24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T475,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Worm.Mydoom Sample 9e4c6410ab9e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9e4c6410ab9e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","keywords":["Malicious","Worm.Mydoom","malware analysis","sandbox report","threat intelligence","9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Worm.Mydoom","antivirusDetections":{"malicious":26,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T51e,"Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"26:T51e,"Harry Potter.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "index.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "ICQ 4 Lite.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_ Crack.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Kazaa Lite.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "WinRAR.v.3.2.and.key.ShareReactor.com" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Harry Potter.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed" "Winamp 5.0 _en_.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed"27:Ta5a,".exe" wrote bytes "b4361b75" to virtual address "0x751C025C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a1b75" to virtual address "0x751C01FC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "6012d673" to virtual address "0x7545E324" (part of module "WININET.DLL") ".exe" wrote bytes "b84013d673ffe0" to virtual address "0x751B3AD8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x751B4E38" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a0200" to virtual address "0x751B4D78" (part of module "SSPICLI.DLL") ".exe" wrote bytes "d83a1b75" to virtual address "0x751C0258" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4361b75" to virtual address "0x751C0278" (part of module "SSPICLI.DLL") ".exe" wrote bytes "0efc947781ed9377ae869277c6e09177effd94772d169377c0fc9077da8f9b7760149577478d9277a8e291776089927700000000ad3772768b2d7276b641727600000000" to virtual address "0x73C71000" (part of module "WINHTTP.DLL") ".exe" wrote bytes "71116b017a3b6a01ab8b02007f950200fc8c0200729602006cc805001ecd67017d266701" to virtual address "0x762C07E4" (part of module "USER32.DLL") ".exe" wrote bytes "d83a1b75" to virtual address "0x751C0274" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b8c015d673ffe0" to virtual address "0x751B36B4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x76721680" (part of module "WS2_32.DLL") ".exe" wrote bytes "b4360200" to virtual address "0x751B4D68" (part of module "SSPICLI.DLL") ".exe" wrote bytes "7d07957781ed9377ae869277c6e09177effd94772d16937760149577478d9277a8e291776089927700000000ad3772768b2d7276b641727600000000" to virtual address "0x73D71000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "b4361b75" to virtual address "0x751C01E4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012d673ffe0" to virtual address "0x76721368" (part of module "WS2_32.DLL") ".exe" wrote bytes "d83a1b75" to virtual address "0x751C01E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b4361b75" to virtual address "0x751C0200" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c0df91771cf99077ccf890770d64927700000000c0113f7700000000fc3e3f7700000000e0133f770000000094573a7725e09177c6e0917700000000bc6a397700000000cf313f770000000093193a77000000002c323f7700000000" to virtual address "0x755D1000" (part of module "NSI.DLL")28:T19fa,".exe" created file "C:\Windows\lsass.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\Kazaa Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\WinRAR.v.3.2.and.key.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\DW\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\WinRAR.v.3.2.and.key.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\EURO\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Filters\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\Help\Kazaa Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ICQ 4 Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\Winamp 5.0 (en).com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\Winamp 5.0 (en) Crack.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\Kazaa Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\Kazaa Lite.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\Kazaa Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\Kazaa Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\Harry Potter.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\Harry Potter.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\index.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\Winamp 5.0 (en) Crack.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\ICQ 4 Lite.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\Harry Potter.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\index.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\Winamp 5.0 (en) Crack.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\ICQ 4 Lite.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\Harry Potter.exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\Harry Potter.ShareReactor.com:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\Winamp 5.0 (en).exe:Zone.Identifier" ".exe" created file "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\Kazaa Lite.com:Zone.Identifier"29:Ta17,64/67 Antivirus vendors marked dropped file "Harry Potter.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Kazaa Lite.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "index.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "ICQ 4 Lite.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "ICQ 4 Lite.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Winamp 5.0 _en_ Crack.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Winamp 5.0 _en_.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Kazaa Lite.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Harry Potter.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Winamp 5.0 _en_.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "index.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "index.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Kazaa Lite.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "Winamp 5.0 _en_.ShareReactor.com" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "ICQ 4 Lite.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate) 64/67 Antivirus vendors marked dropped file "WinRAR.v.3.2.and.key.exe" as malicious (classified as "Worm.Mydoom" with 95% detection rate)2a:Tfdd,Found malicious artifacts related to "15.62.45.75": ... File SHA256: 970930bf93ba02a96711e0eaa53e93afc9f367a002217b9b998a9e80a70591dd (AV positives: 66/72 scanned on 07/29/2019 06:20:27) File SHA256: 0de6949502e5e5b30d6a6d1fe1bcabe0394574801939d4cce99db6b0833f9a05 (AV positives: 66/71 scanned on 07/20/2019 13:52:41) File SHA256: 8f7211e844b400832d31364a920eed698441a1cc0c25054c788f49d913699d0d (Date: 07/08/2019 09:22:03) File SHA256: d563cddd9709f2325eb32fb440b4c8e6ad088f37969b0f4b9935383398ab06fc (AV positives: 66/71 scanned on 01/20/2019 19:48:44) Found malicious artifacts related to "16.150.46.42": ... File SHA256: b3751e7143d75d613ffc737c15a3c239a5f34025e35577b129c1795b39e8c6fb (AV positives: 63/71 scanned on 07/04/2019 07:31:21) File SHA256: ce18b52b02dc7eb62b4f5402d650a17cc4dce6b44802480eae8109eb501947e1 (AV positives: 61/66 scanned on 03/22/2019 02:54:46) File SHA256: 12b1cb512bf3a50ba383ba57f7da5ad3c35609022c339c391123811709c357ca (Date: 11/03/2015 19:11:05) Found malicious artifacts related to "148.127.76.67": ... File SHA256: 9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8 (AV positives: 62/68 scanned on 07/15/2019 18:45:50) File SHA256: 897c6cd5973446e75397e00a89b021111456b78605b72655029eae0c69ca5f90 (AV positives: 65/73 scanned on 06/29/2019 12:51:31) File SHA256: c17b06cd4f1a89e0d3058bfb264d0d042968398d753f40c66bb2127de418f7ab (Date: 06/24/2019 04:35:47) File SHA256: ac16b929586b4daff6544fcb4ff4ef9ec9ad6fdb09ec43f7c2522c8f28fd4d94 (AV positives: 65/74 scanned on 05/21/2019 03:33:20) File SHA256: 4458aadf122ca4a34bce3c212fc1e2c5d254a83b40ec02dc606763481e8ec883 (AV positives: 62/68 scanned on 04/24/2019 01:45:03) File SHA256: 46c5f34715292704dcb387f13900d49ae085a2d7d06300d4448e1962f18e95e3 (Date: 05/30/2016 20:30:17) Found malicious artifacts related to "167.198.220.219": ... File SHA256: 5ffcd29d4fd720000c1fd1f778d1bb9541993dd90fe7add77bad9cff34bc4da5 (AV positives: 66/72 scanned on 07/26/2019 05:23:31) File SHA256: a6a3bf4fbdd041b631550f29de61241449e7687827ced1c763e7ebfc573671a4 (AV positives: 59/71 scanned on 06/23/2019 03:30:33) File SHA256: 5ed9e808d7a7c8f0d676cce6049a95e7bdeef092cc8709c1cdac371d48079b2a (AV positives: 67/73 scanned on 06/08/2019 18:25:12) File SHA256: f1fc082439131a637db84cb8a1ae1872eabacb1c2b21c58c0c49c1b7784a673d (AV positives: 67/73 scanned on 04/20/2019 01:42:37) File SHA256: 4514a5e5a68c519f9e75006c7ad2d78932c794b340dedc20efaad2264b08dcbc (AV positives: 63/70 scanned on 12/24/2018 00:35:04) Found malicious artifacts related to "148.127.71.47": ... File SHA256: ce50cadd2a8459f5634710df1f13459868ccc544403f2481a5ec410d19c54b17 (AV positives: 67/71 scanned on 07/22/2019 03:53:14) File SHA256: ceb987cfc5f573b9f1cd8c64492e3f419d400100de5e6239dde42706dc638f9f (AV positives: 64/70 scanned on 07/17/2019 07:47:17) File SHA256: d88dd448687ad583e234a4c42b8ab3f6fdd35793bd979ac661f1e9686b31eef9 (AV positives: 63/70 scanned on 07/15/2019 21:10:41) File SHA256: 7afca98843d072b80980fbb0ccc23c3b74908f745ecec0854189ef74c1e98062 (AV positives: 66/71 scanned on 07/15/2019 13:29:45) File SHA256: 8840209e5e1aa11a549cb0a3da6bdf9f0730228b4a3558de4b3bcf0b77d77fb0 (AV positives: 64/70 scanned on 07/11/2019 01:57:48) Found malicious artifacts related to "167.193.150.98": ... File SHA256: 2e2b82729d067809f26b029ecca79d25b3995924cfa7752dcd3088b5cb3ab80f (AV positives: 60/72 scanned on 07/05/2019 13:21:02) File SHA256: 19f4d851c4b48b147b1808272c9c2f91f6a39242ff82c7911456a7482dde3a97 (AV positives: 59/66 scanned on 04/21/2019 04:59:20) File SHA256: 899f7b999089249d95330bbb7b46985ef307c53273b413c7b8811d280be0fd1c (AV positives: 59/66 scanned on 04/01/2019 23:21:07) File SHA256: 189cff957a74a776cf4d16c9f988a0d6b30998eecf802fb6ff3ad023589ce303 (AV positives: 65/71 scanned on 01/13/2019 01:47:45) File SHA256: a4a4eecf59e81cfa181e492e199b0e712085dca27a237b67393d3d6e7dd2dfca (AV positives: 55/69 scanned on 11/01/2018 05:41:41) File SHA256: 9fcac9a539947918541f91cc6cc050dddc95e5bf6c3b2904afd77a7f1a06616b (Date: 11/03/2015 19:11:12)2b:Tfdd,Found malicious artifacts related to "15.62.45.75": ... File SHA256: 970930bf93ba02a96711e0eaa53e93afc9f367a002217b9b998a9e80a70591dd (AV positives: 66/72 scanned on 07/29/2019 06:20:27) File SHA256: 0de6949502e5e5b30d6a6d1fe1bcabe0394574801939d4cce99db6b0833f9a05 (AV positives: 66/71 scanned on 07/20/2019 13:52:41) File SHA256: 8f7211e844b400832d31364a920eed698441a1cc0c25054c788f49d913699d0d (Date: 07/08/2019 09:22:03) File SHA256: d563cddd9709f2325eb32fb440b4c8e6ad088f37969b0f4b9935383398ab06fc (AV positives: 66/71 scanned on 01/20/2019 19:48:44) Found malicious artifacts related to "16.150.46.42": ... File SHA256: b3751e7143d75d613ffc737c15a3c239a5f34025e35577b129c1795b39e8c6fb (AV positives: 63/71 scanned on 07/04/2019 07:31:21) File SHA256: ce18b52b02dc7eb62b4f5402d650a17cc4dce6b44802480eae8109eb501947e1 (AV positives: 61/66 scanned on 03/22/2019 02:54:46) File SHA256: 12b1cb512bf3a50ba383ba57f7da5ad3c35609022c339c391123811709c357ca (Date: 11/03/2015 19:11:05) Found malicious artifacts related to "148.127.76.67": ... File SHA256: 9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8 (AV positives: 62/68 scanned on 07/15/2019 18:45:50) File SHA256: 897c6cd5973446e75397e00a89b021111456b78605b72655029eae0c69ca5f90 (AV positives: 65/73 scanned on 06/29/2019 12:51:31) File SHA256: c17b06cd4f1a89e0d3058bfb264d0d042968398d753f40c66bb2127de418f7ab (Date: 06/24/2019 04:35:47) File SHA256: ac16b929586b4daff6544fcb4ff4ef9ec9ad6fdb09ec43f7c2522c8f28fd4d94 (AV positives: 65/74 scanned on 05/21/2019 03:33:20) File SHA256: 4458aadf122ca4a34bce3c212fc1e2c5d254a83b40ec02dc606763481e8ec883 (AV positives: 62/68 scanned on 04/24/2019 01:45:03) File SHA256: 46c5f34715292704dcb387f13900d49ae085a2d7d06300d4448e1962f18e95e3 (Date: 05/30/2016 20:30:17) Found malicious artifacts related to "167.198.220.219": ... File SHA256: 5ffcd29d4fd720000c1fd1f778d1bb9541993dd90fe7add77bad9cff34bc4da5 (AV positives: 66/72 scanned on 07/26/2019 05:23:31) File SHA256: a6a3bf4fbdd041b631550f29de61241449e7687827ced1c763e7ebfc573671a4 (AV positives: 59/71 scanned on 06/23/2019 03:30:33) File SHA256: 5ed9e808d7a7c8f0d676cce6049a95e7bdeef092cc8709c1cdac371d48079b2a (AV positives: 67/73 scanned on 06/08/2019 18:25:12) File SHA256: f1fc082439131a637db84cb8a1ae1872eabacb1c2b21c58c0c49c1b7784a673d (AV positives: 67/73 scanned on 04/20/2019 01:42:37) File SHA256: 4514a5e5a68c519f9e75006c7ad2d78932c794b340dedc20efaad2264b08dcbc (AV positives: 63/70 scanned on 12/24/2018 00:35:04) Found malicious artifacts related to "148.127.71.47": ... File SHA256: ce50cadd2a8459f5634710df1f13459868ccc544403f2481a5ec410d19c54b17 (AV positives: 67/71 scanned on 07/22/2019 03:53:14) File SHA256: ceb987cfc5f573b9f1cd8c64492e3f419d400100de5e6239dde42706dc638f9f (AV positives: 64/70 scanned on 07/17/2019 07:47:17) File SHA256: d88dd448687ad583e234a4c42b8ab3f6fdd35793bd979ac661f1e9686b31eef9 (AV positives: 63/70 scanned on 07/15/2019 21:10:41) File SHA256: 7afca98843d072b80980fbb0ccc23c3b74908f745ecec0854189ef74c1e98062 (AV positives: 66/71 scanned on 07/15/2019 13:29:45) File SHA256: 8840209e5e1aa11a549cb0a3da6bdf9f0730228b4a3558de4b3bcf0b77d77fb0 (AV positives: 64/70 scanned on 07/11/2019 01:57:48) Found malicious artifacts related to "167.193.150.98": ... File SHA256: 2e2b82729d067809f26b029ecca79d25b3995924cfa7752dcd3088b5cb3ab80f (AV positives: 60/72 scanned on 07/05/2019 13:21:02) File SHA256: 19f4d851c4b48b147b1808272c9c2f91f6a39242ff82c7911456a7482dde3a97 (AV positives: 59/66 scanned on 04/21/2019 04:59:20) File SHA256: 899f7b999089249d95330bbb7b46985ef307c53273b413c7b8811d280be0fd1c (AV positives: 59/66 scanned on 04/01/2019 23:21:07) File SHA256: 189cff957a74a776cf4d16c9f988a0d6b30998eecf802fb6ff3ad023589ce303 (AV positives: 65/71 scanned on 01/13/2019 01:47:45) File SHA256: a4a4eecf59e81cfa181e492e199b0e712085dca27a237b67393d3d6e7dd2dfca (AV positives: 55/69 scanned on 11/01/2018 05:41:41) File SHA256: 9fcac9a539947918541f91cc6cc050dddc95e5bf6c3b2904afd77a7f1a06616b (Date: 11/03/2015 19:11:12)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3cAAAf////////////////3AAAHj///////////////hwAAB/j/////////////+PcAAAf/j////////////4/3AAAH//j///////////j/9wAAB///j/////////+P//cAAAf///j////////4///3AAAH////j///////j///9wAAB///+IiIiIiIiIj///cAAAf//4j4+Pj4+Pj4j//3AAAH//iPj4+Pj4+Pj4j/9wAAB/+I+Pj4+Pj4+Pj4j/cAAAeIj4+Pj4+Pj4+Pj4iHAAAH+Pj4+Pj4+Pj4+Pj49wAAB/////////////////AAAAB///////////////8AAAAAB//////////////wAAAAAAB/////////////AAAAAAAAB///////////8AAAAAAAAAB//////////wAAAAAAAAAAB/////////AAAAAAAAAAAAB///////8AAAAAAAAAAAAAB//////wAAAAAAAAAAAAAAB3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD////////////////AAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAB+AAAA/wAAAf+AAAP/wAAH/+AAD//wAB//+AA///wAf//+AP/////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791025305782,"unified_at":"2026-10-03T11:01:45.782Z","metadata":{"hashes":{"sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","sha1":"5ea87cf24d1aec3f44639bfc4be4d055db01ad43","md5":"60c820b81bf2c35dd847969f28b2edbc","sha512":"0e5152d2e45429eaab596f66ce8a93c389cdbbdb912e9354439d9a0343bf9f50796ead26b9465466692f578c32c867ce29c0a2a4cb503e474bba4e5f33c15d4a","ssdeep":"384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUHBU:SCIqdH/k1ZVcT194jp4W","ssdeep_chunks":["384:FZcpzCI","384:ZcpzCIq","384:cpzCIqd","384:pzCIqdG","384:zCIqdG3","384:CIqdG3A","384:IqdG3A3","384:qdG3A3W","384:dG3A3WU","384:G3A3WUk","384:3A3WUkx","384:A3WUkx3","384:3WUkx38","384:WUkx38G","384:Ukx38GZ","384:kx38GZD","384:x38GZDJ","384:38GZDJu","384:8GZDJuJ","384:GZDJuJb","384:ZDJuJbf","384:DJuJbf1","384:JuJbf1+","384:uJbf1+o","384:Jbf1+o4","384:bf1+o44","384:f1+o44u","384:1+o44u8","384:+o44u8g","384:o44u8gH","384:44u8gHz","384:4u8gHzU","384:u8gHzUH","384:8gHzUHB","384:gHzUHBU","768:FZcpzCI","768:ZcpzCIq","768:cpzCIqd","768:pzCIqdG","768:zCIqdG3","768:CIqdG3A","768:IqdG3A3","768:qdG3A3W","768:dG3A3WU","768:G3A3WUk","768:3A3WUkx","768:A3WUkx3","768:3WUkx38","768:WUkx38G","768:Ukx38GZ","768:kx38GZD","768:x38GZDJ","768:38GZDJu","768:8GZDJuJ","768:GZDJuJb","768:ZDJuJbf","768:DJuJbf1","768:JuJbf1+","768:uJbf1+o","768:Jbf1+o4","768:bf1+o44","768:f1+o44u","768:1+o44u8","768:+o44u8g","768:o44u8gH","768:44u8gHz","768:4u8gHzU","768:u8gHzUH","768:8gHzUHB","768:gHzUHBU","384:SCIqdH/","384:CIqdH/k","384:IqdH/k1","384:qdH/k1Z","384:dH/k1ZV","384:H/k1ZVc","384:/k1ZVcT","384:k1ZVcT1","384:1ZVcT19","384:ZVcT194","384:VcT194j","384:cT194jp","384:T194jp4","384:194jp4W"],"imphash":"5d02f6de12eb07fb22fe87e05e50d6a0"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":22020,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1564667364000,"last_seen":1631086628000,"last_multi_scan":1631086628000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":16,"suspicious_count":23,"malicious_count":11,"total":50},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.tpmO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.worm.22020.H","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm[Email]/Win32.Mydoom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/BAS.Samca.zictf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Mydoom.Q","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Mydoom.CJDZ-5239","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Worm.MyDoom.NF (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Mydoom.Q worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.Mydoom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"EmailWorm ( 0000439f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Email-Worm.Win32.Mydoom.l","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXLN-WS!60C820B81BF2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Mydoom.cuyllc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Worm.Mydoom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/MyDoom-N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"W32.Mydoom.L@mm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Mydoom.34820","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"WORM_MYDOOM.GEN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"I-WORM.MyDoom.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Shiz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Worm.Mydoom","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Launches the WMI Provider Host"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Command and Control","technique":"Uncommonly Used Port","attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","identifiers":[{"type":"suspicious","value":"Detected increased number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00010462-00003136-43359-110-00805247\n GetLocalTime@KERNEL32.DLL at 00010462-00003136-43359-103-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00010462-00003136-43359-103-00802DB3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetSystemTime@KERNEL32.DLL directly followed by \"cmp word ptr [ebp-10h], 07C6h\" and \"jc 00805282h\" at 00010462-00003136-43359-110-00805247\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, 02h\" and \"jne 00802E06h\" at 00010462-00003136-43359-103-00802DB3","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-83-0080357F\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-53-0080418A\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-120-00803B75\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-122-00804349\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-124-0080399E\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-155-0080453B\n GetProcessHeap@KERNEL32.DLL at 00010462-00003136-43359-81-0080359E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"15.62.45.75:1042\"\n \"16.150.46.42:1042\"\n \"148.127.76.67:1042\"\n \"167.198.220.219:1042\"\n \"148.127.71.47:1042\"\n \"167.193.150.98:1042\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\taaikmbhu.txt\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\".exe\" searching for class \"rctrl_renwnd32\"\n \".exe\" searching for class \"ATH_Note\"\n \".exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WmiPrvSE.exe\" (UID: 00010463-00002988)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"WmiPrvSE.exe\" (UID: 00010463-00002988)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe\"\n \".exe\" touched file \"%WINDIR%\\lsass.exe:Zone.Identifier\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"yahoo.com\"\n Heuristic match: \"cisco.com\"\n Heuristic match: \"ShareReactor.com\"\n Heuristic match: \"sf.net\"\n Heuristic match: \"ks.com\"\n Heuristic match: \"gmail.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"\n \"Harry Potter.com\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Launches the WMI Provider Host","description":"Found process \"WmiPrvSE.exe\" (UID: 00010463-00002988)","origin":"Monitored Target","mitre_attack_id":"T1047","relevance":10,"id":"target-34","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1\n UPX1 with unusual entropies 7.89790234125\n 7.89790234125","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.bin\" has a section named \"UPX0\"\n \"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.bin\" has a section named \"UPX1\"\n \"Harry Potter.com\" has a section named \"UPX0\"\n \"Harry Potter.com\" has a section named \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"00130000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$26","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"TRAYBAR\"; Value: \"%WINDIR%\\lsass.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00010462-00003136-43359-208-00807D81","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"Process \"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe\" binds to port 1042","origin":"Network Traffic","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"recv@WS2_32.DLL at 00010462-00003136-43359-82-008036E9\n recv@WS2_32.DLL at 00010462-00003136-43359-93-0080641A\n recv@WS2_32.DLL at 00010462-00003136-43359-135-0080783E\n recv@WS2_32.DLL at 00010462-00003136-43359-139-00807983","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe\" marked \"%WINDIR%\\lsass.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%WINDIR%\\lsass.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.bin\" has an entrypoint in section \"UPX1\"\n \"Harry Potter.com\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.bin\" claims program is from Thu Jan 1 00:00:00 1970\n \"Harry Potter.com\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"$28","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"64/67 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"64/67 Antivirus vendors marked sample as malicious (95% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"$29","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 for MS Windows UPX compressed\" was dropped at \"%WINDIR%\\lsass.exe\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 15.62.45.75 on port 1042\n TCP traffic to 16.150.46.42 on port 1042\n TCP traffic to 148.127.76.67 on port 1042\n TCP traffic to 167.198.220.219 on port 1042\n TCP traffic to 148.127.71.47 on port 1042\n TCP traffic to 167.193.150.98 on port 1042","origin":"Network Traffic","mitre_attack_id":"T1065","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%WINDIR%\\lsass.exe\"","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"Found a lot of single characters ('w','i','n','i','n','e','t','.','d','l','l') being pushed to stack and GetProcAddress@KERNEL32.DLL in the same context (relevant concatenated strings: 'wininet.dll') at: 00010462-00003136-43359-76-00803108","origin":"Hybrid Analysis Technology","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"126.com\"\n \"126mx00.mxmail.netease.com\"\n \"126mx01.mxmail.netease.com\"\n \"126mx02.mxmail.netease.com\"\n \"126mx03.mxmail.netease.com\"\n \"acm.org\"\n \"aladdin.com\"\n \"apple.com\"\n \"bryson.demon.co.uk\"\n \"cl.cam.ac.uk\"\n \"cluster1.us.messagelabs.com\"\n \"cluster1a.us.messagelabs.com\"\n \"debian.org\"\n \"ford-mason.co.uk\"\n \"ismtp.sitestar.everyone.net\"\n \"ma1-aaemail-dr-lapp01.apple.com\"\n \"ma1-aaemail-dr-lapp02.apple.com\"\n \"ma1-aaemail-dr-lapp03.apple.com\"\n \"mail.126.com\"\n \"mail.apple.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"http://126.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"mx.126.com\" seems to be random\n \"mx.debian.org\" seems to be random\n \"mxs.mail.ru\" seems to be random\n \"smtp.debian.org\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.240.213/32, ...\"","origin":"Network Traffic","mitre_attack_id":"T1046","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"suspicious","category":"Network Related","name":"Detected very many DNS queries for domains that cannot be resolved","description":"\"126.com\"\n \"aladdin.com\"\n \"bryson.demon.co.uk\"\n \"cl.cam.ac.uk\"\n \"debian.org\"\n \"ford-mason.co.uk\"\n \"mail.apple.com\"\n \"mail.debian.org\"\n \"mail.northcoast.com\"\n \"mail.ru\"\n \"mx.apple.com\"\n \"mx.cl.cam.ac.uk\"\n \"mx.debian.org\"\n \"mx.northcoast.com\"\n \"mx1-lw-eu.apache.org\"\n \"mx2-lw-eu.apache.org\"\n \"mx2-lw-us.apache.org\"\n \"netcom.com\"\n \"northcoast.com\"\n \"openoffice.org\"\n \"smtp.apple.com\"\n \"smtp.cl.cam.ac.uk\"\n \"smtp.debian.org\"\n \"smtp.northcoast.com\"\n \"src.dec.com\"\n \"theriver.com\"","origin":"Network Traffic","relevance":10,"id":"network-34","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe:Zone.Identifier\"\n \".exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Reads terminal service related keys (often RDP related)"},{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 71 domains and 71 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":56,"dropped_files_count":0,"extracted_files_count":27,"files_written_count":222,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":61,"dns_resolutions_count":71,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5d42ec09038838a4914d93b7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Mydoom","contacted_countries":["CAN","CHN","DEU","GBR","HKG","NLD","RUS","USA"],"submit_name":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe","analysis_start_time":"2019-08-01T13:39:18+00:00","indicators_count":{"informative":16,"suspicious":28,"malicious":15},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"5d42ec0502883868746704be","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Mydoom","contacted_countries":["USA"],"submit_name":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe","analysis_start_time":"2019-08-01T13:39:21+00:00","indicators_count":{"informative":15,"suspicious":24,"malicious":11},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"15.62.45.75","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"16.150.46.42","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"148.127.76.67","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"167.198.220.219","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"148.127.71.47","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"167.193.150.98","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"address":"15.246.18.4","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"220.181.15.191","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"94.100.180.104","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"98.137.159.27","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"66.218.85.139","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"98.137.159.26","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"220.181.15.209","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"72.30.35.9","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"94.100.180.200","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"220.181.15.147","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"217.69.139.87","port":25,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"220.181.15.142","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"123.126.96.210","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"103.129.252.34","port":25,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"123.126.96.5","port":25,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"15.23.139.10","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"65.132.111.149","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.151.62.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.151.62.67","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.151.62.66","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.171.2.72","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.171.2.68","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.171.2.60","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"17.178.96.59","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"207.244.88.150","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"192.254.190.168","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"216.200.145.235","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"131.111.8.146","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"67.219.246.202","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"207.69.189.231","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"74.201.226.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"173.228.157.42","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"34.203.43.166","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"207.69.189.232","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"64.147.108.55","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"146.148.85.20","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"207.69.189.229","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"64.147.108.52","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"207.69.189.230","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"64.147.108.51","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"209.86.122.183","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"173.228.157.39","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"173.228.157.41","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"64.147.108.50","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"173.228.157.40","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"15.98.76.13","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"64.147.108.40","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"95.216.24.32","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"128.232.25.20","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"209.87.16.33","port":25,"protocol":"TCP","country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"199.89.1.120","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"82.195.75.114","port":25,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"5.153.231.4","port":25,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"104.17.79.191","port":25,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"address":"16.101.58.68","port":1042,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"dns_resolutions":[{"domain":"126.com","address":"123.126.96.210","ttl":17999,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-02-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"126mx00.mxmail.netease.com","address":"220.181.15.209","ttl":599,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"126mx01.mxmail.netease.com","address":"220.181.15.140","ttl":209,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"126mx02.mxmail.netease.com","address":"220.181.15.145","ttl":351,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"126mx03.mxmail.netease.com","address":"220.181.15.193","ttl":186,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Guangzhou NetEase Computer System Co., Ltd","registrar_name_servers":"NS1.NEASE.NET","registrar_creation_date":"1998-04-09T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"acm.org","address":"104.17.79.191","ttl":297,"country":"United States","registrar_name":"Network Solutions, LLC","registrar_organization":"Association for Computing Machinery","registrar_name_servers":"A1.VERISIGNDNS.COM","registrar_creation_date":"1992-02-14T05:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"aladdin.com","address":"208.32.211.100","ttl":71,"country":"United States","registrar_name":"DomainTheNet.com","registrar_organization":"Aladdin Knowledge Systesm Ltd","registrar_name_servers":"NS-MUC.EALADDIN.COM","registrar_creation_date":"1989-03-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"apple.com","address":"17.178.96.59","ttl":1570,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Apple Inc.","registrar_name_servers":"ADNS1.APPLE.COM","registrar_creation_date":"1987-02-19T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"bryson.demon.co.uk","ttl":299,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"cl.cam.ac.uk","ttl":430,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"cluster1.us.messagelabs.com","address":"67.219.246.106","ttl":440,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"cluster1a.us.messagelabs.com","address":"34.203.43.166","ttl":35,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"debian.org","address":"130.89.148.14","ttl":18282,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"ford-mason.co.uk","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"ismtp.sitestar.everyone.net","address":"216.200.145.235","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"ma1-aaemail-dr-lapp01.apple.com","address":"17.171.2.60","ttl":20654,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"ma1-aaemail-dr-lapp02.apple.com","address":"17.171.2.68","ttl":19383,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"ma1-aaemail-dr-lapp03.apple.com","address":"17.171.2.72","ttl":11502,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.126.com","address":"103.129.252.34","ttl":599,"country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.apple.com","ttl":1302,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.cl.cam.ac.uk","address":"128.232.25.20","ttl":599,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.debian.org","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.mailroute.net","address":"199.89.1.120","ttl":1540,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mail.ru","address":"217.69.139.200","ttl":368,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mailly.debian.org","address":"82.195.75.114","ttl":599,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mta5.am0.yahoodns.net","address":"66.218.85.52","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mta6.am0.yahoodns.net","address":"98.137.159.25","ttl":23,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mta7.am0.yahoodns.net","address":"98.137.159.25","ttl":52,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"muffat.debian.org","address":"209.87.16.33","ttl":599,"country":"Canada","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.126.com","address":"123.126.96.210","ttl":17982,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.apple.com","ttl":1798,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.cam.ac.uk","address":"131.111.8.149","ttl":2447,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.cl.cam.ac.uk","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.debian.org","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.mail.ru","address":"217.69.139.87","ttl":149,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx.openoffice.org","address":"40.79.78.1","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx1-lw-eu.apache.org","ttl":1139,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx1-lw-us.apache.org","address":"207.244.88.150","ttl":1267,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx2-lw-eu.apache.org","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx2-lw-us.apache.org","ttl":1628,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx6.earthlink.net","address":"207.69.189.229","ttl":1767,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx7.earthlink.net","address":"207.69.189.230","ttl":496,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx8.earthlink.net","address":"207.69.189.231","ttl":1119,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mx9.earthlink.net","address":"207.69.189.232","ttl":604,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"mxs.mail.ru","address":"94.100.180.31","ttl":31,"country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"netcom.com","address":"209.86.122.183","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"northcoast.com","address":"146.148.85.20","ttl":3536,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"nwk-aaemail-lapp01.apple.com","address":"17.151.62.66","ttl":1421,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"nwk-aaemail-lapp02.apple.com","address":"17.151.62.67","ttl":14924,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"nwk-aaemail-lapp03.apple.com","address":"17.151.62.68","ttl":14251,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"onlineconnections.com.au","address":"192.254.190.168","ttl":14399,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"openoffice.org","address":"40.79.78.1","ttl":3599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx10.pobox.com","address":"64.147.108.51","ttl":1244,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx11.pobox.com","address":"64.147.108.52","ttl":360,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx14.pobox.com","address":"64.147.108.55","ttl":513,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx20.pobox.com","address":"173.228.157.39","ttl":402,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx21.pobox.com","address":"173.228.157.40","ttl":599,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx22.pobox.com","address":"173.228.157.41","ttl":372,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx23.pobox.com","address":"173.228.157.42","ttl":376,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pb-mx9.pobox.com","address":"64.147.108.50","ttl":1559,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"pobox.com","address":"64.147.108.40","ttl":750,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"smtp.126.com","address":"123.126.96.4","ttl":1799,"country":"China","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"smtp.apple.com","ttl":1799,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"smtp.cl.cam.ac.uk","ttl":1199,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"smtp.debian.org","ttl":597,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"smtp.northcoast.com","ttl":899,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"src.dec.com","ttl":599,"country":"-","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"theriver.com","address":"74.201.226.52","ttl":116,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"domain":"yahoo.com","address":"72.30.35.9","ttl":301,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}],"processes":[{"pid":3384,"ppid":0,"name":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe","command_line":"","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","normalized_path":"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe","uid":"00036472-00003384","icon":"$2c"},{"pid":2588,"ppid":3384,"name":"WmiPrvSE.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","parent_uid":"00036472-00003384","uid":"00036473-00002588"},{"pid":2288,"ppid":3384,"name":"WmiPrvSE.exe","command_line":"","normalized_path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","parent_uid":"00036472-00003384","uid":"00036473-00002288"}],"all_imported_dlls":["WSHTCPIP.DLL","ole32.dll","pnrpnsp.dll","FWPUCLNT.DLL","user32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","normaliz.dll","iertutil.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","profapi.dll","wininet.dll","lpk.dll","IPHLPAPI.DLL","winnsi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msvcr100.dll","shell32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","wow64cpu.dll","msvcrt.dll","winrnr.dll","rpcrt4.dll","usp10.dll","dhcpcsvc6.dll","ntdll.dll","KernelBase.dll","advapi32.dll","cryptbase.dll","ws2_32.dll","nlaapi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","wship6.dll","wow64win.dll","mswsock.dll","kernel32.dll","sechost.dll","msctf.dll","tzres.dll","NapiNSP.dll","dnsapi.dll","rasadhlp.dll","sspicli.dll","gdi32.dll","shlwapi.dll","version.dll","secur32.dll","nsi.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","winhttp.dll","webio.dll","dhcpcsvc.dll","wow64.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Winamp 5.0 _en_ Crack.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Winamp 5.0 _en_ Crack.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Winamp 5.0 _en_.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Winamp 5.0 _en_.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Winamp 5.0 _en_.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Winamp 5.0 _en_ Crack.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"WinRAR.v.3.2.and.key.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"ICQ 4 Lite.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Kazaa Lite.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Kazaa Lite.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"WinRAR.v.3.2.and.key.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Harry Potter.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"index.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Harry Potter.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"ICQ 4 Lite.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Harry Potter.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"ICQ 4 Lite.ShareReactor.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"Kazaa Lite.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"index.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"index.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"WinRAR.v.3.2.and.key.com","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"lsass.exe","sha256":"9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"taaikmbhu.txt","sha256":"fdcfc81fb7cea7b8eb7f69f667e2cc1517a5c14886fcf2ff493e7c0e6e29a96a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"tmp137C.tmp","sha256":"98f3be480bbf4955d25739b1badafa214ca5b80a23986002be4b1c3830dad167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"tmp139C.tmp","sha256":"98f3be480bbf4955d25739b1badafa214ca5b80a23986002be4b1c3830dad167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"tmp13FB.tmp","sha256":"98f3be480bbf4955d25739b1badafa214ca5b80a23986002be4b1c3830dad167","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"name":"tmp142B.tmp","sha256":"c0cfd63d83323c6b6fafb0b259b63d3d77b928a1a601beff4d33931731cf3da0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"files_written":[{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%WINDIR%\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"C:\\9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%WINDIR%\\lsass.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%TEMP%\\taaikmbhu.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\es.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\he.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ka.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ro.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%PROGRAMFILES%\\7-Zip\\History.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\da-DK\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\af.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\an.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ar.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ast.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\az.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ba.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\be.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bg.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\bn.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\br.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ca.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\co.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cs.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\cy.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\da.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\de.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\el.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eo.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\et.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\eu.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ext.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fa.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fi.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fr.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fur.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\fy.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ga.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gl.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\gu.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hi.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hr.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hu.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\hy.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\id.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\io.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\is.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\it.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ja.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kaa.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\kk.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ko.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku-ckb.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ku.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ky.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lij.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lt.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\lv.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mk.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mn.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mng2.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\mr.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ms.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nb.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ne.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nl.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\nn.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pa-in.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pl.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ps.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt-br.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\pt.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ru.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sa.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\si.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sk.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sl.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sq.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spc.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sr-spl.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\sv.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ta.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\th.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tr.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\tt.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\ug.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uk.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\uz.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\va.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\vi.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\yo.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-cn.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\Lang\\zh-tw.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\License.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\7-Zip\\readme.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\Winamp 5.0 (en) Crack.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\WinRAR.v.3.2.and.key.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ClickToRun\\WinRAR.v.3.2.and.key.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\index.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\DW\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\WinRAR.v.3.2.and.key.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\WinRAR.v.3.2.and.key.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EQUATION\\1033\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\EURO\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Filters\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\GRPHFLT\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\Help\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ar-SA\\Winamp 5.0 (en).com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\bg-BG\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\cs-CZ\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\de-DE\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sk-SK\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\el-GR\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\Winamp 5.0 (en).ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\en-US\\Winamp 5.0 (en).ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\es-ES\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Winamp 5.0 (en) Crack.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\et-EE\\Winamp 5.0 (en) Crack.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\index.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fi-FI\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fr-FR\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Kazaa Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\Kazaa Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\en-US\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\main\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\index.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\WinRAR.v.3.2.and.key.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\fsdefinitions\\web\\WinRAR.v.3.2.and.key.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\he-IL\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hr-HR\\Winamp 5.0 (en) Crack.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\hu-HU\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\ICQ 4 Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\HWRCustomization\\ICQ 4 Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\it-IT\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ja-JP\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\Harry Potter.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ko-KR\\Harry Potter.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\index.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lt-LT\\index.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\lv-LV\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nb-NO\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\Winamp 5.0 (en) Crack.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\nl-NL\\Winamp 5.0 (en) Crack.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pl-PL\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-BR\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\Harry Potter.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\pt-PT\\Harry Potter.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\Winamp 5.0 (en).exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ro-RO\\Winamp 5.0 (en).exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Kazaa Lite.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\ru-RU\\Kazaa Lite.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\Harry Potter.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sl-SI\\Harry Potter.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\ICQ 4 Lite.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sr-Latn-CS\\ICQ 4 Lite.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\sv-SE\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\Kazaa Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\th-TH\\Kazaa Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\index.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\tr-TR\\index.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\index.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\uk-UA\\index.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\WinRAR.v.3.2.and.key.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-CN\\WinRAR.v.3.2.and.key.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\Winamp 5.0 (en) Crack.ShareReactor.com","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\ink\\zh-TW\\Winamp 5.0 (en) Crack.ShareReactor.com:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\ICQ 4 Lite.exe","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\MSInfo\\ICQ 4 Lite.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"path":"%TEMP%\\tmp137C.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%TEMP%\\tmp13FB.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%TEMP%\\tmp139C.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\Legal\\ENU\\license.html","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POSIX\\","sources":[{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5d42ec0502883868746704be"},{"report_type":"sandbox","report_id":"5d42ec09038838a4914d93b7"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d42ec09038838a4914d93b7","5d42ec0502883868746704be"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Worm.Mydoom Sample 9e4c6410ab9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9e4c6410ab9e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8"}],["$","meta","4",{"property":"og:title","content":"Malicious Worm.Mydoom Sample 9e4c6410ab9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9e4c6410ab9e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9e4c6410ab9eda9a3d3cbf23c58215f3bc8d3e66ad55e40b4e30eb785e191bf8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Worm.Mydoom Sample 9e4c6410ab9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9e4c6410ab9e…. Malware family: Worm.Mydoom. Threat score 100/100. 26/27 AV engines flagged this file. 11 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]