfbUa0.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftcnm.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfogOk.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=651&y=174","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfcyZ8.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=851&y=751","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"ping.chartbeat.net","host_ip":"23.23.154.127:80","url":"/ping?h=de-de.msn.com&p=%2Fde-de&u=CmpDtNaNX9ID0sski&d=msn.com&g=42635&g0=homepage&n=1&f=f0001&c=0&x=0&m=0&y=6258&o=1272&w=395&j=45&R=1&W=0&I=0&E=0&e=0&r=&t=DU_OwIDetPgNDbBz0pCQj5Byuwmda&V=66&i=MSN%20Deutschland%20%E2%80%93%20mit%20Hotmail%20Nachfolger%20Outlook%20und%20Messenger%20Skype&tz=420&_cdname=eastus&sn=1&_","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAf8cBY.img?h=194&w=300&m=6&q=60&u=t&o=t&l=f&x=133&y=76","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfrlZ6.img?h=75&w=100&m=6&q=60&u=t&o=t&l=f&x=304&y=482","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvlXu.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.bing.com","host_ip":"204.79.197.200:80","url":"/fd/ls/l?IG=cf6a0871fcfd4ff8949a35632c6e2ead&Type=Event.CPT&DATA={\"pp\":{\"S\":\"L\",\"PC\":1455,\"FC\":-1,\"BC\":1455,\"BS\":5336,\"H\":5336,\"FE\":-1,\"LE\":-1,\"C1\":-1,\"C2\":-1,\"BP\":5336,\"KP\":-1,\"CT\":5357,\"IL\":0}}&P=SERP&DA=CHGv2","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA6SNZ6.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv4mi.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=373&y=321","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvwKr.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=748&y=242","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.facebook.com","host_ip":"31.13.74.1:80","url":"/plugins/like.php?locale=de_DE&href=https%3A%2F%2Fwww.facebook.com%2Fmsn.deutschland&send=false&layout=button_count&width=450&show_faces=false&font&colorscheme=light&action=like&height=21","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfvCIT.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1339&y=698","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AA6KizP.img?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAftKTd.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1013&y=671","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfw82F.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=1193&y=755","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"www.bing.com","host_ip":"204.79.197.200:80","url":"/favicon.ico","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfw4Xs.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=639&y=380","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfr3sG.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=340&y=289","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfu5PK.img?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jpg","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAfv5Hx.img?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jpg&x=286&y=383","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"img-s-msn-com.akamaized.net","host_ip":"23.3.98.56:80","url":"/tenant/amp/entityid/AAft34I.img?h=368&w=622&m=6&q=60&u=t&o=t&l=f&f=jpg&x=717&y=545","method":"GET","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"host":"ic-407c0c00-0ac7b9-windowsupdate48.s.loris.llnwd.net","host_ip":"69.28.170.99:80","url":"/llnhost_ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9357d700c0e63af2","method":"GET","header":"GET /llnhost_ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9357d700c0e63af2 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nIf-Modified-Since: Tue, 13 Aug 2019 16:20:54 GMT\nIf-None-Match: \"0f77d14f351d51:0\"\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ic-407c0c00-0ac7b9-windowsupdate48.s.loris.llnwd.net","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"host":"ic-407c0c00-1475e2-windowsupdate48.s.loris.llnwd.net","host_ip":"69.28.170.96:80","url":"/llnhost_ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6375559a3d29fa9b","method":"GET","header":"GET /llnhost_ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6375559a3d29fa9b HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ic-407c0c00-1475e2-windowsupdate48.s.loris.llnwd.net","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}],"processes":[{"pid":3240,"ppid":0,"name":"Application-304991.exe","command_line":"","sha256":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","normalized_path":"C:\\Application-304991.exe","uid":"00000000-00003240","icon":"$2f"},{"pid":3404,"ppid":3240,"name":"milkyhit.exe","command_line":"","sha256":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","normalized_path":"%TEMP%\\milkyhit.exe","parent_uid":"00000000-00003240","uid":"00000000-00003404"},{"pid":2312,"ppid":0,"name":"dismhost.exe","command_line":"{F4631671-1342-4428-8B70-A4F381E6F7BE}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\TEMP\\98BA8FD4-8963-4FE3-BA03-C2F56304AF94\\dismhost.exe","uid":"00000000-00002312","icon":"$30"}],"all_imported_dlls":["USERENV.dll","CRTDLL.dll","COMCTL32.dll","sechost.dll","wship6.dll","sensapi.dll","MSCTF.dll","KERNELBASE.dll","USER32.dll","fwpuclnt.dll","dwmapi.dll","CRYPTSP.dll","dnsapi.DLL","riched32.dll","msvcrt.dll","rasman.dll","napinsp.dll","ncrypt.dll","urlmon.dll","RPCRT4.dll","PSAPI.DLL","ole32.dll","wininet.dll","NLAapi.dll","ws2_32.DLL","NSI.dll","wintrust.dll","GPAPI.dll","ntdll.dll","rtutils.dll","SspiCli.dll","CFGMGR32.dll","DEVOBJ.dll","OLEAUT32.dll","ntmarta.dll","WINHTTP.dll","iphlpapi.DLL","wshtcpip.dll","credssp.dll","SHLWAPI.dll","secur32.dll","rsaenh.dll","cryptnet.dll","ADVAPI32.dll","USP10.dll","profapi.dll","Cabinet.dll","DEVRTL.dll","rasadhlp.dll","pnrpnsp.dll","schannel.DLL","bcryptprimitives.dll","dhcpcsvc6.DLL","winrnr.dll","LPK.dll","GDI32.dll","CRYPTBASE.dll","kernel32.dll","shell32.dll","apphelp.dll","RASAPI32.dll","mswsock.dll","CRYPT32.dll","SETUPAPI.dll","uxtheme.dll","dhcpcsvc.DLL","VERSION.dll","IMM32.DLL","Normaliz.dll","crtdll.dll","msasn1.dll","FWPUCLNT.DLL","RpcRtRemote.dll","userenv.dll","webio.dll","NapiNSP.dll","rasapi32.dll","msxml3.dll","msxml3r.dll","comctl32.dll","dhcpcsvc.dll","dhcpcsvc6.dll","schannel.dll","winhttp.dll","tzres.dll","riched20.dll","winnsi.dll","cryptsp.dll","bcrypt.dll","devrtl.dll","msctf.dll","rpcss.dll","WSHTCPIP.DLL","gdi32.dll","ws2_32.dll","normaliz.dll","user32.dll","advapi32.dll","rpcrt4.dll","lpk.dll","shlwapi.dll","cryptbase.dll","oleaut32.dll","nsi.dll","KernelBase.dll","version.dll","cfgmgr32.dll","usp10.dll","devobj.dll","iertutil.dll","sspicli.dll","IPHLPAPI.DLL","SensApi.dll","netprofm.dll","gpapi.dll","imm32.dll","nlaapi.dll","npmproxy.dll","setupapi.dll","clbcatq.dll","crypt32.dll","Wldap32.dll","dnsapi.dll","cabinet.dll","SPInf.dll","CbsCore.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","LogProvider.dll","DrUpdate.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wow64cpu.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-user32-l1-1-0.dll","wow64win.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wdscore.dll","dbghelp.dll","api-ms-win-core-synch-l1-2-0.dll","VxSSL64.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","drvstore.dll","wshqos.dll","wow64.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","OSProvider.dll","DismProv.dll","SSShim.dll","DmiProvider.dll","DismCorePS.dll","mpr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"LogMilky.txt","sha256":"5707baf2033370e7a9a5eba05d41744e9fa41d52e2e0d48a81788d1a7ff8c1a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"milkyhit.exe","sha256":"ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"TarAB8D.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"icanhazip_com[1].txt","sha256":"aba643f4867d6532509cc2fffdd63adb35a48717d923e1aecc4f862f93b7be8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"677ffb54bd3cc0e2e66eccaf2f6e6c8e1050286516e4f2ef984a3a3673ccc311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"CabAB8C.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"CabAC60.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"CabAED9.tmp","sha256":"677ffb54bd3cc0e2e66eccaf2f6e6c8e1050286516e4f2ef984a3a3673ccc311","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"TarAC61.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"TarAEDA.tmp","sha256":"8c0f5d09cf41e38cf161b6cdd1c3a76cec845b7c11db267ab800edabf1a23fb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"dismhost.exe.614CB815.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"L64C70EX.txt","sha256":"edff6dc526ee3b0cf4a6c003bd93e12e2ec243a2de838bd5c275e98f652c10da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"85UK779O.txt","sha256":"77017dda5e099abf5c1dce1672f7d4b9b0a0ca3f9e324258d73525041c948d7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"dism.log","sha256":"c6e74623b1dd643d884c931461c2038e6151c868ef18a7ef44cc86c3fc1ecb6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"files_written":[{"path":"%TEMP%\\LogMilky.txt","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%TEMP%\\milkyhit.exe","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\icanhazip_com[1].txt","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\icanhazip_com[1].txt","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\system32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"path":"%WINDIR%\\TEMP\\98BA8FD4-8963-4FE3-BA03-C2F56304AF94\\en-US\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\TEMP\\98BA8FD4-8963-4FE3-BA03-C2F56304AF94\\en\\dismhost.exe.mui","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\Logs\\DISM\\dism.log","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.23505_none_681aa442f6fed7f0\\CbsCore.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CP53U0VR\\85UK779O.txt","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"C:\\BVTBin\\Tests\\installpackage\\csilogfile.log","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\Temp\\98BA8FD4-8963-4FE3-BA03-C2F56304AF94\\en-US\\DmiProvider.dll.mui","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\inf\\oem12.inf","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\VBoxVideo.inf","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\System32\\DriverStore\\FileRepository\\vboxvideo.inf_amd64_neutral_1ade99e6e02a247f\\vboxvideo.PNF","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"path":"%WINDIR%\\inf\\oem11.inf","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MILKYHIT_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MILKYHIT_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}]},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5593c97d0e316d6b7e050e37"},{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hlxzwej!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hlxzwej!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hlxzwej!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"},{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hlxzwej!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\c:!users!hlxzwej!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\c:!users!hlxzwej!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\c:!users!hlxzwej!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"Local\\c:!users!hlxzwej!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59d1da477ca3e16a14532036"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"614cb68e7a98716f021c7945"}]}]}},"report_ids":{"sandbox_job_ids":["59d1da477ca3e16a14532036","5593c97d0e316d6b7e050e37","614cb68e7a98716f021c7945","5593c9a10e316d227bba99c4"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ab036a9c324a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab036a9c324a…. Malware family: Trojan.Generic. Threat score 100/100. 22/24 AV engines flagged this file. 16 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ab036a9c324a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab036a9c324a…. Malware family: Trojan.Generic. Threat score 100/100. 22/24 AV engines flagged this file. 16 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab036a9c324ad09ab36d3d805e5bcdc8be8103ceb7db3dd5f95dafa1054b96c0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ab036a9c324a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab036a9c324a…. Malware family: Trojan.Generic. Threat score 100/100. 22/24 AV engines flagged this file. 16 malicious and 32 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]