96.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | March 22, 2023, 5:26 p.m. | March 22, 2023, 5:32 p.m. |
-
-
svchost.exe C:\Windows\system32\svchost.exe
2500 -
svchost.exe C:\Windows\system32\svchost.exe
2628 -
svchost.exe C:\Windows\system32\svchost.exe
1796 -
svchost.exe C:\Windows\system32\svchost.exe
1320
-
| IP Address | Status | Action |
|---|---|---|
| 103.224.182.241 | Active | Moloch |
| 103.3.1.161 | Active | Moloch |
| 103.4.16.43 | Active | Moloch |
| 104.164.117.233 | Active | Moloch |
| 104.18.40.43 | Active | Moloch |
| 104.196.26.65 | Active | Moloch |
| 104.20.123.68 | Active | Moloch |
| 104.20.220.29 | Active | Moloch |
| 104.21.1.213 | Active | Moloch |
| 104.21.1.51 | Active | Moloch |
| 104.21.2.101 | Active | Moloch |
| 104.21.23.9 | Active | Moloch |
| 104.21.234.120 | Active | Moloch |
| 104.21.30.14 | Active | Moloch |
| 104.21.41.152 | Active | Moloch |
| 104.21.42.10 | Active | Moloch |
| 104.21.48.207 | Active | Moloch |
| 104.21.50.138 | Active | Moloch |
| 104.21.6.168 | Active | Moloch |
| 104.21.66.220 | Active | Moloch |
| 104.21.66.46 | Active | Moloch |
| 104.21.68.7 | Active | Moloch |
| 104.21.7.22 | Active | Moloch |
| 104.21.73.143 | Active | Moloch |
| 104.21.77.146 | Active | Moloch |
| 104.21.92.183 | Active | Moloch |
| 104.218.10.254 | Active | Moloch |
| 104.24.161.27 | Active | Moloch |
| 104.26.1.82 | Active | Moloch |
| 104.26.10.81 | Active | Moloch |
| 104.26.12.244 | Active | Moloch |
| 104.26.15.53 | Active | Moloch |
| 104.26.3.124 | Active | Moloch |
| 104.26.6.17 | Active | Moloch |
| 104.26.7.221 | Active | Moloch |
| 104.74.211.103 | Active | Moloch |
| 107.180.98.101 | Active | Moloch |
| 108.167.164.216 | Active | Moloch |
| 108.170.12.50 | Active | Moloch |
| 109.71.54.22 | Active | Moloch |
| 118.27.125.181 | Active | Moloch |
| 121.254.136.27 | Active | Moloch |
| 122.128.109.107 | Active | Moloch |
| 128.8.10.90 | Active | Moloch |
| 13.225.131.31 | Active | Moloch |
| 13.248.155.104 | Active | Moloch |
| 13.248.169.48 | Active | Moloch |
| 133.125.38.187 | Active | Moloch |
| 135.125.108.170 | Active | Moloch |
| 135.181.73.98 | Active | Moloch |
| 136.243.147.81 | Active | Moloch |
| 137.118.26.67 | Active | Moloch |
| 138.201.65.187 | Active | Moloch |
| 141.193.213.20 | Active | Moloch |
| 142.250.152.27 | Active | Moloch |
| 147.154.0.23 | Active | Moloch |
| 148.130.4.196 | Active | Moloch |
| 148.72.176.26 | Active | Moloch |
| 151.101.130.159 | Active | Moloch |
| 151.101.66.132 | Active | Moloch |
| 153.120.34.73 | Active | Moloch |
| 153.126.211.112 | Active | Moloch |
| 154.203.14.100 | Active | Moloch |
| 154.213.117.166 | Active | Moloch |
| 154.81.136.239 | Active | Moloch |
| 154.88.50.199 | Active | Moloch |
| 157.112.176.4 | Active | Moloch |
| 157.112.182.239 | Active | Moloch |
| 157.112.187.75 | Active | Moloch |
| 157.7.107.38 | Active | Moloch |
| 157.7.107.88 | Active | Moloch |
| 157.7.231.224 | Active | Moloch |
| 159.89.244.183 | Active | Moloch |
| 162.241.233.114 | Active | Moloch |
| 164.124.101.2 | Active | Moloch |
| 164.132.175.106 | Active | Moloch |
| 164.90.244.158 | Active | Moloch |
| 165.160.13.20 | Active | Moloch |
| 165.227.252.190 | Active | Moloch |
| 170.82.173.30 | Active | Moloch |
| 172.217.31.19 | Active | Moloch |
| 172.67.134.134 | Active | Moloch |
| 172.67.135.146 | Active | Moloch |
| 172.67.142.169 | Active | Moloch |
| 172.67.148.147 | Active | Moloch |
| 172.67.150.80 | Active | Moloch |
| 172.67.152.159 | Active | Moloch |
| 172.67.156.237 | Active | Moloch |
| 172.67.158.251 | Active | Moloch |
| 172.67.160.168 | Active | Moloch |
| 172.67.163.101 | Active | Moloch |
| 172.67.163.173 | Active | Moloch |
| 172.67.165.62 | Active | Moloch |
| 172.67.173.200 | Active | Moloch |
| 172.67.181.113 | Active | Moloch |
| 172.67.184.30 | Active | Moloch |
| 172.67.185.152 | Active | Moloch |
| 172.67.188.75 | Active | Moloch |
| 172.67.189.227 | Active | Moloch |
| 172.67.189.68 | Active | Moloch |
| 172.67.193.133 | Active | Moloch |
| 172.67.199.57 | Active | Moloch |
| 172.67.209.90 | Active | Moloch |
| 172.67.33.95 | Active | Moloch |
| 173.205.126.33 | Active | Moloch |
| 173.231.184.124 | Active | Moloch |
| 173.254.28.29 | Active | Moloch |
| 178.249.70.75 | Active | Moloch |
| 18.176.155.206 | Active | Moloch |
| 18.197.121.220 | Active | Moloch |
| 18.64.8.103 | Active | Moloch |
| 183.181.82.14 | Active | Moloch |
| 183.90.232.24 | Active | Moloch |
| 185.106.129.180 | Active | Moloch |
| 185.129.138.60 | Active | Moloch |
| 185.151.30.147 | Active | Moloch |
| 185.163.45.187 | Active | Moloch |
| 185.178.208.141 | Active | Moloch |
| 185.237.66.112 | Active | Moloch |
| 185.42.105.162 | Active | Moloch |
| 185.53.177.50 | Active | Moloch |
| 185.80.51.179 | Active | Moloch |
| 188.165.133.163 | Active | Moloch |
| 188.166.152.188 | Active | Moloch |
| 188.94.254.88 | Active | Moloch |
| 192.124.249.10 | Active | Moloch |
| 192.124.249.13 | Active | Moloch |
| 192.124.249.14 | Active | Moloch |
| 192.124.249.15 | Active | Moloch |
| 192.124.249.20 | Active | Moloch |
| 192.124.249.3 | Active | Moloch |
| 192.169.149.78 | Active | Moloch |
| 192.203.230.10 | Active | Moloch |
| 192.241.158.94 | Active | Moloch |
| 192.252.154.18 | Active | Moloch |
| 192.252.159.165 | Active | Moloch |
| 192.33.4.12 | Active | Moloch |
| 192.36.148.17 | Active | Moloch |
| 192.58.128.30 | Active | Moloch |
| 193.0.14.129 | Active | Moloch |
| 193.107.88.74 | Active | Moloch |
| 193.166.255.171 | Active | Moloch |
| 193.70.68.254 | Active | Moloch |
| 195.5.116.23 | Active | Moloch |
| 195.78.66.50 | Active | Moloch |
| 195.96.252.188 | Active | Moloch |
| 198.1.81.28 | Active | Moloch |
| 198.100.146.220 | Active | Moloch |
| 198.185.159.144 | Active | Moloch |
| 198.185.159.145 | Active | Moloch |
| 198.199.101.195 | Active | Moloch |
| 198.209.253.30 | Active | Moloch |
| 198.32.64.12 | Active | Moloch |
| 198.41.0.4 | Active | Moloch |
| 198.49.23.144 | Active | Moloch |
| 198.54.117.242 | Active | Moloch |
| 199.34.228.78 | Active | Moloch |
| 199.59.243.220 | Active | Moloch |
| 199.59.243.223 | Active | Moloch |
| 202.12.27.33 | Active | Moloch |
| 202.172.28.187 | Active | Moloch |
| 202.172.28.89 | Active | Moloch |
| 202.254.236.40 | Active | Moloch |
| 202.53.77.146 | Active | Moloch |
| 202.94.166.30 | Active | Moloch |
| 203.137.75.45 | Active | Moloch |
| 203.210.102.34 | Active | Moloch |
| 204.11.56.48 | Active | Moloch |
| 204.15.134.44 | Active | Moloch |
| 204.79.197.212 | Active | Moloch |
| 205.149.134.32 | Active | Moloch |
| 205.178.189.131 | Active | Moloch |
| 206.191.152.37 | Active | Moloch |
| 207.180.198.201 | Active | Moloch |
| 208.100.26.245 | Active | Moloch |
| 208.109.214.162 | Active | Moloch |
| 208.80.122.2 | Active | Moloch |
| 208.97.178.138 | Active | Moloch |
| 210.140.73.39 | Active | Moloch |
| 211.1.226.67 | Active | Moloch |
| 211.13.196.162 | Active | Moloch |
| 211.13.204.3 | Active | Moloch |
| 212.44.102.57 | Active | Moloch |
| 213.142.131.159 | Active | Moloch |
| 213.175.217.57 | Active | Moloch |
| 213.186.33.17 | Active | Moloch |
| 213.186.33.40 | Active | Moloch |
| 213.227.141.97 | Active | Moloch |
| 216.177.137.32 | Active | Moloch |
| 217.160.0.131 | Active | Moloch |
| 217.160.0.179 | Active | Moloch |
| 217.19.237.54 | Active | Moloch |
| 217.19.254.22 | Active | Moloch |
| 217.69.139.150 | Active | Moloch |
| 217.79.248.38 | Active | Moloch |
| 219.94.128.216 | Active | Moloch |
| 219.94.128.87 | Active | Moloch |
| 219.94.129.97 | Active | Moloch |
| 221.132.33.88 | Active | Moloch |
| 23.227.38.32 | Active | Moloch |
| 23.227.38.74 | Active | Moloch |
| 27.0.174.59 | Active | Moloch |
| 3.130.253.23 | Active | Moloch |
| 3.140.13.188 | Active | Moloch |
| 3.18.7.81 | Active | Moloch |
| 3.19.116.195 | Active | Moloch |
| 3.33.152.147 | Active | Moloch |
| 3.64.163.50 | Active | Moloch |
| 3.65.101.129 | Active | Moloch |
| 3.94.41.167 | Active | Moloch |
| 31.177.76.70 | Active | Moloch |
| 31.177.80.70 | Active | Moloch |
| 34.102.136.180 | Active | Moloch |
| 34.117.168.233 | Active | Moloch |
| 34.205.242.146 | Active | Moloch |
| 35.154.163.204 | Active | Moloch |
| 35.168.185.204 | Active | Moloch |
| 35.172.94.1 | Active | Moloch |
| 35.186.238.101 | Active | Moloch |
| 35.214.171.193 | Active | Moloch |
| 35.230.155.43 | Active | Moloch |
| 38.111.255.201 | Active | Moloch |
| 39.99.233.155 | Active | Moloch |
| 43.255.29.192 | Active | Moloch |
| 45.142.176.225 | Active | Moloch |
| 45.200.235.135 | Active | Moloch |
| 46.242.238.60 | Active | Moloch |
| 46.30.60.158 | Active | Moloch |
| 49.12.155.123 | Active | Moloch |
| 49.212.180.178 | Active | Moloch |
| 49.212.232.113 | Active | Moloch |
| 49.212.235.175 | Active | Moloch |
| 49.212.235.59 | Active | Moloch |
| 49.212.243.77 | Active | Moloch |
| 5.134.13.210 | Active | Moloch |
| 5.134.4.115 | Active | Moloch |
| 5.189.171.125 | Active | Moloch |
| 5.196.166.214 | Active | Moloch |
| 5.39.75.157 | Active | Moloch |
| 51.159.3.117 | Active | Moloch |
| 51.79.51.72 | Active | Moloch |
| 51.89.6.56 | Active | Moloch |
| 52.200.51.73 | Active | Moloch |
| 52.211.245.146 | Active | Moloch |
| 52.219.178.96 | Active | Moloch |
| 52.219.179.0 | Active | Moloch |
| 52.71.57.184 | Active | Moloch |
| 54.194.190.151 | Active | Moloch |
| 54.209.32.212 | Active | Moloch |
| 54.212.145.129 | Active | Moloch |
| 54.236.92.93 | Active | Moloch |
| 54.39.198.18 | Active | Moloch |
| 59.106.13.181 | Active | Moloch |
| 59.106.19.204 | Active | Moloch |
| 60.43.154.138 | Active | Moloch |
| 62.122.170.171 | Active | Moloch |
| 62.122.190.121 | Active | Moloch |
| 62.75.216.107 | Active | Moloch |
| 62.75.216.137 | Active | Moloch |
| 63.251.106.25 | Active | Moloch |
| 64.125.133.18 | Active | Moloch |
| 64.233.187.27 | Active | Moloch |
| 65.52.128.33 | Active | Moloch |
| 66.111.4.70 | Active | Moloch |
| 66.163.170.48 | Active | Moloch |
| 66.226.70.66 | Active | Moloch |
| 66.94.119.160 | Active | Moloch |
| 69.163.218.51 | Active | Moloch |
| 69.163.239.62 | Active | Moloch |
| 69.195.90.46 | Active | Moloch |
| 69.46.30.77 | Active | Moloch |
| 70.39.251.249 | Active | Moloch |
| 72.44.93.236 | Active | Moloch |
| 74.125.203.26 | Active | Moloch |
| 74.208.215.145 | Active | Moloch |
| 74.208.215.199 | Active | Moloch |
| 75.2.70.75 | Active | Moloch |
| 75.2.95.235 | Active | Moloch |
| 76.223.27.102 | Active | Moloch |
| 76.223.35.103 | Active | Moloch |
| 76.223.65.111 | Active | Moloch |
| 76.74.184.61 | Active | Moloch |
| 77.68.50.105 | Active | Moloch |
| 77.78.104.3 | Active | Moloch |
| 78.46.224.133 | Active | Moloch |
| 79.124.76.247 | Active | Moloch |
| 79.96.161.192 | Active | Moloch |
| 79.96.32.254 | Active | Moloch |
| 80.74.154.6 | Active | Moloch |
| 80.82.115.227 | Active | Moloch |
| 80.93.82.33 | Active | Moloch |
| 81.169.145.175 | Active | Moloch |
| 81.2.194.241 | Active | Moloch |
| 82.201.61.230 | Active | Moloch |
| 82.208.6.9 | Active | Moloch |
| 83.167.255.150 | Active | Moloch |
| 83.223.113.46 | Active | Moloch |
| 85.128.196.22 | Active | Moloch |
| 85.128.55.51 | Active | Moloch |
| 85.233.160.148 | Active | Moloch |
| 87.230.93.218 | Active | Moloch |
| 87.98.236.253 | Active | Moloch |
| 88.86.118.82 | Active | Moloch |
| 89.161.136.188 | Active | Moloch |
| 89.161.163.246 | Active | Moloch |
| 89.221.250.3 | Active | Moloch |
| 89.31.143.1 | Active | Moloch |
| 91.201.52.102 | Active | Moloch |
| 91.220.211.163 | Active | Moloch |
| 91.229.22.126 | Active | Moloch |
| 92.42.191.38 | Active | Moloch |
| 93.187.206.66 | Active | Moloch |
| 93.189.66.202 | Active | Moloch |
| 94.130.164.242 | Active | Moloch |
| 95.174.22.233 | Active | Moloch |
| 96.127.180.42 | Active | Moloch |
| 96.91.204.114 | Active | Moloch |
| 99.83.154.118 | Active | Moloch |
| 99.83.190.102 | Active | Moloch |
| 77.73.134.27 | Active | Moloch |
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49330 172.67.199.57:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 04:c9:15:e0:a1:18:74:04:16:cb:98:fd:73:56:cf:7d:99:35:cb:75 |
|
TLSv1 192.168.56.101:49303 172.67.160.168:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 39:60:5f:8a:b0:63:95:b4:7b:c1:8a:c0:a2:87:dc:a4:4d:b7:94:a6 |
|
TLSv1 192.168.56.101:49346 104.21.48.207:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 8e:eb:ad:d2:6e:53:39:1d:ea:e0:21:c4:22:9a:ee:d0:93:3d:62:6a |
|
TLSv1 192.168.56.101:49384 172.67.193.133:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 28:54:2c:72:71:1b:3f:88:07:e2:1d:7b:6c:1b:7f:45:bc:7e:fe:1c |
|
TLSv1 192.168.56.101:49423 172.67.209.90:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 0f:0a:0c:90:f8:6d:9f:92:6a:fc:87:76:90:56:46:b5:a5:4e:41:70 |
|
TLSv1 192.168.56.101:49462 5.189.171.125:443 |
None | None | None |
|
TLSv1 192.168.56.101:49466 172.67.209.90:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 0f:0a:0c:90:f8:6d:9f:92:6a:fc:87:76:90:56:46:b5:a5:4e:41:70 |
|
TLSv1 192.168.56.101:49512 83.223.113.46:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=magicomm.co.uk | c7:bb:94:3f:a7:23:97:e0:93:f5:69:24:eb:a6:85:25:92:3b:d3:e1 |
|
TLSv1 192.168.56.101:49386 104.21.66.220:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 | CN=*.clinicasanluis.com.co | 29:ac:43:1a:71:82:7f:ec:3f:09:c7:81:24:9c:1e:24:f4:10:94:b6 |
|
TLSv1 192.168.56.101:49483 83.223.113.46:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=magicomm.co.uk | c7:bb:94:3f:a7:23:97:e0:93:f5:69:24:eb:a6:85:25:92:3b:d3:e1 |
|
TLSv1 192.168.56.101:49424 91.229.22.126:443 |
C=US, O=DigiCert Inc, OU=www.digicert.com, CN=GeoTrust RSA CA 2018 | C=PL, ST=Mazowieckie, L=Warszawa, O=Komenda Glowna Policji, CN=*.policja.gov.pl | 3d:fe:e4:18:9c:81:af:dd:a8:f5:e3:51:55:cb:6e:5e:89:7f:65:e2 |
|
TLSv1 192.168.56.101:49435 5.189.171.125:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=muhr-soehne.com | 53:27:b3:3c:95:07:9d:ec:95:5c:07:b2:f1:75:0e:ea:5b:36:10:83 |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| resource name | OMT |
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.pr-park.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.jenco.co.uk/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.baijaku.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.quadlock.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.pdqhomes.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.tvtools.fi/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.alteor.cl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.olras.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.dgmna.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.valdal.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.elpro.si/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.credo.edu.pl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.depalo.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.iamdirt.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.wifi4all.nl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.abdg.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.fcwcvt.org/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.petsfan.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.synetik.net/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.item-pr.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.snugpak.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.rs-ag.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.photo4b.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.yocinc.org/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.nunomira.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.hummer.hu/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.vazir.se/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.transsib.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.mqs.com.br/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.abart.pl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.vitaindu.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.crcsi.org/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.t-tre.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.naoi-a.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.valselit.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.ora.ecnet.jp/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.waldi.pl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.gpthink.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.ora-ito.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.nelipak.nl/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.kernsafe.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.cokocoko.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.ex-olive.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.2print.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.x0c.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.holleman.us/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.tyrns.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.vexcom.com/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.edimart.hu/ | ||||||
| suspicious_features | POST method with no referer header | suspicious_request | POST http://www.speelhal.net/ | ||||||
| request | POST http://www.pr-park.com/ |
| request | POST http://www.jenco.co.uk/ |
| request | POST http://www.baijaku.com/ |
| request | POST http://www.quadlock.com/ |
| request | POST http://www.pdqhomes.com/ |
| request | POST http://www.tvtools.fi/ |
| request | POST http://www.alteor.cl/ |
| request | POST http://www.olras.com/ |
| request | POST http://www.dgmna.com/ |
| request | POST http://www.valdal.com/ |
| request | POST http://www.elpro.si/ |
| request | POST http://www.credo.edu.pl/ |
| request | POST http://www.depalo.com/ |
| request | POST http://www.iamdirt.com/ |
| request | POST http://www.wifi4all.nl/ |
| request | POST http://www.abdg.com/ |
| request | POST http://www.fcwcvt.org/ |
| request | POST http://www.petsfan.com/ |
| request | POST http://www.synetik.net/ |
| request | POST http://www.item-pr.com/ |
| request | POST http://www.snugpak.com/ |
| request | POST http://www.rs-ag.com/ |
| request | POST http://www.photo4b.com/ |
| request | POST http://www.yocinc.org/ |
| request | POST http://www.nunomira.com/ |
| request | POST http://www.hummer.hu/ |
| request | POST http://www.vazir.se/ |
| request | POST http://www.transsib.com/ |
| request | POST http://www.mqs.com.br/ |
| request | POST http://www.abart.pl/ |
| request | POST http://www.vitaindu.com/ |
| request | POST http://www.crcsi.org/ |
| request | POST http://www.t-tre.com/ |
| request | POST http://www.naoi-a.com/ |
| request | POST http://www.valselit.com/ |
| request | POST http://www.ora.ecnet.jp/ |
| request | POST http://www.waldi.pl/ |
| request | POST http://www.gpthink.com/ |
| request | POST http://www.ora-ito.com/ |
| request | POST http://www.nelipak.nl/ |
| request | POST http://www.kernsafe.com/ |
| request | POST http://www.cokocoko.com/ |
| request | POST http://www.ex-olive.com/ |
| request | POST http://www.2print.com/ |
| request | POST http://www.x0c.com/ |
| request | POST http://www.holleman.us/ |
| request | POST http://www.tyrns.com/ |
| request | POST http://www.vexcom.com/ |
| request | POST http://www.edimart.hu/ |
| request | POST http://www.speelhal.net/ |
| request | POST http://www.pr-park.com/ |
| request | POST http://www.jenco.co.uk/ |
| request | POST http://www.baijaku.com/ |
| request | POST http://www.quadlock.com/ |
| request | POST http://www.pdqhomes.com/ |
| request | POST http://www.tvtools.fi/ |
| request | POST http://www.alteor.cl/ |
| request | POST http://www.olras.com/ |
| request | POST http://www.dgmna.com/ |
| request | POST http://www.valdal.com/ |
| request | POST http://www.elpro.si/ |
| request | POST http://www.credo.edu.pl/ |
| request | POST http://www.depalo.com/ |
| request | POST http://www.iamdirt.com/ |
| request | POST http://www.wifi4all.nl/ |
| request | POST http://www.abdg.com/ |
| request | POST http://www.fcwcvt.org/ |
| request | POST http://www.petsfan.com/ |
| request | POST http://www.synetik.net/ |
| request | POST http://www.item-pr.com/ |
| request | POST http://www.snugpak.com/ |
| request | POST http://www.rs-ag.com/ |
| request | POST http://www.photo4b.com/ |
| request | POST http://www.yocinc.org/ |
| request | POST http://www.nunomira.com/ |
| request | POST http://www.hummer.hu/ |
| request | POST http://www.vazir.se/ |
| request | POST http://www.transsib.com/ |
| request | POST http://www.mqs.com.br/ |
| request | POST http://www.abart.pl/ |
| request | POST http://www.vitaindu.com/ |
| request | POST http://www.crcsi.org/ |
| request | POST http://www.t-tre.com/ |
| request | POST http://www.naoi-a.com/ |
| request | POST http://www.valselit.com/ |
| request | POST http://www.ora.ecnet.jp/ |
| request | POST http://www.waldi.pl/ |
| request | POST http://www.gpthink.com/ |
| request | POST http://www.ora-ito.com/ |
| request | POST http://www.nelipak.nl/ |
| request | POST http://www.kernsafe.com/ |
| request | POST http://www.cokocoko.com/ |
| request | POST http://www.ex-olive.com/ |
| request | POST http://www.2print.com/ |
| request | POST http://www.x0c.com/ |
| request | POST http://www.holleman.us/ |
| request | POST http://www.tyrns.com/ |
| request | POST http://www.vexcom.com/ |
| request | POST http://www.edimart.hu/ |
| request | POST http://www.speelhal.net/ |
| description | svchost.exe tried to sleep 543 seconds, actually delayed analysis time by 543 seconds | |||
| cmdline | C:\Windows\system32\svchost.exe |
| section | {u'size_of_data': u'0x00015800', u'virtual_address': u'0x0002e000', u'entropy': 7.784607914953358, u'name': u'.rsrc', u'virtual_size': u'0x000157d4'} | entropy | 7.78460791495 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.34126984127 | description | Overall entropy of this PE file is high | |||||||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communications smtp | rule | network_smtp_raw | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| domain | smtp.live.com |
| buffer | Buffer with sha1: 97751a713ab1c071fe2a95e95ba6d2bd53539433 |
| buffer | Buffer with sha1: d4c0e4a6a1a42545ce3453e7d7b56813f26a5e6b |
| receiver | [] | sender | [] | server | 66.226.70.66 | |||||||||
| receiver | [] | sender | [] | server | 74.125.203.26 | |||||||||
| receiver | [] | sender | [] | server | 66.163.170.48 | |||||||||
| receiver | [] | sender | [] | server | 108.170.12.50 | |||||||||
| receiver | [] | sender | [] | server | 219.94.128.216 | |||||||||
| receiver | [] | sender | [] | server | 219.94.129.97 | |||||||||
| receiver | [] | sender | [] | server | 202.172.28.89 | |||||||||
| receiver | [] | sender | [] | server | 217.69.139.150 | |||||||||
| receiver | [] | sender | [] | server | 217.69.139.150 | |||||||||
| receiver | [] | sender | [] | server | 142.250.152.27 | |||||||||
| receiver | [] | sender | [] | server | 217.69.139.150 | |||||||||
| receiver | [] | sender | [] | server | 142.250.152.27 | |||||||||
| receiver | [] | sender | [] | server | 64.233.187.27 | |||||||||
| receiver | [] | sender | [] | server | 142.250.152.27 | |||||||||
| receiver | [] | sender | [] | server | 66.111.4.70 | |||||||||
| receiver | [] | sender | [] | server | 64.233.187.27 | |||||||||
| receiver | [] | sender | [] | server | 64.233.187.27 | |||||||||
| receiver | [] | sender | [] | server | 66.111.4.70 | |||||||||
| receiver | [] | sender | [] | server | 49.212.243.77 | |||||||||
| receiver | [] | sender | [] | server | 66.111.4.70 | |||||||||
| receiver | [] | sender | [] | server | 49.212.180.178 | |||||||||
| receiver | [] | sender | [] | server | 79.96.32.254 | |||||||||
| receiver | [] | sender | [] | server | 153.120.34.73 | |||||||||
| receiver | [] | sender | [] | server | 203.137.75.45 | |||||||||
| receiver | [] | sender | [] | server | 192.169.149.78 | |||||||||
| receiver | [] | sender | [] | server | 213.175.217.57 | |||||||||
| receiver | [] | sender | [] | server | 202.172.28.187 | |||||||||
| receiver | [] | sender | [] | server | 49.12.155.123 | |||||||||
| receiver | [] | sender | [] | server | 162.241.233.114 | |||||||||
| receiver | [] | sender | [] | server | 69.195.90.46 | |||||||||
| receiver | [] | sender | [] | server | 153.126.211.112 | |||||||||
| receiver | [] | sender | [] | server | 157.112.187.75 | |||||||||
| receiver | [] | sender | [] | server | 109.71.54.22 | |||||||||
| receiver | [] | sender | [] | server | 212.44.102.57 | |||||||||
| receiver | [] | sender | [] | server | 173.205.126.33 | |||||||||
| receiver | [] | sender | [] | server | 94.130.164.242 | |||||||||
| receiver | [] | sender | [] | server | 173.205.126.33 | |||||||||
| receiver | [] | sender | [] | server | 164.132.175.106 | |||||||||
| receiver | [] | sender | [] | server | 69.195.90.46 | |||||||||
| receiver | [] | sender | [] | server | 79.96.32.254 | |||||||||
| receiver | [] | sender | [] | server | 219.94.128.87 | |||||||||
| receiver | [] | sender | [] | server | 54.39.198.18 | |||||||||
| receiver | [] | sender | [] | server | 69.46.30.77 | |||||||||
| receiver | [] | sender | [] | server | 213.142.131.159 | |||||||||
| receiver | [] | sender | [] | server | 193.107.88.74 | |||||||||
| host | 153.120.34.73 | |||
| host | 198.1.81.28 | |||
| host | 211.13.196.162 | |||
| host | 77.73.134.27 | |||
| process | svchost.exe | useragent | |||||||
| process | svchost.exe | useragent | Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) | ||||||
| process: potential process injection target | svchost.exe |
| Lionic | Trojan.Win32.Cutwail.4!c |
| Elastic | malicious (high confidence) |
| CrowdStrike | win/malicious_confidence_90% (W) |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Generik.MMRRDJE |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | Trojan.Win32.Cutwail.yaq |
| BitDefender | Trojan.GenericKD.66042498 |
| MicroWorld-eScan | Trojan.GenericKD.66043091 |
| Avast | Win32:Trojan-gen |
| Rising | Trojan.Cutwail!8.2E7D (CLOUD) |
| Emsisoft | Trojan.GenericKD.66042498 (B) |
| McAfee-GW-Edition | Artemis!Trojan |
| Trapmine | malicious.moderate.ml.score |
| FireEye | Generic.mg.9faea65cff61ad64 |
| GData | Win32.Trojan-Dropper.Cutwail.I8NS4J |
| ZoneAlarm | Trojan.Win32.Cutwail.yaq |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Detected | |
| McAfee | Artemis!9FAEA65CFF61 |
| MAX | malware (ai score=84) |
| Malwarebytes | MachineLearning/Anomalous.100% |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/Malicious_Behavior.SBX |
| BitDefenderTheta | Gen:NN.ZexaF.36344.pOW@aKAoL1li |
| AVG | Win32:Trojan-gen |
| dead_host | 208.80.122.2:25 |
| dead_host | 204.79.197.212:25 |
| dead_host | 192.168.56.101:49595 |
| dead_host | 83.167.255.150:25 |
| dead_host | 192.168.56.101:49824 |
| dead_host | 221.132.33.88:25 |
| dead_host | 192.168.56.101:49530 |
| dead_host | 137.118.26.67:80 |
| dead_host | 76.223.35.103:25 |
| dead_host | 192.168.56.101:50061 |
| dead_host | 157.7.231.224:25 |
| dead_host | 63.251.106.25:25 |
| dead_host | 204.15.134.44:80 |
| dead_host | 35.172.94.1:25 |
| dead_host | 154.81.136.239:80 |
| dead_host | 64.125.133.18:80 |
| dead_host | 88.86.118.82:25 |
| dead_host | 192.168.56.101:49528 |
| dead_host | 172.67.158.251:25 |
| dead_host | 99.83.154.118:80 |
| dead_host | 3.64.163.50:25 |
| dead_host | 51.89.6.56:25 |
| dead_host | 5.134.4.115:25 |
| dead_host | 148.130.4.196:80 |
| dead_host | 62.122.170.171:25 |
| dead_host | 151.101.66.132:25 |
| dead_host | 99.83.190.102:25 |
| dead_host | 75.2.70.75:25 |
| dead_host | 52.71.57.184:25 |
| dead_host | 165.160.13.20:25 |
| dead_host | 211.13.196.162:25 |
| dead_host | 65.52.128.33:25 |
| dead_host | 192.168.56.101:49339 |
| dead_host | 208.100.26.245:25 |
| dead_host | 198.185.159.144:25 |
| dead_host | 52.211.245.146:25 |
| dead_host | 172.67.189.227:25 |
| dead_host | 23.227.38.32:25 |
| dead_host | 198.209.253.30:80 |
| dead_host | 34.102.136.180:25 |
| dead_host | 104.21.7.22:25 |
| dead_host | 148.72.176.26:25 |
| dead_host | 79.124.76.247:80 |
| dead_host | 185.106.129.180:25 |
| dead_host | 96.91.204.114:80 |
| dead_host | 31.177.80.70:25 |
| dead_host | 35.168.185.204:25 |
| dead_host | 192.168.56.101:50062 |
| dead_host | 38.111.255.201:25 |
| dead_host | 89.31.143.1:25 |