24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Mydoom Sample 48cf912217c1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 48cf912217c1…. Malware family: Worm.Mydoom. Threat score 100/100. 28/30 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","keywords":["Malicious","Worm.Mydoom","malware analysis","sandbox report","threat intelligence","48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205"],"about":{"@type":"SoftwareApplication","name":"message.pif.exe","applicationCategory":["peexe","executable"],"identifier":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Mydoom","antivirusDetections":{"malicious":28,"total":30},"behavioralIndicators":{"malicious":9,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e0,"Winamp 5.0 _en_ Crack.com" has type "empty" "Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"26:T23e8,Heuristic match: "scires.com" Heuristic match: "ShareReactor.com" Heuristic match: "yahoo.com" Heuristic match: "sf.net" Heuristic match: "linux.org" Heuristic match: "h.com" Heuristic match: "gmail.com" Heuristic match: "126.com" Heuristic match: "126mx00.mxmail.netease.com" Heuristic match: "126mx01.mxmail.netease.com" Heuristic match: "126mx02.mxmail.netease.com" Heuristic match: "126mx03.mxmail.netease.com" Heuristic match: "246tnt.com" Heuristic match: "Mellanox-com.mail.protection.outlook.com" Heuristic match: "aer-mx-01.cisco.com" Heuristic match: "alexa-global-in.qualcomm.com" Heuristic match: "alexa-in-ams.qualcomm.com" Heuristic match: "alexa-in-lv.qualcomm.com" Heuristic match: "alexa-in-sd.qualcomm.com" Heuristic match: "alexa-in-tai.qualcomm.com" Heuristic match: "alinet.it" Heuristic match: "alln-mx-01.cisco.com" Heuristic match: "alum-mit-edu.mail.protection.outlook.com" Heuristic match: "alum.mit.edu" Heuristic match: "alumni-purdue-edu.mail.protection.outlook.com" Heuristic match: "alumni.purdue.edu" Heuristic match: "apple.com" Heuristic match: "aserp2020.oracle.com" Heuristic match: "aserp2030.oracle.com" Heuristic match: "aserp2040.oracle.com" Heuristic match: "aserp2050.oracle.com" Heuristic match: "aserp2060.oracle.com" Heuristic match: "ashi.footprints.net" Heuristic match: "aspmx2.googlemail.com" Heuristic match: "aspmx3.googlemail.com" Heuristic match: "athonet-com.mail.protection.outlook.com" Heuristic match: "athonet.com" Heuristic match: "baslerweb.com" Heuristic match: "baslug.org" Heuristic match: "baynetworks-com.mail.protection.outlook.com" Heuristic match: "baynetworks.com" Heuristic match: "bguyton.com" Heuristic match: "broadcom.com" Heuristic match: "bryson.demon.co.uk" Heuristic match: "cisco.com" Heuristic match: "cr0.net" Heuristic match: "delmic.com" Heuristic match: "desy.de" Heuristic match: "diningphilosopher.de" Heuristic match: "diorcet.fr" Heuristic match: "emeerson.com" Heuristic match: "ericsson-com.mail.protection.outlook.com" Heuristic match: "ericsson.com" Heuristic match: "fb.mail.gandi.net" Heuristic match: "giga.or.at" Heuristic match: "gimp.org" Heuristic match: "gmx.net" Heuristic match: "gsu-edu.mail.eo.outlook.com" Heuristic match: "gsu-edu.mail.protection.outlook.com" Heuristic match: "gsu.edu" Heuristic match: "ietf.org" Heuristic match: "iki.fi" Heuristic match: "inbox.lv" Heuristic match: "isl.rdc.toshiba.co.jp" Heuristic match: "its-v.de" Heuristic match: "ixperta.com" Heuristic match: "lists.tcpdump.org" Heuristic match: "mail.246tnt.com" Heuristic match: "mail.alinet.it" Heuristic match: "mail.alum.mit.edu" Heuristic match: "mail.alumni.purdue.edu" Heuristic match: "mail.baslerweb.com" Heuristic match: "mail.bc-bd.org" Heuristic match: "mail.cisco.com" Heuristic match: "mail.definitely.at" Heuristic match: "mail.delmic.com" Heuristic match: "mail.diningphilosopher.de" Heuristic match: "mail.diorcet.fr" Heuristic match: "mail.ericsson.com" Heuristic match: "mail.giga.or.at" Heuristic match: "mail.gmx.net" Heuristic match: "mail.gsu.edu" Heuristic match: "mail.ietf.org" Heuristic match: "mail.iki.fi" Heuristic match: "mail.inbox.lv" Heuristic match: "mail.mail.ru" Heuristic match: "mail.mellanox.com" Heuristic match: "mail.netyl.org" Heuristic match: "mail.oracle.com" Heuristic match: "mail.primarydata.com" Heuristic match: "mail.promus.com" Heuristic match: "mail.qca.qualcomm.com" Heuristic match: "mail.renfro.org" Heuristic match: "mail.rogers.com" Heuristic match: "mail.ru" Heuristic match: "mail.samba.org" Heuristic match: "mail.samsung.com" Heuristic match: "mail.stackframe.org" Heuristic match: "mail.stoeckmann.org" Heuristic match: "mail.strongswan.org" Heuristic match: "mail.web.de" Heuristic match: "mail.willglynn.com" Heuristic match: "mail01.baslerweb.com" Heuristic match: "mail1.ixperta.com" Heuristic match: "mail2.iki.fi" Heuristic match: "mail2.ixperta.com" Heuristic match: "mail3.iki.fi" Heuristic match: "mail3.ixperta.com" Heuristic match: "mailin.samsung.com" Heuristic match: "mailprot.hilton.com" Heuristic match: "maxx.shmoo.com" Heuristic match: "mellanox.com" Heuristic match: "mgate-2.bguyton.com" Heuristic match: "mta5.am0.yahoodns.net" Heuristic match: "mta6.am0.yahoodns.net" Heuristic match: "mta7.am0.yahoodns.net" Heuristic match: "mx-ha02.web.de" Heuristic match: "mx-ha03.web.de" Heuristic match: "mx-rogers.mail.am0.yahoodns.net" Heuristic match: "mx.126.com" Heuristic match: "mx.246tnt.com" Heuristic match: "mx.acantho.net" Heuristic match: "mx.alinet.it" Heuristic match: "mx.alum.mit.edu" Heuristic match: "mx.alumni.purdue.edu" Heuristic match: "mx.cisco.com" Heuristic match: "mx.delmic.com" Heuristic match: "mx.ericsson.com" Heuristic match: "mx.giga.or.at" Heuristic match: "mx.gmx.net" Heuristic match: "mx.gsu.edu" Heuristic match: "mx.ietf.org" Heuristic match: "mx.iki.fi" Heuristic match: "mx.inbox.lv" Heuristic match: "mx.mail.ru" Heuristic match: "mx.mellanox.com" Heuristic match: "mx.netyl.org" Heuristic match: "mx.oracle.com" Heuristic match: "mx.primarydata.com" Heuristic match: "mx.promus.com" Heuristic match: "mx.qca.qualcomm.com" Heuristic match: "mx.renfro.org" Heuristic match: "mx.rogers.com" Heuristic match: "mx.samba.org" Heuristic match: "mx.samsung.com" Heuristic match: "mx.stackframe.org" Heuristic match: "mx.stoeckmann.org" Heuristic match: "mx.strongswan.org" Heuristic match: "mx.web.de" Heuristic match: "mx.willglynn.com" Heuristic match: "mx00.emig.gmx.net" Heuristic match: "mx00.kundenserver.de" Heuristic match: "mx01.emig.gmx.net" Heuristic match: "mx01.kundenserver.de" Heuristic match: "mx1-lw-eu.apache.org" Heuristic match: "mx1-lw-us.apache.org" Heuristic match: "mx1.acantho.net" Heuristic match: "mx1.inbox.lv" Heuristic match: "mx1.mtaroutes.com" Heuristic match: "mx1.qq.com" Heuristic match: "mx1.redhat.com" Heuristic match: "mx1.seznam.cz" Heuristic match: "mx2-lw-eu.apache.org" Heuristic match: "mx2-lw-us.apache.org" Heuristic match: "mx2.acantho.net" Heuristic match: "mx2.inbox.lv" Heuristic match: "mx2.mtaroutes.com" Heuristic match: "mx2.ovh.net" Heuristic match: "mx2.qq.com" Heuristic match: "mx2.redhat.com" Heuristic match: "mx3.mtaroutes.com" Heuristic match: "mx3.qq.com" Heuristic match: "mx4.mtaroutes.com" Heuristic match: "mx76.mb1p.com" Heuristic match: "mxs.mail.ru" Heuristic match: "mxt.securemx.jp" Heuristic match: "netyl.org" Heuristic match: "newbridge.com" Heuristic match: "ns.aus.com" Heuristic match: "ns1.samba.org" Heuristic match: "nwk-aaemail-lapp03.apple.com" Heuristic match: "onlineconnections.com.au" Heuristic match: "open-mesh.com" Heuristic match: "openoffice.org" Heuristic match: "oracle.com" Heuristic match: "owa.ixperta.com" Heuristic match: "primarydata-com.mail.protection.outlook.com" Heuristic match: "primarydata.com" Heuristic match: "promus.com" Heuristic match: "qca.qualcomm.com" Heuristic match: "qq.com" Heuristic match: "rcdn-mx-01.cisco.com" Heuristic match: "redhat.com" Heuristic match: "renfro.org" Heuristic match: "rogers.com" Heuristic match: "samba.org" Heuristic match: "samsung.com" Heuristic match: "seznam.cz" Heuristic match: "shmoo.com" Heuristic match: "smtp-intra-1.desy.de" Heuristic match: "smtp-intra-2.desy.de" Heuristic match: "smtp-intra-3.desy.de" Heuristic match: "smtp.alinet.it" Heuristic match: "smtp.alum.mit.edu" Heuristic match: "smtp.alumni.purdue.edu" Heuristic match: "smtp.cisco.com" Heuristic match: "smtp.delmic.com" Heuristic match: "smtp.duncanthrax.net" Heuristic match: "smtp.ericsson.com" Heuristic match: "smtp.giga.or.at" Heuristic match: "smtp.gnome.org" Heuristic match: "smtp.gsu.edu" Heuristic match: "smtp.ietf.org" Heuristic match: "smtp.iki.fi" Heuristic match: "smtp.mail.ru" Heuristic match: "smtp.mellanox.com" Heuristic match: "smtp.netyl.org" Heuristic match: "smtp.oracle.com" Heuristic match: "smtp.primarydata.com" Heuristic match: "smtp.promus.com" Heuristic match: "smtp.qca.qualcomm.com" Heuristic match: "smtp.renfro.org" Heuristic match: "smtp.rogers.com" Heuristic match: "smtp.samba.org" Heuristic match: "smtp.stackframe.org" Heuristic match: "smtp.stoeckmann.org" Heuristic match: "smtp.web.de" Heuristic match: "smtp.willglynn.com" Heuristic match: "sourcefrog.net" Heuristic match: "spool.mail.gandi.net" Heuristic match: "stackframe.org" Heuristic match: "stoeckmann.org" Heuristic match: "strongswan.org" Heuristic match: "toshiba.co.jp" Heuristic match: "tycale.be" Heuristic match: "us-smtp-inbound-1.mimecast.com" Heuristic match: "us-smtp-inbound-2.mimecast.com" Heuristic match: "userp2020.oracle.com" Heuristic match: "userp2030.oracle.com" Heuristic match: "userp2040.oracle.com" Heuristic match: "userp2050.oracle.com" Heuristic match: "userp2060.oracle.com" Heuristic match: "web.de" Heuristic match: "willglynn.com" Heuristic match: "winpcap-org.p10.spamhero.com" Heuristic match: "winpcap.org" Heuristic match: "wireshark-org.p30.spamhero.net" Heuristic match: "wireshark.org"27:T50a,"Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"28:Ta5a,".exe" wrote bytes "b436bb74" to virtual address "0x74BC025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83abb74" to virtual address "0x74BC01FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x74C01680" (part of module "WS2_32.DLL") ".exe" wrote bytes "b84013d973ffe0" to virtual address "0x74BB3AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x74BB4E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x74BB4D78" (part of module "SSPICLI.DLL") ".exe" wrote bytes "7111d7017a3bd601ab8b02007f950200fc8c0200729602006cc805001ecdd3017d26d301" to virtual address "0x756007E4" (part of module "USER32.DLL") ".exe" wrote bytes "d83abb74" to virtual address "0x74BC0258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436bb74" to virtual address "0x74BC0278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83abb74" to virtual address "0x74BC0274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012d973ffe0" to virtual address "0x74C01368" (part of module "WS2_32.DLL") ".exe" wrote bytes "0efc347781ed3377ae863277c6e03177effd34772d163377c0fc3077da8f3b7760143577478d3277a8e231776089327700000000ad37c0748b2dc074b641c07400000000" to virtual address "0x73CB1000" (part of module "WINHTTP.DLL") ".exe" wrote bytes "c0df31771cf93077ccf830770d64327700000000c011707500000000fc3e707500000000e0137075000000009457817525e03177c6e0317700000000bc6a807500000000cf3170750000000093198175000000002c32707500000000" to virtual address "0x772C1000" (part of module "NSI.DLL") ".exe" wrote bytes "b8c015d973ffe0" to virtual address "0x74BB36B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x74BB4D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436bb74" to virtual address "0x74BC01E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "7d07357781ed3377ae863277c6e03177effd34772d16337760143577478d3277a8e231776089327700000000ad37c0748b2dc074b641c07400000000" to virtual address "0x73DA1000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "d83abb74" to virtual address "0x74BC01E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b436bb74" to virtual address "0x74BC0200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "6012d973" to virtual address "0x75BAE324" (part of module "WININET.DLL")29:T19cd,".exe" created file "C:\Windows\lsass.exe:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp6F83.tmp:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp6FD2.tmp:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\DW\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\tmp73FC.tmp:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EURO\Harry Potter.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Filters\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Help\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\Kazaa Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\index.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\index.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\Kazaa Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\WinRAR.v.3.2.and.key.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\ICQ 4 Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\Kazaa Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\Kazaa Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\WinRAR.v.3.2.and.key.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\WinRAR.v.3.2.and.key.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\Kazaa Lite.com:Zone.Identifier"2a:T9a8,73/79 Antivirus vendors marked dropped file "Harry Potter.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Kazaa Lite.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Harry Potter.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Kazaa Lite.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "ICQ 4 Lite.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "ICQ 4 Lite.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "index.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "index.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Harry Potter.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.exe" as malicious (classified as "Worm.Mydoom" with 92% detection rate) 73/79 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 92% detection rate)2b:T579a,Found malicious artifacts related to "4.18.43.3": ... File SHA256: d3504e5a29dc4bc963d641e7aab27765c03f3cc4b6c388e8e937c992bd4b5380 (AV positives: 65/72 scanned on 07/22/2019 08:02:54) File SHA256: 7d33cbfdfb18e0cbdba0074fe73d292c03fadc8a3f6f4301907d06d2788b16de (AV positives: 66/72 scanned on 07/16/2019 21:26:14) File SHA256: cf7389847af754d0f7b729e508b8caf1ee2555607b8fa3190fc37503b9221425 (AV positives: 66/73 scanned on 12/21/2018 11:20:45) Found malicious artifacts related to "94.100.180.31": ... File SHA256: 0c5e1f83ef7543de958be68b3d36918e663ccbcd25cf77f569486c0ebffa0999 (AV positives: 51/73 scanned on 08/01/2019 22:35:02) File SHA256: 4e0b1d23fca0e69436d971342499c3689559662acba7771d85a49dacb74a3034 (AV positives: 31/72 scanned on 08/01/2019 18:39:09) File SHA256: 40df61d589d6b67d9826a9a3349dec31d838a89d7ae68d8d18857ef5440e2892 (AV positives: 52/72 scanned on 08/01/2019 21:47:45) File SHA256: 1e959753e2ed5b5b8d17c94c75e4b803795159d1aa06017bf023aca6217437b5 (AV positives: 55/72 scanned on 08/01/2019 14:38:58) File SHA256: 2e926614f5734e4b8427b5f0af93719a1ad8042bc3da3fc0f87b9b7a5abe5290 (AV positives: 53/73 scanned on 08/01/2019 17:48:10) File SHA256: 133219947d92da08441d1b982b23740c82892bc5a8541dd3ce4160a37c7eb9c9 (Date: 07/21/2019 15:02:42) File SHA256: 124387fc0b7d8686eb62ba07fdbe01550cdc017ab276b77aefbc376d615f7a82 (Date: 07/05/2019 09:27:52) File SHA256: 6fca1c112e7399112c14dda28e5f6bc7fb439d9c2f92f88d2692ae51744bccf2 (Date: 04/27/2019 11:07:04) File SHA256: 1071216d7073c3ea6a8bcacbee2a3200b564d290be7b45c383744fb20c8029ed (Date: 04/24/2019 19:21:28) File SHA256: 3ca5ba7a3158b84a0fe5593ab118d25c60963999417dec6fe51dec4e8c55355c (Date: 12/20/2018 09:17:23) Found malicious artifacts related to "220.181.15.207": ... File SHA256: d9f9675063607cbf7e87b2196a2b5beb4f8caa868b043dc82c453097f6203aa1 (AV positives: 61/71 scanned on 08/01/2019 04:29:12) File SHA256: 1bc7a69a0d6ddf1f6e41c3e1c808c8d14e1c9e6be58b9b5891931f879c6811ca (AV positives: 56/72 scanned on 08/01/2019 04:31:41) File SHA256: 8c0f05cc99f7e96e2a2a37a1a95de95026c1b381846c422a36d378374eee9063 (AV positives: 54/69 scanned on 08/01/2019 01:10:57) File SHA256: d0c660322194bf9c6a03f49dcfc4703b8a354e44b70d24bb1ca64c3f659dab5d (AV positives: 56/71 scanned on 08/01/2019 00:27:51) File SHA256: 520216521f2ee7210dfbdfefb36c42e9ae41991ec59de5ffaf0de81d6bcdc55b (AV positives: 57/72 scanned on 08/01/2019 00:25:51) Found malicious artifacts related to "98.137.159.27": ... File SHA256: 10b9bf60c8e32f1f2dc914bc499b780a7847ea8e6a4a6af229261ed50ec1447f (AV positives: 55/73 scanned on 08/01/2019 22:37:48) File SHA256: 4e0b1d23fca0e69436d971342499c3689559662acba7771d85a49dacb74a3034 (AV positives: 31/72 scanned on 08/01/2019 18:39:09) File SHA256: 096a4d29c279e472356f70fc4719c511da593b29d36dd784e4d6fbca529c1d37 (AV positives: 55/71 scanned on 08/01/2019 14:16:10) File SHA256: 40df61d589d6b67d9826a9a3349dec31d838a89d7ae68d8d18857ef5440e2892 (AV positives: 52/72 scanned on 08/01/2019 21:47:45) File SHA256: f59a60dad03df62d1ff58dd21c7f82f7bbbaf4f47fb84b857c5eca759dd903b7 (AV positives: 36/72 scanned on 08/01/2019 20:46:58) File SHA256: 70bec12844cc70e4e82aa14370cdb4ff330032e23faf636848cfba1677c419f4 (Date: 07/31/2019 06:05:59) File SHA256: 0381a4b84c7b0d69c8ce7afb7bbbde2e5f12f3a6fa27d86205fbb8b9ca5be414 (Date: 07/29/2019 16:24:14) File SHA256: 9e06b35563c2067121cf420974355de337ce928ed0adc09823095819b6cb2302 (Date: 07/29/2019 00:23:48) File SHA256: d7f626e03aa8c1b14782d7acfebcbae8d6de00764516d82694186a0c34804f79 (Date: 07/21/2019 15:20:45) File SHA256: 9781a73b4538179421520c1ed31c0bfa514fd146764d83f6c1c3ee3d875a3d43 (Date: 07/21/2019 14:46:03) Found malicious artifacts related to "220.181.15.145": ... File SHA256: d9f9675063607cbf7e87b2196a2b5beb4f8caa868b043dc82c453097f6203aa1 (AV positives: 61/71 scanned on 08/01/2019 04:29:12) File SHA256: 1bc7a69a0d6ddf1f6e41c3e1c808c8d14e1c9e6be58b9b5891931f879c6811ca (AV positives: 56/72 scanned on 08/01/2019 04:31:41) File SHA256: 8c0f05cc99f7e96e2a2a37a1a95de95026c1b381846c422a36d378374eee9063 (AV positives: 54/69 scanned on 08/01/2019 01:10:57) File SHA256: d0c660322194bf9c6a03f49dcfc4703b8a354e44b70d24bb1ca64c3f659dab5d (AV positives: 56/71 scanned on 08/01/2019 00:27:51) File SHA256: 520216521f2ee7210dfbdfefb36c42e9ae41991ec59de5ffaf0de81d6bcdc55b (AV positives: 57/72 scanned on 08/01/2019 00:25:51) Found malicious artifacts related to "98.137.159.25": ... File SHA256: 10b9bf60c8e32f1f2dc914bc499b780a7847ea8e6a4a6af229261ed50ec1447f (AV positives: 55/73 scanned on 08/01/2019 22:37:48) File SHA256: 6079f7f3f290e49affe315de5c5dd2d121ecde5abd6ed8df34f0b7d336d94bd4 (AV positives: 44/69 scanned on 08/01/2019 18:49:26) File SHA256: 015b3a5f0f67fe2ab7cb2ef0e2708ccdf2591783e51ca6f094b2687f993a575d (AV positives: 57/72 scanned on 08/01/2019 22:24:29) File SHA256: 40df61d589d6b67d9826a9a3349dec31d838a89d7ae68d8d18857ef5440e2892 (AV positives: 52/72 scanned on 08/01/2019 21:47:45) File SHA256: f59a60dad03df62d1ff58dd21c7f82f7bbbaf4f47fb84b857c5eca759dd903b7 (AV positives: 36/72 scanned on 08/01/2019 20:46:58) File SHA256: ac3f5fde5e559f609ecb8df8d576f5a2bf404df97851aa505a4e588ed9fbcf66 (Date: 08/01/2019 11:08:12) File SHA256: dcae0989125a310ef4ec4313d307a8daad6c42a963c5754a9fd625ad98da73f9 (Date: 07/31/2019 06:06:53) File SHA256: d29de9bbbfbd9ba04914c2edcede72d628ea9e06c30d4febd46c75643cf42cfb (Date: 07/25/2019 05:39:54) File SHA256: cadecfe12b6fb889d14a4c8f8b778cebfe5756186d2067b143f6f98a2c20db84 (Date: 07/25/2019 05:13:15) File SHA256: e66d6415efc9a212526a0a8855a6b47151b3c76ea0f5fae68fcc672241d1b88a (Date: 07/21/2019 15:08:02) Found malicious artifacts related to "220.181.15.192": ... File SHA256: fbbb6d48c47ee324d304fbd7518c32ae41d9b4b0d636ca29cd65bb7c7be99f89 (AV positives: 49/73 scanned on 08/01/2019 11:26:41) File SHA256: d9f9675063607cbf7e87b2196a2b5beb4f8caa868b043dc82c453097f6203aa1 (AV positives: 61/71 scanned on 08/01/2019 04:29:12) File SHA256: 1bc7a69a0d6ddf1f6e41c3e1c808c8d14e1c9e6be58b9b5891931f879c6811ca (AV positives: 56/72 scanned on 08/01/2019 04:31:41) File SHA256: 8c0f05cc99f7e96e2a2a37a1a95de95026c1b381846c422a36d378374eee9063 (AV positives: 54/69 scanned on 08/01/2019 01:10:57) File SHA256: cdd95e295770bf2136fcbee9e6bf066b95d68b29fc1a137222b3c923b1e82f8b (AV positives: 63/73 scanned on 08/01/2019 00:30:45) Found malicious artifacts related to "67.195.228.109": ... File SHA256: 10b9bf60c8e32f1f2dc914bc499b780a7847ea8e6a4a6af229261ed50ec1447f (AV positives: 55/73 scanned on 08/01/2019 22:37:48) File SHA256: 4e0b1d23fca0e69436d971342499c3689559662acba7771d85a49dacb74a3034 (AV positives: 31/72 scanned on 08/01/2019 18:39:09) File SHA256: 6079f7f3f290e49affe315de5c5dd2d121ecde5abd6ed8df34f0b7d336d94bd4 (AV positives: 44/69 scanned on 08/01/2019 18:49:26) File SHA256: a827e6520e1ef31afc3d6529ccb4f74e1bad703dba310ef187aa77a49a38fcb3 (AV positives: 55/71 scanned on 08/01/2019 21:57:09) File SHA256: 096a4d29c279e472356f70fc4719c511da593b29d36dd784e4d6fbca529c1d37 (AV positives: 55/71 scanned on 08/01/2019 14:16:10) File SHA256: f540b179580145cf7c288d4121217f38a636d96c7233481d02fcf35ba4c46529 (Date: 07/19/2019 04:16:03) File SHA256: 1c90da66d346abe6f9cc7644af0e13b39243f11c24f9c36d35b2739313c51a3c (Date: 07/16/2019 22:11:44) File SHA256: 0bb1ad2b3508465e66f4663738c6753749272ea4664eb82eaf147800c6ed345b (Date: 07/16/2019 04:50:31) File SHA256: 8f3d57f85f6492ce30bd65bd896b6011f4e4880b7dae1f127c93034a5139f288 (Date: 07/09/2019 09:55:56) File SHA256: f316ae7353df01a080aeb605e0fe9c0b11984aac5e66b8a26a078982c23f3d37 (Date: 07/08/2019 07:22:08) Found malicious artifacts related to "217.69.139.202": ... URL: http://ns1.ns2.ns1.ns2.ns4.www.madunixxx.ru/ (AV positives: 3/68 scanned on 07/16/2016 11:09:22) URL: https://mail.ru/ (AV positives: 1/66 scanned on 11/30/2015 23:34:07) URL: http://mail.ru/ (AV positives: 1/66 scanned on 11/30/2015 16:00:40) URL: https://mail.ru/all (AV positives: 1/66 scanned on 11/30/2015 03:15:18) File SHA256: 8c86345e4cb6d10ef7a53b21328d814154e96a64ad96c7aa81b5e59e016e1264 (AV positives: 53/72 scanned on 07/31/2019 16:08:54) File SHA256: 97b11e5b2087d48601e3e49faaf8cdd2330f8fcf64a2fd4e09877aea69fe665e (AV positives: 48/72 scanned on 07/31/2019 13:58:23) File SHA256: c307fabbf2982fd5a73975af1f6de2dd263dee64f915cf865aa96bc955d509a0 (AV positives: 53/70 scanned on 07/27/2019 19:27:18) File SHA256: 067702f81a3de2ecb8218f27528b9591c22542266ab3ccd28fe5a396758c54fc (AV positives: 49/71 scanned on 07/27/2019 09:41:37) File SHA256: 25ce9b08155c0d34332e8de34ad47f9eb5b697e462eb3847683bd5835770639b (AV positives: 66/71 scanned on 07/27/2019 08:28:44) File SHA256: 7c0fe551ac767cfd42dce08ed8eab7d123438ad2f9d3fa284a3f8d2a66838f2a (Date: 06/26/2019 05:36:18) File SHA256: 1851609796db841fdd350e13d9134bd36818efd53c145c86ac40a55e88844aed (Date: 06/25/2019 06:07:15) File SHA256: 6e4baf0421dac6cfa535877dc95a52db672821713716db08ab9f4df9ad7dc5f5 (Date: 03/18/2019 20:11:08) File SHA256: 2f5fc345bc051ace2e3e02f134e8ab65dc2ba4a596832d8ff15cac61c6855a91 (Date: 07/02/2017 20:19:51) File SHA256: cbb7ec5d4fa22cf3084c6e634dd7ba636ff2a67262359b544ebf15eb835055cf (Date: 07/02/2017 20:08:59) Found malicious artifacts related to "98.137.246.8": ... URL: http://www.adne.tv/ (AV positives: 1/66 scanned on 05/24/2019 08:39:13) URL: http://antesprerm.stream/ (AV positives: 2/67 scanned on 11/09/2018 07:07:26) URL: http://finance-advisors-ca.bid/ldr.bin (AV positives: 8/68 scanned on 11/09/2018 02:19:17) URL: http://passercour.stream/ (AV positives: 2/67 scanned on 11/08/2018 18:49:34) URL: http://ibleconcern.us/ (AV positives: 1/67 scanned on 11/08/2018 13:24:33) File SHA256: e7fbc749204aa36bf219d21a1481f886a3f5739907ab2f53dabfb5b1bbce27de (AV positives: 63/72 scanned on 08/01/2019 13:01:00) File SHA256: 5503058e0528be52c8d3c63422b6c19c76a270787aad8105c7e1e6f8211ce449 (AV positives: 64/74 scanned on 08/01/2019 22:37:18) File SHA256: a647de7afdaa565ef88643355e9517363e755399d25a75ff2733264a16220ef7 (AV positives: 64/74 scanned on 08/01/2019 14:56:25) File SHA256: f0bf01185a2c9c056e3129de6d36370628b69248eb6b91b4fa82df88fc2986b4 (AV positives: 56/66 scanned on 08/01/2019 12:58:40) File SHA256: cc575f93077abe7678c7117c70e673c7c55dabfad43199ca1784fcf7045881c1 (AV positives: 63/72 scanned on 08/01/2019 22:30:20) File SHA256: 537db99fbfc66eb24ab77ea72acd204283da757af5a5878dcb655b6f5511bac0 (Date: 08/01/2019 06:02:58) File SHA256: 43ac9facf677f4d2489eca0bd22b302f9c7a9d6f8525042997a6b150d797474b (Date: 08/01/2019 06:02:38) File SHA256: d2a5cd99c65874c467e89ecf08194795d72a3d27384b845ed22945495f7049fe (Date: 08/01/2019 05:56:03) File SHA256: e8cf21b913336f72e1773bb01f139ab06abe2b7427b858e07d6b49e64a4000d0 (Date: 08/01/2019 05:22:01) File SHA256: 6cea3e982bf5ba7f81e368cfcd9a6596c0d401bb828bbd9c4a8ec3674cffea4f (Date: 07/31/2019 10:29:27) Found malicious artifacts related to "220.181.15.134": ... File SHA256: d9f9675063607cbf7e87b2196a2b5beb4f8caa868b043dc82c453097f6203aa1 (AV positives: 61/71 scanned on 08/01/2019 04:29:12) File SHA256: 1bc7a69a0d6ddf1f6e41c3e1c808c8d14e1c9e6be58b9b5891931f879c6811ca (AV positives: 56/72 scanned on 08/01/2019 04:31:41) File SHA256: 8c0f05cc99f7e96e2a2a37a1a95de95026c1b381846c422a36d378374eee9063 (AV positives: 54/69 scanned on 08/01/2019 01:10:57) File SHA256: d0c660322194bf9c6a03f49dcfc4703b8a354e44b70d24bb1ca64c3f659dab5d (AV positives: 56/71 scanned on 08/01/2019 00:27:51) File SHA256: 520216521f2ee7210dfbdfefb36c42e9ae41991ec59de5ffaf0de81d6bcdc55b (AV positives: 57/72 scanned on 08/01/2019 00:25:51) Found malicious artifacts related to "217.69.139.87": ... URL: http://dlp2.mail.ru/output/5fn52fbeiovnioohi7omj2f2fii6uj50vxg4blr5oho0utpsa3d3d/00/ff/ab/8d/setup/install_flashplayer11x32_mssa_aih.exe (AV positives: 3/71 scanned on 07/30/2019 02:05:19) URL: http://dlt.mail.ru/output/torrent/00/ac/17/51/tfile_org_66190.exe (AV positives: 2/69 scanned on 03/08/2019 03:15:33) URL: http://dlt2.mail.ru/output/setup/00/00/00/aa/vlc-1_1_11-win32.exe (AV positives: 3/66 scanned on 11/19/2018 10:05:42) URL: http://dls1.mail.ru/output/fwsld0vquasefbowerkquq0kubgacyahehnagrytgiawg0i3d/01/83/af/7f/u/torrent/gta_vice_city.exe (AV positives: 2/67 scanned on 10/09/2018 09:25:49) URL: http://dls2.mail.ru/output/qv1dwrmgbl1iqkxar09gb1tcbk5mxxzrreuwt0bfthzatrq3d/01/01/5b/29/u/torrent/oblivion_trejler_2013_avi.exe (AV positives: 2/67 scanned on 10/09/2018 02:53:34) File SHA256: 25ce9b08155c0d34332e8de34ad47f9eb5b697e462eb3847683bd5835770639b (AV positives: 66/71 scanned on 07/27/2019 08:28:44) File SHA256: 564ffc566fe9328408fe8ce338a8200c7b36b180e26bcf4c8a6426c88b751ac2 (AV positives: 57/72 scanned on 07/26/2019 20:00:44) File SHA256: b8afc126f90741844ce2cec4d34c06471b3a836dad18758eef8111f7f8824be0 (AV positives: 57/70 scanned on 07/25/2019 09:37:58) File SHA256: bbe4a41f3cbf05aa69337161f9e1ee368e79fcf8f3f849e68528acadee224515 (AV positives: 58/70 scanned on 07/23/2019 12:13:41) File SHA256: 39419a543c2d88d63f5d23fc97cce8e1cd53af83a66d619ed9fda5d49facc082 (AV positives: 57/72 scanned on 07/20/2019 03:43:32) File SHA256: 02ed693ff524a90cf2feaef0dc233547fcf7e2ecf556a994dfeeb0647b896d49 (Date: 05/10/2016 16:46:20) Found malicious artifacts related to "123.126.96.210": ... URL: http://vip.163.com/ (AV positives: 1/71 scanned on 08/01/2019 09:03:40) URL: http://126.com/rtt/?4652211557 (AV positives: 1/71 scanned on 07/27/2019 01:51:49) URL: http://126.com/ (AV positives: 1/71 scanned on 07/26/2019 07:00:47) URL: http://188.com/ (AV positives: 1/70 scanned on 07/17/2019 02:39:59) URL: http://126.com/RollingNum2/Tetris/cocos2d/cocos/2d/CCActionCatmullRom.cpp (AV positives: 1/70 scanned on 07/04/2019 11:22:16) File SHA256: ace10395545f5e1e2bdd107b506fa4f7e45ed77b87033e6a12e7a18267934505 (AV positives: 56/73 scanned on 07/27/2019 13:20:47) File SHA256: d6e47161104832ffc0f55e743d1458e77bcabd7c048d3fa4250b16f19a25a4b0 (AV positives: 51/69 scanned on 07/27/2019 09:10:20) File SHA256: 033cd644c5ff8955fd102bf74b6d4c49a76fe7d3b82f152f59ff0b6f5224e920 (AV positives: 45/70 scanned on 07/27/2019 04:29:39) File SHA256: cd413c2ad74960cd00285f20e84eb60959a462dcceccaa3d2aaa97b8774cdcd9 (AV positives: 60/74 scanned on 07/27/2019 04:31:38) File SHA256: da2e54bd2941b42687818ca136cfa53c810a17c239a0366422e3c65e390b6127 (AV positives: 51/74 scanned on 07/26/2019 01:25:43) File SHA256: f9a30ecac32c1f3d95bea99b5f0205fd1fa677a531e2e89adb8001e494badacb (Date: 05/19/2019 01:58:02) File SHA256: d8d9277731b1e5cdde42d7b6c9a050c4a5c0d7919a28ca90648b432402d1978a (Date: 05/12/2019 01:17:41) File SHA256: e7bfe6dd04a3891af3f258f305017420fcd3f2b216580c526a58327fb1d595d4 (Date: 05/03/2019 19:58:49) File SHA256: 171af6e532298b86ff9134cc737973b3816c754baae4f8c7fb1366c03caaaea6 (Date: 05/03/2019 19:56:55) File SHA256: 0ee0769add2374090bcf80e99912c9e8141b25a48d007c4ee9f793a604169850 (Date: 05/03/2019 19:43:25) Found malicious artifacts related to "15.61.13.9": ... File SHA256: e01ad94dbfd169d63e8fed403e3f5df3b8bc054c576f2a06976cb0cb47578559 (AV positives: 63/73 scanned on 07/30/2019 03:18:37) File SHA256: 61846d4507d6585053470175fbc649ca466b75329d55999ee8a5050d499761ec (AV positives: 63/72 scanned on 06/23/2019 13:50:20) File SHA256: cd0dc031f2096dd4c002eb01e4b73b58e082e72b253dfe346b98f84d0e98278c (AV positives: 56/65 scanned on 04/24/2019 05:29:49) File SHA256: 60f54105c1c8f44f03f5a503518c6fa6b0141dacaa3467a52d79963dcbfe846b (AV positives: 60/68 scanned on 10/21/2018 10:57:42) File SHA256: 3af008fc05bb947afc94970845150204797258898ef27a89e007457e05c7547b (AV positives: 64/71 scanned on 12/04/2017 15:36:42) Found malicious artifacts related to "217.69.139.70": ... URL: http://www.my-mali.ru/ (AV positives: 1/67 scanned on 07/19/2018 08:07:24) URL: http://www.mail.ru/i17ss9cizypexk8rvzay/file.php|file=file.dll (AV positives: 2/67 scanned on 05/28/2018 13:39:10) URL: http://cgi3.xyz/ (AV positives: 1/64 scanned on 10/04/2017 17:33:42) URL: http://cgi2.xyz/ (AV positives: 4/65 scanned on 08/09/2017 01:40:05) URL: http://cgi5.xyz/ (AV positives: 1/64 scanned on 06/02/2017 21:26:23) File SHA256: 25ce9b08155c0d34332e8de34ad47f9eb5b697e462eb3847683bd5835770639b (AV positives: 66/71 scanned on 07/27/2019 08:28:44) File SHA256: d36f27462f56454f459be6e7a1ed46a31ae088750740dd41faeed82738da3627 (AV positives: 33/70 scanned on 07/25/2019 01:53:57) File SHA256: 9e4083258daeb3cab2761a14e3053ef3ba84e3559ad4f5a5f27baebda96b58dc (AV positives: 46/71 scanned on 07/24/2019 13:00:15) File SHA256: 9e83ce393c71e403121be254c4c80fc2e1ac80de39937db5921ced1673fcbbe9 (AV positives: 47/72 scanned on 07/24/2019 11:41:57) File SHA256: a1e7935aaf6a0d2a783ac2797ecd16c3bf06a19f668f3db02292a99f9541dfb2 (AV positives: 50/69 scanned on 07/23/2019 21:04:30) File SHA256: 1851609796db841fdd350e13d9134bd36818efd53c145c86ac40a55e88844aed (Date: 06/25/2019 06:07:15) File SHA256: d866d02fec1b0bb183fdfce412ca80d80aabbd71f123f3cd4882c971cecb8be3 (Date: 12/25/2018 07:37:59) File SHA256: 96f842a958271fa4dd8466f6c675a1a34733aa4092327f9401a2dcb4bf513f33 (Date: 12/08/2018 08:27:54) File SHA256: daf48b19d2d2ae2df26746264e6aed5097687026fad2f3fb2e4b956919bc428f (Date: 10/23/2018 14:48:19) File SHA256: c39cf21f7fae1850e9d45ea258e1e8a7a8ec4ad25c17d322448fb53e351b7daa (Date: 10/01/2018 09:17:49) Found malicious artifacts related to "212.227.15.17": ... File SHA256: 6079f7f3f290e49affe315de5c5dd2d121ecde5abd6ed8df34f0b7d336d94bd4 (AV positives: 44/69 scanned on 08/01/2019 18:49:26) File SHA256: 40df61d589d6b67d9826a9a3349dec31d838a89d7ae68d8d18857ef5440e2892 (AV positives: 52/72 scanned on 08/01/2019 21:47:45) File SHA256: 200bcfb078413451b5116f331c5c332c17e6f493305d83161131536c62d6c429 (AV positives: 56/73 scanned on 08/01/2019 15:26:20) File SHA256: e01e7dc7c9ea360801fa706ae308dd01600a00c6d30214c0922cae07d2b935e2 (AV positives: 53/73 scanned on 08/01/2019 15:20:40) File SHA256: 4f60e78e46d92659be40e40661da141600f0f33631aea0b98277c8c3aa135cf3 (AV positives: 50/71 scanned on 08/01/2019 14:42:50) File SHA256: b07009ad382b6b2aed83a3813d5c8e0c3c4b76d43e9b753a44e15e0e5aa3e81b (Date: 07/27/2019 09:23:11) File SHA256: 26e530ce9efb0c3b68283aa809987b5a020ae2aa4648d0887417251804483f46 (Date: 07/16/2019 22:50:43) File SHA256: a23da1bfbf735c7bfbf4b9dfbf0cb6bba74ca769c61f3fcae12900b743282b0a (Date: 04/25/2019 21:05:26) File SHA256: a989e4c0ac3806bd3f1029425956d65bf67ced7c449b5439844e5ee5463d89ea (Date: 04/25/2019 20:54:33) File SHA256: e089533d00195ddd6b4e95d5fb256a68b8c181b02511174aa377db95e4e1d4b6 (Date: 04/25/2019 20:23:25) Found malicious artifacts related to "104.47.37.36": ... File SHA256: 1e144e6710aa20fde9b79f0b0017004a1b9b954a48c7b6be778010aaac9cf2fc (AV positives: 48/73 scanned on 08/01/2019 18:28:34) File SHA256: 1a68a0c8f285b330dae205f3498a9b5ab546c8b314c43f17dcc2511e59fb8e0e (AV positives: 47/73 scanned on 08/01/2019 18:11:27) File SHA256: e01e7dc7c9ea360801fa706ae308dd01600a00c6d30214c0922cae07d2b935e2 (AV positives: 53/73 scanned on 08/01/2019 15:20:40) File SHA256: 6e9e0562b1113841c7c05eb464aeac1a49e8cfcc6fe9cf998fa98f77b849bf8c (AV positives: 54/72 scanned on 08/01/2019 15:17:19) File SHA256: 3e4bba0f47dd92a8621417c5a31b827ecbbbe8aca7d5a46ccbc2be18e6741708 (AV positives: 52/72 scanned on 08/01/2019 14:03:39) File SHA256: 4a817dd43ac303e5089e3d709a08c62df73bf31a71e7de7b88b6bb90e623a285 (Date: 06/06/2019 08:26:46) File SHA256: a3221261c632eeb44547a4e565dc29d29c2e160f9916de90dc2f919cafc9e538 (Date: 12/18/2018 19:15:32) File SHA256: 90e4bebd58bc3f8bf103d9f8fe748e9641c822cd02658ec3540cc5d1c719e49d (Date: 12/16/2018 09:55:37) File SHA256: 67a7d2fa7dc7b08ecff304425a90fd62a899c2b056093d2c0c455ad1339c623d (Date: 12/13/2018 00:50:59) File SHA256: 8c281e43abbd39b2db44255d3ea048e9db18eaa5a1fda8c97bb89be060fd28e7 (Date: 12/09/2018 08:42:48) Found malicious artifacts related to "212.227.17.8": ... File SHA256: c810f5a53890d2daa2b984d478c4edf823cd616cee3ea74a408df704974d8f83 (AV positives: 49/71 scanned on 08/01/2019 19:49:21) File SHA256: dc696e5800f28ebea09f2aaa8047e3c3d242a80cb9c479f7e89cd57a55705957 (AV positives: 45/70 scanned on 08/01/2019 18:54:19) File SHA256: c83f17ab926128832820a4344567ddc9b1bd58f9609d3a13ac15ca6b194893f9 (AV positives: 53/72 scanned on 08/01/2019 15:58:57) File SHA256: a46e39a2a5b4ea5a94bcd62b4b9bddd5330d62aa6b914f1e11841f042b91ddd1 (AV positives: 50/71 scanned on 08/01/2019 15:40:44) File SHA256: 6e9e0562b1113841c7c05eb464aeac1a49e8cfcc6fe9cf998fa98f77b849bf8c (AV positives: 54/72 scanned on 08/01/2019 15:17:19) File SHA256: 40b802248a15ca8b68893b735f5793883f6bc762b584d64843fa219727a13545 (Date: 05/28/2019 04:23:50) File SHA256: fc71f1cf7b4c489519833afe919b497e5c9106fa9f2060667fb931b158f41bbc (Date: 04/24/2019 19:17:08) File SHA256: 348b7e37b18dbdb350f14f518eac9e3e5fb998f23003b43ac1c8a3befa3155f1 (Date: 04/24/2019 18:20:46) File SHA256: 7515fe95fbdbe4969367c4aa851ff59a748705f09441648759069760de7d9ab1 (Date: 12/19/2018 18:05:25) File SHA256: 9c3797d8131a4c170ef364a99d73e5821128c9ee14a1bda085fa41fb8e6ecb41 (Date: 12/19/2018 13:03:28) Found malicious artifacts related to "108.166.161.243": ... File SHA256: 8c8e098b4d8739d1b9588e75c491a26f072af0442258b68da90f5bf0952c60dd (AV positives: 48/73 scanned on 07/21/2019 13:40:23) File SHA256: ca793c776f43c9cb25afdc8777cd8bd9c65791ca24221f1da5a8424676825213 (AV positives: 46/70 scanned on 07/19/2019 10:01:57) File SHA256: 966e1bbf82993029e498d86a65ac41673a5bf7146c774a0acd85f5dca5f3377c (AV positives: 25/70 scanned on 07/13/2019 10:20:44) File SHA256: 55685bc46fdb319decea5e81b218879d957d78d2d2d98113c53fa0d596b83f7a (AV positives: 21/71 scanned on 07/10/2019 10:20:36) Found malicious artifacts related to "209.41.68.240": ... File SHA256: 4e0b1d23fca0e69436d971342499c3689559662acba7771d85a49dacb74a3034 (AV positives: 31/72 scanned on 08/01/2019 18:39:09) File SHA256: ca793c776f43c9cb25afdc8777cd8bd9c65791ca24221f1da5a8424676825213 (AV positives: 46/70 scanned on 07/19/2019 10:01:57) File SHA256: 966e1bbf82993029e498d86a65ac41673a5bf7146c774a0acd85f5dca5f3377c (AV positives: 25/70 scanned on 07/13/2019 10:20:44) File SHA256: 55685bc46fdb319decea5e81b218879d957d78d2d2d98113c53fa0d596b83f7a (AV positives: 21/71 scanned on 07/10/2019 10:20:36) File SHA256: 5364bb6f3ba947181ecf05d00843df9cf93e2d11179d3db5e425f2fc8dfc3fd9 (AV positives: 36/67 scanned on 04/23/2019 09:36:37)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3cAAAf////////////////3AAAHj///////////////hwAAB/j/////////////+PcAAAf/j////////////4/3AAAH//j///////////j/9wAAB///j/////////+P//cAAAf///j////////4///3AAAH////j///////j///9wAAB///+IiIiIiIiIj///cAAAf//4j4+Pj4+Pj4j//3AAAH//iPj4+Pj4+Pj4j/9wAAB/+I+Pj4+Pj4+Pj4j/cAAAeIj4+Pj4+Pj4+Pj4iHAAAH+Pj4+Pj4+Pj4+Pj49wAAB/////////////////AAAAB///////////////8AAAAAB//////////////wAAAAAAB/////////////AAAAAAAAB///////////8AAAAAAAAAB//////////wAAAAAAAAAAB/////////AAAAAAAAAAAAB///////8AAAAAAAAAAAAAB//////wAAAAAAAAAAAAAAB3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////AAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAB+AAAA/wAAAf+AAAP/wAAH/+AAD//wAB//+AA///wAf//+AP/////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791524426974,"unified_at":"2026-10-09T05:40:26.974Z","metadata":{"hashes":{"sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","sha1":"c462a4502d6710ca976adae5d592279b9e7dbf4b","md5":"b8fb4efafb3d85b5d2dc91fc44288e17","sha512":"651c26ddbb56f06112078cc63f919107770b5fe746714dcfc615073b1841add12a96cb022c041189bc13503be938e528b7882d7817372ca1421cd855491515b8","ssdeep":"384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUBl4:SCIqdH/k1ZVcT194jp4Bu","ssdeep_chunks":["384:FZcpzCI","384:ZcpzCIq","384:cpzCIqd","384:pzCIqdG","384:zCIqdG3","384:CIqdG3A","384:IqdG3A3","384:qdG3A3W","384:dG3A3WU","384:G3A3WUk","384:3A3WUkx","384:A3WUkx3","384:3WUkx38","384:WUkx38G","384:Ukx38GZ","384:kx38GZD","384:x38GZDJ","384:38GZDJu","384:8GZDJuJ","384:GZDJuJb","384:ZDJuJbf","384:DJuJbf1","384:JuJbf1+","384:uJbf1+o","384:Jbf1+o4","384:bf1+o44","384:f1+o44u","384:1+o44u8","384:+o44u8g","384:o44u8gH","384:44u8gHz","384:4u8gHzU","384:u8gHzUB","384:8gHzUBl","384:gHzUBl4","768:FZcpzCI","768:ZcpzCIq","768:cpzCIqd","768:pzCIqdG","768:zCIqdG3","768:CIqdG3A","768:IqdG3A3","768:qdG3A3W","768:dG3A3WU","768:G3A3WUk","768:3A3WUkx","768:A3WUkx3","768:3WUkx38","768:WUkx38G","768:Ukx38GZ","768:kx38GZD","768:x38GZDJ","768:38GZDJu","768:8GZDJuJ","768:GZDJuJb","768:ZDJuJbf","768:DJuJbf1","768:JuJbf1+","768:uJbf1+o","768:Jbf1+o4","768:bf1+o44","768:f1+o44u","768:1+o44u8","768:+o44u8g","768:o44u8gH","768:44u8gHz","768:4u8gHzU","768:u8gHzUB","768:8gHzUBl","768:gHzUBl4","384:SCIqdH/","384:CIqdH/k","384:IqdH/k1","384:qdH/k1Z","384:dH/k1ZV","384:H/k1ZVc","384:/k1ZVcT","384:k1ZVcT1","384:1ZVcT19","384:ZVcT194","384:VcT194j","384:cT194jp","384:T194jp4","384:194jp4B","384:94jp4Bu"],"imphash":"5d02f6de12eb07fb22fe87e05e50d6a0"},"file_info":{"file_name":"message.pif.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":22020,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1564109706000,"last_seen":1657141981000,"last_multi_scan":1657141981000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nemucod","ransomware","dornoe"]},"stats":{"av":{"malicious_count":28,"suspicious_count":0,"total_engines":30},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":14,"suspicious_count":21,"malicious_count":9,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.tpmO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.worm.22020.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm[Email]/Win32.Mydoom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/BAS.Samca.zictf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.Q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Mydoom.CJDZ-5239","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.Q worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.Mydoom.L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"EmailWorm ( 0000439f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.Mydoom.l","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Mydoom-GBX!B8FB4EFAFB3D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Mydoom.cuyllc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/MyDoom-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W32.Mydoom.L@mm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Mydoom.34820","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"I-WORM.MyDoom.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Shiz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Mydoom.Win32.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm.Mydoom","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00054800-00002100-45887-111-00805247\n GetLocalTime@KERNEL32.DLL at 00054800-00002100-45887-104-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00054800-00002100-45887-104-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTime@KERNEL32.DLL directly followed by \"cmp word ptr [ebp-10h], 07C6h\" and \"jc 00805282h\" at 00054800-00002100-45887-111-00805247\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, 02h\" and \"jne 00802E06h\" at 00054800-00002100-45887-104-00802DB3","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-54-0080418A\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-84-0080357F\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-121-00803B75\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-123-00804349\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-125-0080399E\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-82-0080359E\n GetProcessHeap@KERNEL32.DLL at 00054800-00002100-45887-157-0080453B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"126.com\"\n \"126mx00.mxmail.netease.com\"\n \"126mx01.mxmail.netease.com\"\n \"126mx02.mxmail.netease.com\"\n \"126mx03.mxmail.netease.com\"\n \"246tnt.com\"\n \"Mellanox-com.mail.protection.outlook.com\"\n \"aer-mx-01.cisco.com\"\n \"alexa-global-in.qualcomm.com\"\n \"alexa-in-ams.qualcomm.com\"\n \"alexa-in-lv.qualcomm.com\"\n \"alexa-in-sd.qualcomm.com\"\n \"alexa-in-tai.qualcomm.com\"\n \"alinet.it\"\n \"alln-mx-01.cisco.com\"\n \"alum-mit-edu.mail.protection.outlook.com\"\n \"alum.mit.edu\"\n \"alumni-purdue-edu.mail.protection.outlook.com\"\n \"alumni.purdue.edu\"\n \"apple.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"4.18.43.3:1042\"\n \"94.100.180.31:25\"\n \"220.181.15.207:25\"\n \"98.137.159.27:25\"\n \"220.181.15.145:25\"\n \"98.137.159.25:25\"\n \"220.181.15.192:25\"\n \"67.195.228.109:25\"\n \"217.69.139.202:25\"\n \"98.137.246.8:25\"\n \"220.181.15.134:25\"\n \"217.69.139.87:25\"\n \"123.126.96.210:25\"\n \"15.61.13.9:1042\"\n \"217.69.139.70:25\"\n \"212.227.15.17:25\"\n \"104.47.37.36:25\"\n \"212.227.17.8:25\"\n \"108.166.161.243:25\"\n \"209.41.68.240:25\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\taaikmbhu.txt\"\n \".exe\" created file \"%TEMP%\\tmp6F83.tmp\"\n \".exe\" created file \"%TEMP%\\tmp6F83.tmp:Zone.Identifier\"\n \".exe\" created file \"%TEMP%\\tmp6FD2.tmp\"\n \".exe\" created file \"%TEMP%\\tmp6FD2.tmp:Zone.Identifier\"\n \".exe\" created file \"%TEMP%\\tmp6FF3.tmp\"\n \".exe\" created file \"%TEMP%\\tmp7061.tmp\"\n \".exe\" created file \"%TEMP%\\tmp73FC.tmp\"\n \".exe\" created file \"%TEMP%\\tmp73FC.tmp:Zone.Identifier\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"rctrl_renwnd32\"\n \".exe\" searching for class \"ATH_Note\"\n \".exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe:Zone.Identifier\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\tzres.dll\"\n \".exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"\n \"Harry Potter.com\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n UPX1 with unusual entropies 7.89790234125\n 7.89790234125","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.bin\" has a section named \"UPX0\"\n \"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.bin\" has a section named \"UPX1\"\n \"Harry Potter.com\" has a section named \"UPX0\"\n \"Harry Potter.com\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"http://126.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$27","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRAYBAR\"; Value: \"%WINDIR%\\lsass.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"baslug.org\" seems to be random\n \"baynetworks.com\" seems to be random\n \"mail.bc-bd.org\" seems to be random\n \"mail.gsu.edu\" seems to be random\n \"mail.ospf.msg\" seems to be random\n \"mail.promus.com\" seems to be random\n \"mx.126.com\" seems to be random\n \"mx.gsu.edu\" seems to be random\n \"mx.netyl.org\" seems to be random\n \"mx.ospf.msg\" seems to be random\n \"mx.promus.com\" seems to be random\n \"mx1.qq.com\" seems to be random\n \"mx2.qq.com\" seems to be random\n \"mx3.qq.com\" seems to be random\n \"mx76.mb1p.com\" seems to be random\n \"mxs.mail.ru\" seems to be random\n \"rcdn-mx-01.cisco.com\" seems to be random\n \"smtp.delmic.com\" seems to be random\n \"smtp.gsu.edu\" seems to be random\n \"smtp.mail.ru\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00054800-00002100-45887-211-00807D81","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Network Related","name":"Detected very many DNS queries for domains that cannot be resolved","description":"\"alinet.it\"\n \"alumni.purdue.edu\"\n \"apple.com\"\n \"ashi.footprints.net\"\n \"athonet.com\"\n \"baslerweb.com\"\n \"baslug.org\"\n \"baynetworks.com\"\n \"bguyton.com\"\n \"bryson.demon.co.uk\"\n \"cr0.net\"\n \"desy.de\"\n \"diorcet.fr\"\n \"emeerson.com\"\n \"ericsson.com\"\n \"eth.fcs\"\n \"iki.fi\"\n \"inbox.lv\"\n \"isl.rdc.toshiba.co.jp\"\n \"its-v.de\"\n \"mail.alinet.it\"\n \"mail.alum.mit.edu\"\n \"mail.alumni.purdue.edu\"\n \"mail.giga.or.at\"\n \"mail.mozilla.org.xpi\"\n \"mail.netyl.org\"\n \"mail.oracle.com\"\n \"mail.ospf.msg\"\n \"mail.primarydata.com\"\n \"mail.qca.qualcomm.com\"","origin":"Network Traffic","relevance":10,"id":"network-34","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" binds to port 1042","origin":"Network Traffic","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00054800-00002100-45887-83-008036E9\n recv@WS2_32.DLL at 00054800-00002100-45887-94-0080641A\n recv@WS2_32.DLL at 00054800-00002100-45887-136-0080783E\n recv@WS2_32.DLL at 00054800-00002100-45887-140-00807983","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%WINDIR%\\lsass.exe\" for deletion\n \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%TEMP%\\tmp6F83.tmp\" for deletion\n \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%TEMP%\\tmp6FF3.tmp\" for deletion\n \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%TEMP%\\tmp6FD2.tmp\" for deletion\n \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%TEMP%\\tmp7061.tmp\" for deletion\n \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe\" marked \"%TEMP%\\tmp73FC.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\lsass.exe\" with delete access\n \".exe\" opened \"%TEMP%\\tmp6F83.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp6FF3.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp6FD2.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp7061.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\tmp73FC.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.bin\" has an entrypoint in section \"UPX1\"\n \"Harry Potter.com\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.bin\" claims program is from Thu Jan 1 00:00:00 1970\n \"Harry Potter.com\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"$29","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/19 Antivirus vendors marked sample as malicious (84% detection rate)\n 64/67 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/19 Antivirus vendors marked sample as malicious (84% detection rate)\n 64/67 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$2a","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\" was dropped at \"%WINDIR%\\lsass.exe\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe:Zone.Identifier\"\n \".exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%WINDIR%\\lsass.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"Found a lot of single characters ('w','i','n','i','n','e','t','.','d','l','l') being pushed to stack and GetProcAddress@KERNEL32.DLL in the same context (relevant concatenated strings: 'wininet.dll') at: 00054800-00002100-45887-77-00803108","origin":"Hybrid Analysis Technology","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 601 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 252 domains and 252 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":32,"files_written_count":229,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":225,"dns_resolutions_count":324,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nemucod","ransomware","dornoe"],"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5d436a2e028838936e670360","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Mydoom","contacted_countries":["CAN","CHE","CHN","CZE","DEU","FIN","FRA","GBR","ITA","JPN","KOR","LVA","NLD","RUS","SWE","TWN","USA"],"submit_name":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe","analysis_start_time":"2019-08-01T22:37:42+00:00","indicators_count":{"informative":14,"suspicious":26,"malicious":15},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"5d3a6b840288389c501d1844","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Mydoom","contacted_countries":["CAN","CHN","DEU","GBR","HKG","RUS","USA"],"submit_name":"message.pif.exe","analysis_start_time":"2019-07-26T02:53:08+00:00","indicators_count":{"informative":14,"suspicious":27,"malicious":15},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"4.18.43.3","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"94.100.180.31","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"220.181.15.207","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"98.137.159.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"220.181.15.145","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"98.137.159.25","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"220.181.15.192","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"67.195.228.109","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.69.139.202","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"98.137.246.8","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"220.181.15.134","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.69.139.87","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"123.126.96.210","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"15.61.13.9","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.69.139.70","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.15.17","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.37.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.17.8","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"108.166.161.243","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.41.68.240","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"95.211.121.203","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"82.165.230.17","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"64.137.162.10","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.85.144.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.40.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"166.78.46.98","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"4.31.198.44","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"198.133.158.250","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.6.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"173.194.192.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"154.61.135.20","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.42.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"35.186.228.254","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"74.6.137.45","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"173.38.212.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"193.180.16.203","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.126.122.18","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"74.125.141.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"158.164.138.90","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"173.37.147.230","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"108.177.111.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"72.163.7.166","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"72.163.4.185","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"192.64.119.77","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"205.134.188.171","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"81.17.56.160","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.132.180.187","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.87.249.19","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.69.139.160","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.174.182.194","port":25,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.132.180.179","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"192.251.125.179","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.85.202.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"216.239.32.21","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.174.182.195","port":25,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"95.170.70.140","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.174.182.180","port":25,"protocol":"TCP","country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.165.67.108","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"77.75.78.42","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"131.96.2.42","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.4.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"138.209.22.117","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"24.114.2.199","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"193.180.17.167","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"210.130.202.91","port":25,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"72.163.14.8","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.70.178.217","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"198.211.120.117","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.70.178.1","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"58.251.110.111","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"167.187.200.23","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"92.243.1.129","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"203.205.219.57","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.8.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"203.205.219.58","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"130.211.33.45","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"111.161.64.48","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"52.96.18.178","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"54.225.234.14","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"99.84.41.112","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.41.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.33.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"45.79.91.51","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"144.76.82.137","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.10.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"67.195.228.111","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"67.195.228.106","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"144.76.82.148","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"172.217.4.51","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"24.20.179.228","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"129.46.98.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"103.229.16.67","port":25,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"199.106.107.15","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.136.9.76","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"199.106.109.198","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"173.37.207.42","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"87.98.132.45","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"144.76.82.156","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"192.251.125.165","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.17.5","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.15.9","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"82.165.229.87","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.70.178.3","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"64.101.32.55","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.16.98.57","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"203.254.224.12","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"211.45.27.231","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.132.183.28","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"66.187.233.71","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.132.183.105","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"104.47.5.36","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"94.23.64.17","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"195.140.195.198","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"16.100.81.99","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.16.98.61","port":25,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"62.209.229.40","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"151.237.227.25","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.72.192.67","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"194.152.32.73","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"152.96.80.46","port":25,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.15.41","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.175.50.25","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"217.160.0.52","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"151.237.227.22","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"85.25.47.226","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"194.152.32.72","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"209.85.202.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"194.152.32.40","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"131.169.56.69","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"212.227.17.168","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"5.2.73.210","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"80.156.24.166","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"5.2.73.211","port":25,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"80.156.24.162","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"203.254.224.9","port":25,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"213.186.33.19","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"62.138.237.244","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"131.169.56.83","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"64.15.186.164","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"89.31.1.170","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"15.7.212.124","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"91.121.175.85","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"89.31.1.178","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"17.151.62.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"205.139.110.242","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"131.169.56.82","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"207.211.30.102","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"141.146.126.73","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"156.151.31.84","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"162.244.87.111","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"31.15.10.119","port":25,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"88.217.195.190","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"141.146.126.76","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"156.151.31.91","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"156.151.31.90","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"207.244.88.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"141.146.126.80","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"156.151.31.92","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"141.146.126.74","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"156.151.31.89","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"141.146.126.75","port":25,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"137.254.120.50","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"192.254.190.168","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"131.169.180.47","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"194.152.32.10","port":25,"protocol":"TCP","country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"91.121.40.167","port":25,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"address":"16.115.197.156","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"67.195.228.94","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"94.100.180.104","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"220.181.15.151","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"66.218.85.139","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"66.218.85.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"72.30.35.9","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"220.181.15.197","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"94.100.180.87","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"220.181.15.135","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"103.129.252.34","port":25,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"123.126.96.3","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"15.237.16.240","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"98.136.103.24","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"68.231.13.53","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"69.147.88.7","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"158.183.75.11","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"216.145.54.171","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"15.80.97.64","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.151.62.67","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.151.62.66","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.171.2.72","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.171.2.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.171.2.60","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"17.142.160.59","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"216.200.145.235","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"74.201.226.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"131.111.8.147","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"52.73.243.182","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"173.228.157.41","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"207.69.189.230","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"67.219.247.58","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"146.148.85.20","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"207.69.189.231","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"207.69.189.232","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"173.228.157.40","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"207.69.189.229","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"209.86.122.183","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.51","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"173.228.157.39","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.55","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"95.216.24.32","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"173.228.157.42","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.50","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.40","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"15.253.27.90","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"64.147.108.30","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"173.228.157.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"82.195.75.114","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"199.89.3.120","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"128.232.25.20","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"209.87.16.33","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"5.153.231.4","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"209.249.171.103","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"104.17.80.191","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"4.16.57.71","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"15.244.196.172","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"address":"209.85.144.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"dns_resolutions":[{"domain":"126.com","address":"123.126.96.210","ttl":299,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"126mx00.mxmail.netease.com","address":"220.181.15.207","ttl":480,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"126mx01.mxmail.netease.com","address":"220.181.15.140","ttl":569,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"126mx02.mxmail.netease.com","address":"220.181.15.147","ttl":205,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"126mx03.mxmail.netease.com","address":"220.181.15.196","ttl":461,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"246tnt.com","address":"213.186.33.19","ttl":10799,"country":"France","registrar_name":"GANDI SAS","registrar_name_servers":"A.DNS.GANDI.NET","registrar_creation_date":"2001-03-18T12:06:20+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"Mellanox-com.mail.protection.outlook.com","address":"104.47.8.36","ttl":9,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1994-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aer-mx-01.cisco.com","address":"173.38.212.150","ttl":1045,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Cisco Technology Inc.","registrar_creation_date":"1987-05-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alexa-global-in.qualcomm.com","address":"199.106.107.15","ttl":2604,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Qualcomm Inc.","registrar_creation_date":"1988-07-07T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alexa-in-ams.qualcomm.com","address":"212.136.9.76","ttl":2918,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alexa-in-lv.qualcomm.com","address":"129.46.98.27","ttl":3544,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alexa-in-sd.qualcomm.com","address":"199.106.107.15","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alexa-in-tai.qualcomm.com","address":"103.229.16.67","ttl":3599,"country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alinet.it","ttl":21599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alln-mx-01.cisco.com","address":"173.37.147.230","ttl":1448,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alum-mit-edu.mail.protection.outlook.com","address":"104.47.37.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alum.mit.edu","address":"23.67.238.142","ttl":19,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alumni-purdue-edu.mail.protection.outlook.com","address":"104.47.40.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"apple.com","address":"17.178.96.59","ttl":3148,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"aserp2020.oracle.com","address":"141.146.126.73","ttl":10596,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aserp2030.oracle.com","address":"141.146.126.74","ttl":9884,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aserp2040.oracle.com","address":"141.146.126.75","ttl":10100,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aserp2050.oracle.com","address":"141.146.126.76","ttl":10102,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aserp2060.oracle.com","address":"141.146.126.80","ttl":10261,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ashi.footprints.net","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aspmx2.googlemail.com","address":"64.233.177.27","ttl":292,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"aspmx3.googlemail.com","address":"209.85.144.27","ttl":292,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"athonet-com.mail.protection.outlook.com","address":"104.47.4.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"athonet.com","address":"94.23.64.17","ttl":59,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"baslerweb.com","address":"62.138.237.244","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"baslug.org","address":"94.23.64.17","ttl":21599,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"baynetworks-com.mail.protection.outlook.com","address":"104.47.40.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"baynetworks.com","address":"35.186.228.254","ttl":3359,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"bguyton.com","address":"98.200.170.46","ttl":1798,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"broadcom.com","address":"64.15.186.164","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"cisco.com","address":"72.163.4.185","ttl":2803,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"cr0.net","address":"163.172.231.13","ttl":1799,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"delmic.com","address":"95.170.70.140","ttl":21599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"desy.de","address":"131.169.180.47","ttl":59,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"diorcet.fr","address":"198.211.120.117","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"emeerson.com","ttl":1488,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ericsson-com.mail.protection.outlook.com","address":"104.47.4.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ericsson.com","address":"193.180.16.203","ttl":59,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"eth.fcs","ttl":86398,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"fb.mail.gandi.net","address":"217.70.178.217","ttl":59,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"giga.or.at","address":"5.2.73.211","ttl":3599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"gimp.org","address":"209.132.180.179","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"gmx.net","address":"82.165.229.87","ttl":19338,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"gsu-edu.mail.eo.outlook.com","address":"104.47.40.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"gsu-edu.mail.protection.outlook.com","address":"104.47.42.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"gsu.edu","address":"166.78.46.98","ttl":2715,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ietf.org","address":"4.31.198.44","ttl":52,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"iki.fi","address":"195.140.195.198","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"inbox.lv","address":"194.152.32.40","ttl":21468,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"isl.rdc.toshiba.co.jp","address":"202.249.10.123","ttl":1259,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"its-v.de","ttl":21599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ixperta.com","address":"31.15.10.119","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"lists.tcpdump.org","address":"209.87.249.19","ttl":21599,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.246tnt.com","address":"91.121.40.167","ttl":10799,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.baslerweb.com","address":"80.156.24.162","ttl":2882,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.bc-bd.org","address":"88.217.195.190","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.cisco.com","address":"173.37.151.56","ttl":4,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.definitely.at","address":"5.2.73.210","ttl":3599,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.delmic.com","address":"216.58.193.147","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.diningphilosopher.de","address":"85.25.47.226","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.diorcet.fr","address":"198.211.120.117","ttl":21599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.ericsson.com","address":"193.180.17.167","ttl":21599,"country":"Sweden","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.gmx.net","address":"212.227.17.168","ttl":145,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.gsu.edu","address":"131.96.2.42","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.ietf.org","address":"4.31.198.44","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.iki.fi","address":"212.16.98.57","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.inbox.lv","address":"194.152.32.10","ttl":21594,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.mail.ru","address":"94.100.180.70","ttl":599,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.mellanox.com","address":"40.97.222.194","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.mozilla.org.xpi","ttl":86393,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.netyl.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.oracle.com","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.ospf.msg","ttl":86394,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.promus.com","address":"192.251.125.165","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.renfro.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.rogers.com","address":"24.114.2.199","ttl":18835,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.ru","address":"94.100.180.200","ttl":334,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.samba.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.samsung.com","address":"203.254.224.9","ttl":299,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.stackframe.org","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.strongswan.org","address":"152.96.80.46","ttl":21599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.web.de","address":"213.165.67.124","ttl":21223,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail.willglynn.com","address":"54.225.234.14","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail01.baslerweb.com","address":"80.156.24.166","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail1.ixperta.com","address":"62.209.229.40","ttl":599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail2.iki.fi","address":"212.16.98.61","ttl":3311,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail2.ixperta.com","address":"151.237.227.25","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail3.iki.fi","address":"195.140.195.198","ttl":3599,"country":"Finland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mail3.ixperta.com","address":"213.175.50.25","ttl":3599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mailin.samsung.com","address":"203.254.224.12","ttl":12,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mailprot.hilton.com","address":"192.251.125.179","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"maxx.shmoo.com","ttl":3599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mellanox.com","address":"130.211.33.45","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mgate-2.bguyton.com","address":"64.137.162.10","ttl":179,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mozilla.org.xpi","ttl":86396,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mta5.am0.yahoodns.net","address":"98.137.159.27","ttl":32,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mta6.am0.yahoodns.net","address":"98.137.159.24","ttl":21,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mta7.am0.yahoodns.net","address":"74.6.137.63","ttl":46,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx-ha02.web.de","address":"212.227.17.8","ttl":739,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx-ha03.web.de","address":"212.227.15.17","ttl":738,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx-rogers.mail.am0.yahoodns.net","address":"74.6.137.45","ttl":36,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.126.com","address":"123.126.96.210","ttl":17999,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.246tnt.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.acantho.net","address":"213.174.182.180","ttl":299,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.cisco.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.delmic.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.ericsson.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.gmx.net","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.gsu.edu","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.ietf.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.iki.fi","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.inbox.lv","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.mail.ru","address":"217.69.139.87","ttl":599,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.mellanox.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.mozilla.org.xpi","ttl":86379,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.netyl.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.oracle.com","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.ospf.msg","ttl":86378,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.promus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.renfro.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.rogers.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.samba.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.samsung.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.stackframe.org","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.strongswan.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.web.de","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx.willglynn.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx00.emig.gmx.net","address":"212.227.15.9","ttl":94,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx00.kundenserver.de","address":"212.227.15.41","ttl":4200,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx01.emig.gmx.net","address":"212.227.17.5","ttl":865,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx01.kundenserver.de","address":"217.72.192.67","ttl":1608,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1-lw-eu.apache.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx1-lw-us.apache.org","address":"207.244.88.150","ttl":1799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx1.acantho.net","address":"213.174.182.194","ttl":7199,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1.inbox.lv","address":"194.152.32.72","ttl":4387,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1.mtaroutes.com","address":"85.17.76.141","ttl":59,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1.qq.com","address":"58.251.110.111","ttl":3599,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1.redhat.com","address":"209.132.183.28","ttl":2936,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx1.seznam.cz","address":"77.75.78.42","ttl":223,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2-lw-eu.apache.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx2-lw-us.apache.org","ttl":528,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx2.acantho.net","address":"213.174.182.195","ttl":7199,"country":"Italy","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2.inbox.lv","address":"194.152.32.75","ttl":3433,"country":"Latvia","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2.mtaroutes.com","address":"138.201.61.104","ttl":11,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2.ovh.net","address":"87.98.132.45","ttl":17,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2.qq.com","address":"203.205.219.58","ttl":599,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx2.redhat.com","address":"66.187.233.71","ttl":3401,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx3.mtaroutes.com","address":"46.165.224.87","ttl":16,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx3.qq.com","address":"203.205.219.57","ttl":599,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx4.mtaroutes.com","address":"81.17.56.93","ttl":191,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mx76.mb1p.com","address":"198.133.158.249","ttl":408,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"mxs.mail.ru","address":"94.100.180.31","ttl":9,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mxt.securemx.jp","address":"210.130.202.85","ttl":599,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"netyl.org","address":"92.243.1.129","ttl":10799,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"newbridge.com","address":"199.59.242.151","ttl":10799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ns.aus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ns1.samba.org","address":"144.76.82.137","ttl":11059,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"nwk-aaemail-lapp03.apple.com","address":"17.151.62.68","ttl":5832,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"onlineconnections.com.au","address":"192.254.190.168","ttl":13145,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"open-mesh.com","address":"162.244.87.111","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"openoffice.org","address":"95.216.24.32","ttl":299,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"oracle.com","address":"137.254.120.50","ttl":15,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"ospf.msg","ttl":86395,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"owa.ixperta.com","address":"213.175.50.28","ttl":599,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"primarydata-com.mail.protection.outlook.com","address":"104.47.33.36","ttl":9,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"primarydata.com","address":"45.79.91.51","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"promus.com","address":"167.187.200.23","ttl":82,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"qca.qualcomm.com","address":"199.106.109.198","ttl":1799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"qq.com","address":"111.161.64.40","ttl":7199,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"rcdn-mx-01.cisco.com","address":"72.163.7.166","ttl":577,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"redhat.com","address":"209.132.183.105","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"renfro.org","address":"192.64.119.77","ttl":1799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"resources.jar","ttl":86395,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"rogers.com","address":"40.85.218.2","ttl":535,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"samba.org","address":"144.76.82.156","ttl":5566,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"samsung.com","address":"211.45.27.231","ttl":118,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"seznam.cz","address":"77.75.74.176","ttl":180,"country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"shmoo.com","address":"205.134.188.162","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp-intra-1.desy.de","address":"131.169.56.82","ttl":16467,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp-intra-2.desy.de","address":"131.169.56.83","ttl":13409,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp-intra-3.desy.de","address":"131.169.56.69","ttl":1499,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.alinet.it","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.alum.mit.edu","ttl":59,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.alumni.purdue.edu","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.cisco.com","address":"173.37.207.42","ttl":1799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.delmic.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.duncanthrax.net","address":"89.31.1.170","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.ericsson.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.giga.or.at","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.gnome.org","address":"209.132.180.187","ttl":80,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.gsu.edu","address":"131.96.2.42","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.ietf.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.iki.fi","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.mail.ru","address":"217.69.139.160","ttl":43,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.mellanox.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.mozilla.org.xpi","ttl":86393,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.netyl.org","ttl":10799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.oracle.com","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.ospf.msg","ttl":86391,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.primarydata.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.promus.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.qca.qualcomm.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.renfro.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.rogers.com","ttl":275,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.samba.org","address":"144.76.82.148","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.stackframe.org","address":"89.31.1.170","ttl":21599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.stoeckmann.org","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.web.de","address":"213.165.67.124","ttl":23,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"smtp.willglynn.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"sourcefrog.net","address":"216.239.38.21","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"spool.mail.gandi.net","address":"217.70.178.1","ttl":59,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"stackframe.org","address":"89.31.1.178","ttl":59,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"stoeckmann.org","address":"217.160.0.52","ttl":3599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"strongswan.org","address":"152.96.80.46","ttl":3599,"country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"toshiba.co.jp","address":"106.186.93.49","ttl":599,"country":"Japan","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"tycale.be","address":"91.121.175.85","ttl":21599,"country":"France","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"us-smtp-inbound-1.mimecast.com","address":"205.139.110.141","ttl":112,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"us-smtp-inbound-2.mimecast.com","address":"205.139.110.181","ttl":263,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"userp2020.oracle.com","address":"156.151.31.84","ttl":10532,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"userp2030.oracle.com","address":"156.151.31.89","ttl":10033,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"userp2040.oracle.com","address":"156.151.31.90","ttl":10327,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"userp2050.oracle.com","address":"156.151.31.91","ttl":10799,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"userp2060.oracle.com","address":"156.151.31.92","ttl":10629,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"web.de","address":"82.165.230.17","ttl":50,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"willglynn.com","address":"13.225.146.121","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"winpcap-org.p10.spamhero.com","address":"209.41.68.240","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"winpcap.org","address":"104.25.218.21","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"wireshark-org.p30.spamhero.net","address":"209.41.68.240","ttl":899,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"wireshark.org","address":"104.25.219.21","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"domain":"yahoo.com","address":"98.138.219.231","ttl":1726,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"acm.org","address":"104.17.80.191","ttl":299,"country":"United States","registrar_name":"Network Solutions, LLC","registrar_organization":"Association for Computing Machinery","registrar_name_servers":"A1.VERISIGNDNS.COM","registrar_creation_date":"1992-02-14T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"aladdin.com","address":"208.32.211.100","ttl":599,"country":"United States","registrar_name":"DomainTheNet.com","registrar_organization":"Aladdin Knowledge Systesm Ltd","registrar_name_servers":"NS-MUC.EALADDIN.COM","registrar_creation_date":"1989-03-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"cl.cam.ac.uk","ttl":1101,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"cluster1.us.messagelabs.com","address":"67.219.250.106","ttl":559,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"cluster1a.us.messagelabs.com","address":"34.225.212.74","ttl":5,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"debian.org","address":"128.31.0.62","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"ford-mason.co.uk","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"ismtp.sitestar.everyone.net","address":"216.200.145.235","ttl":103,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"ma1-aaemail-dr-lapp01.apple.com","address":"17.171.2.60","ttl":4034,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"ma1-aaemail-dr-lapp02.apple.com","address":"17.171.2.68","ttl":13204,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"ma1-aaemail-dr-lapp03.apple.com","address":"17.171.2.72","ttl":21257,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.126.com","address":"103.129.252.34","ttl":599,"country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.acm.org","ttl":1697,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.apple.com","ttl":1143,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.cl.cam.ac.uk","address":"128.232.25.20","ttl":599,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.debian.org","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.mailroute.net","address":"199.89.3.120","ttl":2673,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.openoffice.org","address":"40.79.78.1","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.pobox.com","address":"64.147.108.30","ttl":65,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.resources.jar","ttl":86383,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.src.dec.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.theriver.com","address":"209.249.171.103","ttl":203,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mail.yahoo.com","address":"69.147.88.7","ttl":242,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mailly.debian.org","address":"82.195.75.114","ttl":599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"muffat.debian.org","address":"209.87.16.33","ttl":171,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.acm.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.apple.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.cam.ac.uk","address":"131.111.8.146","ttl":1943,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.cl.cam.ac.uk","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.debian.org","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.openoffice.org","address":"40.79.78.1","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.pobox.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.resources.jar","ttl":86375,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.src.dec.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.theriver.com","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx.yahoo.com","address":"98.136.103.24","ttl":45,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx6.earthlink.net","address":"207.69.189.229","ttl":787,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx7.earthlink.net","address":"207.69.189.230","ttl":1754,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx8.earthlink.net","address":"207.69.189.231","ttl":1276,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"mx9.earthlink.net","address":"207.69.189.232","ttl":847,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"netcom.com","address":"209.86.122.183","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"northcoast.com","address":"146.148.85.20","ttl":4980,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"nwk-aaemail-lapp01.apple.com","address":"17.151.62.66","ttl":11159,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"nwk-aaemail-lapp02.apple.com","address":"17.151.62.67","ttl":20624,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx10.pobox.com","address":"64.147.108.51","ttl":639,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx11.pobox.com","address":"64.147.108.52","ttl":808,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx14.pobox.com","address":"64.147.108.55","ttl":69,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx20.pobox.com","address":"173.228.157.39","ttl":167,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx21.pobox.com","address":"173.228.157.40","ttl":191,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx22.pobox.com","address":"173.228.157.41","ttl":254,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx23.pobox.com","address":"173.228.157.42","ttl":535,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pb-mx9.pobox.com","address":"64.147.108.50","ttl":398,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"pobox.com","address":"64.147.108.40","ttl":182,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.126.com","address":"123.126.96.4","ttl":1799,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.acm.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.apple.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.cl.cam.ac.uk","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.debian.org","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.openoffice.org","address":"95.216.24.32","ttl":299,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.pobox.com","address":"173.228.157.53","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.resources.jar","ttl":86395,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.src.dec.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.theriver.com","address":"209.249.171.103","ttl":265,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"smtp.yahoo.com","address":"98.139.253.105","ttl":1144,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"src.dec.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"domain":"theriver.com","address":"74.201.226.52","ttl":162,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}],"processes":[{"pid":2100,"ppid":0,"name":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe","command_line":"","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","normalized_path":"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe","uid":"00054800-00002100","icon":"$2c"}],"all_imported_dlls":["nlaapi.dll","dnsapi.dll","winrnr.dll","advapi32.dll","usp10.dll","FWPUCLNT.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","shlwapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","webio.dll","ntdll.dll","rpcrt4.dll","lpk.dll","tzres.dll","wow64.dll","wow64win.dll","secur32.dll","shell32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dhcpcsvc6.dll","user32.dll","IPHLPAPI.DLL","winnsi.dll","rasadhlp.dll","version.dll","userenv.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wship6.dll","KernelBase.dll","gdi32.dll","wininet.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcr100.dll","dhcpcsvc.dll","wow64cpu.dll","kernel32.dll","msvcrt.dll","NapiNSP.dll","mswsock.dll","WSHTCPIP.DLL","api-ms-win-downlevel-normaliz-l1-1-0.dll","winhttp.dll","sspicli.dll","imm32.dll","pnrpnsp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","iertutil.dll","profapi.dll","ole32.dll","sechost.dll","cryptbase.dll","ws2_32.dll","nsi.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Winamp 5.0 _en_.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Winamp 5.0 _en_ Crack.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Winamp 5.0 _en_.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Winamp 5.0 _en_ Crack.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Winamp 5.0 _en_.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Winamp 5.0 _en_ Crack.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"WinRAR.v.3.2.and.key.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Kazaa Lite.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"ICQ 4 Lite.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"index.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"index.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Harry Potter.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Kazaa Lite.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"index.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"ICQ 4 Lite.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Kazaa Lite.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Harry Potter.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"WinRAR.v.3.2.and.key.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"WinRAR.v.3.2.and.key.ShareReactor.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"ICQ 4 Lite.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"Harry Potter.com","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"lsass.exe","sha256":"48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"taaikmbhu.txt","sha256":"e4b53fb64d6ca38a97ba60502c719abd1635fdbd48716d7fae16823b26dacad1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"tmp6F83.tmp","sha256":"0faf93571528399d37a8ba5c1557d72ddae0dcef30e23da88435e22c277767ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"name":"tmp6FD2.tmp","sha256":"0faf93571528399d37a8ba5c1557d72ddae0dcef30e23da88435e22c277767ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"name":"tmp6FF3.tmp","sha256":"6f2892d7c21523471d0971b7b396f08eccff136034fec25e2f62ad8e954ee7ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"name":"tmp7061.tmp","sha256":"9ba6ab7c064ae703157f3dd4b42448f86edbe5a20134dbb99eeb55b818c3731a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"name":"tmp2DED.tmp","sha256":"353f3b5c56e8b234287ba066f9edf892d1149f0d975f180baa0a38424907fe6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"tmp2E2D.tmp","sha256":"353f3b5c56e8b234287ba066f9edf892d1149f0d975f180baa0a38424907fe6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"tmp2E6C.tmp","sha256":"353f3b5c56e8b234287ba066f9edf892d1149f0d975f180baa0a38424907fe6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"tmp2EDB.tmp","sha256":"5ef503901acbc684ff40be495f5c1b9b4e8b400919c93aa362cd489b53d63e8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"name":"tmp2F1A.tmp","sha256":"596120addcd6ff8337930aa23df8401ee06494a3042e37e57fbb9f5738641038","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%WINDIR%\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"C:\\48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%WINDIR%\\lsass.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\taaikmbhu.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\tmp6F83.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\tmp6FD2.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%TEMP%\\tmp73FC.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\index.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\index.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\index.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\index.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\index.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\index.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\index.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\index.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\WinRAR.v.3.2.and.key.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\WinRAR.v.3.2.and.key.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\WinRAR.v.3.2.and.key.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\WinRAR.v.3.2.and.key.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"path":"C:\\message.pif.exe","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"C:\\message.pif.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\tmp2DED.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\tmp2E2D.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%TEMP%\\tmp2E6C.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5d436a2e028838936e670360"},{"report_type":"sandbox","report_id":"5d3a6b840288389c501d1844"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d436a2e028838936e670360","5d3a6b840288389c501d1844"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Worm.Mydoom Sample 48cf912217c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 48cf912217c1…. Malware family: Worm.Mydoom. Threat score 100/100. 28/30 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205"}],["$","meta","4",{"property":"og:title","content":"Malicious Worm.Mydoom Sample 48cf912217c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 48cf912217c1…. Malware family: Worm.Mydoom. Threat score 100/100. 28/30 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/48cf912217c1b5ef59063c7bdb93b54b9a91bb6920b63a461f8ac7fcff43e205"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Worm.Mydoom Sample 48cf912217c1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 48cf912217c1…. Malware family: Worm.Mydoom. Threat score 100/100. 28/30 AV engines flagged this file. 9 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]