Log

12:40:07 Switches begin
12:40:07 Switches end

12:40:07 Starting v4.5.0.29
12:40:07 FBUserToken: '1190765804291424'
12:40:07 FBLocale: 'id_ID'
12:40:07 FBAttackId: '945112655602197'
12:40:07 User is Admin: YES
12:40:07 Vista or Higher: YES
12:40:07 IsWow64: NO
12:40:07 GetWorkDir: C:\Users\Caritas\AppData\Local\Temp\FBScanner_149902311
12:40:07 InitReport
12:40:07 SendReport_Init
12:40:07 Request query: 12:40:07 1443300579261932/malware_scanner12:40:07
12:40:07 Request body: 12:40:07 access_token=1443300579261932|cfedb1bd1113405e09
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_INIT"
,}&report_sig=BE40D6EE5B9F256F5E45F79F4BD0B156&fwd_ip=127.0.0.1&version=4.5.0.29
12:40:07
12:40:07 Response: 12:40:07 {"status":true}12:40:07
12:40:09 # product=FBAV
# version=8
# FBAV_user_token=1190765804291424
# FBAV_user_locale=id_ID
# FBAV_attack_id=945112655602197
# FBAV_status=0
# flags=2
# ESET.exe=4.5.0.29
# EOSSerial=248ff8955df27c43884741373629871e
# end=init
# utc_time=2016-04-26 05:40:07
# local_time=2016-04-26 12:40:07 (+0700, SE Asia Standard Time)
# country="United States"
# osver=6.1.7600 NT
12:40:09 INIT report sent to ESET
12:40:09 ExtractEsetsApi OK
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_PROGR
ESS","progress": 0,}&report_sig=2B743F651544C758D4C21A49EB3CF23E&fwd_ip=127.0.0.
1&version=4.5.0.2912:40:09
12:40:10 Updating
12:40:10 Update Init
12:40:10 Update Download
ESS","progress": 1,}&report_sig=3DC900E65697E57238D5A919F32752B0&fwd_ip=127.0.0.
1&version=4.5.0.2912:40:24
1&version=4.5.0.2912:40:35
1&version=4.5.0.2912:40:47
12:40:47 Switches begin

12:40:47 Switches end
12:40:47 Starting v4.5.0.29
12:40:47 FBUserToken: '1190765804291424'
12:40:47 FBLocale: 'id_ID'
12:40:47 FBAttackId: '945112655602197'
12:40:47 User is Admin: YES
12:40:47 Vista or Higher: YES
12:40:47 IsWow64: NO
12:40:47 GetWorkDir: C:\Users\Caritas\AppData\Local\Temp\FBScanner_541624627
12:40:47 InitReport
12:40:47 SendReport_Init
12:40:47 Response: 12:40:47 1443300579261932/malware_scanner12:40:47
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_INIT"
,}&report_sig=BE40D6EE5B9F256F5E45F79F4BD0B156&fwd_ip=127.0.0.1&version=4.5.0.29
12:40:47
# version=8
# FBAV_user_token=1190765804291424
# FBAV_attack_id=945112655602197
# FBAV_status=0
# flags=2
# ESET.exe=4.5.0.29
# end=init
# utc_time=2016-04-26 05:40:47
# osver=6.1.7600 NT
12:40:50 INIT report sent to ESET
12:40:50 ExtractEsetsApi OK
1&version=4.5.0.2912:40:51
12:40:51 Updating
12:40:51 Update Init
12:40:53 Update Download
ESS","progress": 2,}&report_sig=75A0CE906A36623A73C4ED76B6A0217A&fwd_ip=127.0.0.
1&version=4.5.0.2912:41:00
1&version=4.5.0.2912:41:09
1&version=4.5.0.2912:41:13

ESS","progress": 3,}&report_sig=3F8375609AB7F90439B42912269A53FD&fwd_ip=127.0.0.
1&version=4.5.0.2912:41:24
1&version=4.5.0.2912:41:25
1&version=4.5.0.2912:41:34
1&version=4.5.0.2912:41:37
ESS","progress": 4,}&report_sig=4BFD76DD577F0A652BC5A263F1463DD6&fwd_ip=127.0.0.
1&version=4.5.0.2912:41:47
1&version=4.5.0.2912:41:48
1&version=4.5.0.2912:41:59
1&version=4.5.0.2912:42:02
ESS","progress": 5,}&report_sig=B83D224A31F8D89576CEF0F835090260&fwd_ip=127.0.0.
1&version=4.5.0.2912:42:11
1&version=4.5.0.2912:42:15

1&version=4.5.0.2912:42:21
1&version=4.5.0.2912:42:27
ESS","progress": 6,}&report_sig=6549E52B04F5AEF9EC9A5F5686A2AE29&fwd_ip=127.0.0.
1&version=4.5.0.2912:42:33
1&version=4.5.0.2912:42:39
1&version=4.5.0.2912:42:44
1&version=4.5.0.2912:42:51
ESS","progress": 7,}&report_sig=FBACAFCD06E447A3452AD6479A1B4251&fwd_ip=127.0.0.
1&version=4.5.0.2912:42:54
1&version=4.5.0.2912:43:01
1&version=4.5.0.2912:43:06
1&version=4.5.0.2912:43:11

ESS","progress": 8,}&report_sig=41DE667BE4B40B28EB51B069C37E545B&fwd_ip=127.0.0.
1&version=4.5.0.2912:43:20
1&version=4.5.0.2912:43:24
1&version=4.5.0.2912:43:30
1&version=4.5.0.2912:43:35
ESS","progress": 9,}&report_sig=4240B5BB56D2736A78A996E9141278B3&fwd_ip=127.0.0.
1&version=4.5.0.2912:43:45
1&version=4.5.0.2912:43:48
1&version=4.5.0.2912:43:59
1&version=4.5.0.2912:43:59 {"status":true}12:43:59
ESS","progress": 10,}&report_sig=AC171CBE639BC332E608EF298CB67001&fwd_ip=127.0.0
.1&version=4.5.0.2912:44:11
1&version=4.5.0.2912:44:12

.1&version=4.5.0.2912:44:24
1&version=4.5.0.2912:44:25
.1&version=4.5.0.2912:44:36
1&version=4.5.0.2912:44:36
ESS","progress": 11,}&report_sig=BCDB4B1E044BB807B717AF2307EE0CF5&fwd_ip=127.0.0
.1&version=4.5.0.2912:44:49
1&version=4.5.0.2912:44:51
.1&version=4.5.0.2912:45:03
1&version=4.5.0.2912:45:03
ESS","progress": 12,}&report_sig=EBDD954BFD00365A56399C4CE273139A&fwd_ip=127.0.0
.1&version=4.5.0.2912:45:14
1&version=4.5.0.2912:45:17

.1&version=4.5.0.2912:45:30
.1&version=4.5.0.2912:45:31
ESS","progress": 13,}&report_sig=866AF33B0280EA61B17A3A36D3449D78&fwd_ip=127.0.0
.1&version=4.5.0.2912:45:40
.1&version=4.5.0.2912:45:44
.1&version=4.5.0.2912:45:50
.1&version=4.5.0.2912:45:56
ESS","progress": 14,}&report_sig=65F462285C29B03D265EE11A1AC06AB6&fwd_ip=127.0.0
.1&version=4.5.0.2912:46:00
.1&version=4.5.0.2912:46:07
.1&version=4.5.0.2912:46:12
.1&version=4.5.0.2912:46:17

ESS","progress": 15,}&report_sig=214BAC5B4A2FF8500EE94FF24946FD5C&fwd_ip=127.0.0
.1&version=4.5.0.2912:46:23
.1&version=4.5.0.2912:46:29
.1&version=4.5.0.2912:46:38
.1&version=4.5.0.2912:46:40
.1&version=4.5.0.2912:46:49
.1&version=4.5.0.2912:46:51
ESS","progress": 16,}&report_sig=88B6B60B4797206A650127491C5C7B8E&fwd_ip=127.0.0
.1&version=4.5.0.2912:47:01
.1&version=4.5.0.2912:47:02
.1&version=4.5.0.2912:47:13
.1&version=4.5.0.2912:47:21

.1&version=4.5.0.2912:47:23
.1&version=4.5.0.2912:47:36
.1&version=4.5.0.2912:47:36
.1&version=4.5.0.2912:47:49
ESS","progress": 17,}&report_sig=A5A9BE6F2A1A54CB1A36A5DCE822AC6D&fwd_ip=127.0.0
.1&version=4.5.0.2912:47:50
.1&version=4.5.0.2912:48:05
.1&version=4.5.0.2912:48:12
.1&version=4.5.0.2912:48:19
ESS","progress": 18,}&report_sig=F03CDC54B63E3A0EDB6743119E6F2AFD&fwd_ip=127.0.0
.1&version=4.5.0.2912:48:26
.1&version=4.5.0.2912:48:29

.1&version=4.5.0.2912:48:36
.1&version=4.5.0.2912:48:39
.1&version=4.5.0.2912:48:49
.1&version=4.5.0.2912:48:49
.1&version=4.5.0.2912:49:00
.1&version=4.5.0.2912:49:04
.1&version=4.5.0.2912:49:14
ESS","progress": 19,}&report_sig=A1EE68F783791D7539778E705CD79F6A&fwd_ip=127.0.0
.1&version=4.5.0.2912:49:16
.1&version=4.5.0.2912:49:26
.1&version=4.5.0.2912:49:37

.1&version=4.5.0.2912:49:59
ESS","progress": 20,}&report_sig=BCCE58E7B42B5B9894C1B0A33C679EB8&fwd_ip=127.0.0
.1&version=4.5.0.2912:50:24
12:50:25 Update Finalize
12:50:25 Call m_esets_charon_send
12:50:25 Call m_esets_charon_destroy
.1&version=4.5.0.2912:50:26
12:50:26 Updated modules version: 29241
# version=8
# FBAV_user_token=1190765804291424
# FBAV_attack_id=945112655602197
# FBAV_status=0
# flags=2
# ESET.exe=4.5.0.29
# end=Updated
# utc_time=2016-04-26 05:40:07
# osver=6.1.7600 NT
12:50:28 UPDATED report sent to ESET
12:50:28 Initialize Scan
.1&version=4.5.0.2912:50:45
12:50:46 Call m_esets_charon_setup_create
12:50:46 Call m_esets_charon_create
12:50:46 m_esets_charon_create OK
12:50:46 Call m_esets_charon_start_send_thread
12:50:46 Call m_esets_charon_setup_set
12:50:46 m_esets_charon_setup_set OK
12:50:46 Scan
12:50:46 Scanner engine: 29241
.1&version=4.5.0.2912:50:52
.1&version=4.5.0.2912:51:36
12:51:36 Update Finalize
.1&version=4.5.0.2912:51:37
12:51:38 Updated modules version: 29241
# version=8
# FBAV_user_token=1190765804291424
# FBAV_attack_id=945112655602197
# FBAV_status=0
# flags=2
# ESET.exe=4.5.0.29
# end=Updated
# utc_time=2016-04-26 05:40:47
# osver=6.1.7600 NT
12:51:42 UPDATED report sent to ESET
12:51:42 Initialize Scan
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_DATA"
,"event_type": "DETECTED","sample_name": "a variant of Win32/Toolbar.Linkury.AQ
potentially unwanted application","sample_id": "a variant of Win32/Toolbar.Linku
ry.AQ potentially unwanted application","sample_hashes": {"SHA1": "0000000000000
000000000000000000000000000",},}&report_sig=AC9D8E98A6934546942E145F0C90F9B7&fwd
_ip=127.0.0.1&version=4.5.0.2912:51:49
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Toolbar.Link
ury.AQ potentially unwanted application","sample_id": "a variant of Win32/Toolba
r.Linkury.AQ potentially unwanted application","sample_hashes": {"SHA1": "000000
0000000000000000000000000000000000",},}&report_sig=45298B5710C190DED3A175CED2098
F2B&fwd_ip=127.0.0.1&version=4.5.0.2912:51:50
ESS","progress": 22,}&report_sig=6D15D3E1FF90784432A863B9D218F145&fwd_ip=127.0.0
.1&version=4.5.0.2912:51:51
12:51:57 Call m_esets_charon_setup_create
12:51:57 Call m_esets_charon_create
12:51:57 m_esets_charon_create OK
12:51:57 Call m_esets_charon_start_send_thread
12:51:57 Call m_esets_charon_setup_set
12:51:57 m_esets_charon_setup_set OK
12:51:57 Scan

ESS","progress": 28,}&report_sig=683999D8CE197C185692803FAF784D60&fwd_ip=127.0.0
.1&version=4.5.0.2912:52:07
.1&version=4.5.0.2912:52:19
.1&version=4.5.0.2912:52:27
.1&version=4.5.0.2912:52:37
.1&version=4.5.0.2912:52:47
ry.AQ potentially unwanted application","sample_hashes": {"SHA1": "0000000000000
000000000000000000000000000",},}&report_sig=AC9D8E98A6934546942E145F0C90F9B7&fwd
_ip=127.0.0.1&version=4.5.0.2912:52:51
r.Linkury.AQ potentially unwanted application","sample_hashes": {"SHA1": "000000
0000000000000000000000000000000000",},}&report_sig=45298B5710C190DED3A175CED2098
F2B&fwd_ip=127.0.0.1&version=4.5.0.2912:52:52
ESS","progress": 22,}&report_sig=6D15D3E1FF90784432A863B9D218F145&fwd_ip=127.0.0
.1&version=4.5.0.2912:52:52
.1&version=4.5.0.2912:52:59

.1&version=4.5.0.2912:53:03
.1&version=4.5.0.2912:53:08
.1&version=4.5.0.2912:53:13
.1&version=4.5.0.2912:53:18
.1&version=4.5.0.2912:53:24
.1&version=4.5.0.2912:53:28
.1&version=4.5.0.2912:53:33
12:53:43 Request query: 12:53:43 Request query: 12:53:43
12:53:43
12:53:43 access_token=1443300579261932|cfedb1bd1113405e097902a8602d76ed&user_tok
en=1190765804291424&report={"report_type": "SCANNER_PROGRESS","progress": 28,}&r
eport_sig=683999D8CE197C185692803FAF784D60&fwd_ip=127.0.0.1&version=4.5.0.2912:5
3:43 access_token=1443300579261932|cfedb1bd1113405e097902a8602d76ed&user_token=1
190765804291424&report={"report_type": "SCANNER_PROGRESS","progress": 28,}&repor
t_sig=683999D8CE197C185692803FAF784D60&fwd_ip=127.0.0.1&version=4.5.0.2912:53:43
,"event_type": "DETECTED","sample_name": "a variant of Win32/Systweak.A potentia
lly unwanted application","sample_id": "a variant of Win32/Systweak.A potentiall
y unwanted application","sample_hashes": {"SHA1": "EEF8ED764B98B0701ED99C6209CE7
866E265218F",},}&report_sig=B057A6F9F78A196042C4BA1A5C32216D&fwd_ip=127.0.0.1&ve
rsion=4.5.0.2912:53:45
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Systweak.A p
otentially unwanted application","sample_id": "a variant of Win32/Systweak.A pot
entially unwanted application","sample_hashes": {"SHA1": "EEF8ED764B98B0701ED99C
6209CE7866E265218F",},}&report_sig=C0D5B5F2CF06C929214993DD4F82DEE2&fwd_ip=127.0
.0.1&version=4.5.0.2912:53:45
12:53:53 Request query: 12:53:53 Request query: 12:53:53 1443300579261932/malwar
e_scanner12:53:53
.1&version=4.5.0.2912:53:53
.1&version=4.5.0.2912:54:00
.1&version=4.5.0.2912:54:03
.1&version=4.5.0.2912:54:11
.1&version=4.5.0.2912:54:13
.1&version=4.5.0.2912:54:20
ESS","progress": 31,}&report_sig=15C59BA62A56DADB58E6965C0FDCCEB6&fwd_ip=127.0.0
.1&version=4.5.0.2912:54:25
ESS","progress": 47,}&report_sig=1C551C5EEA8098D9D2626A4BB51F0FE4&fwd_ip=127.0.0
.1&version=4.5.0.2912:54:35
12:54:37 1443300579261932/malware_scanner12:54:37
.1&version=4.5.0.2912:54:37
12:54:38 Response: 12:54:38 Response: 12:54:38 {"status":true}12:54:38
,"event_type": "DETECTED","sample_name": "a variant of Win32/Toolbar.Linkury.AN
ry.AN potentially unwanted application","sample_hashes": {"SHA1": "D4ED1170BD3FD
3E580FBEC6DF7BD4744DCA897EF",},}&report_sig=A4D3A90F2694A881371CC5EFAC63ECAB&fwd
_ip=127.0.0.1&version=4.5.0.2912:54:38
ry.AQ potentially unwanted application","sample_hashes": {"SHA1": "41B1902D55396
A636D8827B895057C2C381A9237",},}&report_sig=9C856D334A7F6E400C081650E74DB487&fwd
_ip=127.0.0.1&version=4.5.0.2912:54:39
ury.AN potentially unwanted application","sample_id": "a variant of Win32/Toolba
r.Linkury.AN potentially unwanted application","sample_hashes": {"SHA1": "D4ED11
70BD3FD3E580FBEC6DF7BD4744DCA897EF",},}&report_sig=7C7882B8D1C91BD0906A913ADFB46
F7F&fwd_ip=127.0.0.1&version=4.5.0.2912:54:39
12:54:39 Response: 12:54:39 access_token=1443300579261932|cfedb1bd1113405e097902
a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_DATA","ev
ent_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Toolbar.Linkury.
AQ potentially unwanted application","sample_id": "a variant of Win32/Toolbar.Li
nkury.AQ potentially unwanted application","sample_hashes": {"SHA1": "41B1902D55
396A636D8827B895057C2C381A9237",},}&report_sig=295557245A2A7F65F6DFA4ED5F7AB98F&
fwd_ip=127.0.0.1&version=4.5.0.2912:54:39
ury.L potentially unwanted application","sample_id": "a variant of Win64/Toolbar
.Linkury.L potentially unwanted application","sample_hashes": {"SHA1": "B1E44B3A
BFDA51BAC57E8FF811776A1D658AB99D",},}&report_sig=60FFB4E06DDBD4047D6EF3DA9B7CCED
7&fwd_ip=127.0.0.1&version=4.5.0.2912:54:40
.1&version=4.5.0.2912:54:45

.1&version=4.5.0.2912:54:47
.1&version=4.5.0.2912:54:54
.1&version=4.5.0.2912:54:57
.1&version=4.5.0.2912:55:04
.1&version=4.5.0.2912:55:07
.1&version=4.5.0.2912:55:14
.1&version=4.5.0.2912:55:17
,"event_type": "DETECTED","sample_name": "a variant of Win32/Toolbar.Linkury.AJ
ry.AJ potentially unwanted application","sample_hashes": {"SHA1": "78EBFF9807737
01AED1ECFB205B2BA5488F65AEF",},}&report_sig=FAE8C3CEBE793516508948ED9D9332A4&fwd
_ip=127.0.0.1&version=4.5.0.2912:55:22
ury.AJ potentially unwanted application","sample_id": "a variant of Win32/Toolba
r.Linkury.AJ potentially unwanted application","sample_hashes": {"SHA1": "78EBFF
980773701AED1ECFB205B2BA5488F65AEF",},}&report_sig=6AEA050F32D16329858D7E61DAF76
D52&fwd_ip=127.0.0.1&version=4.5.0.2912:55:23

.1&version=4.5.0.2912:55:24
,"event_type": "DETECTED","sample_name": "a variant of Win32/Toolbar.Linkury.AJ
ry.AJ potentially unwanted application","sample_hashes": {"SHA1": "78EBFF9807737
01AED1ECFB205B2BA5488F65AEF",},}&report_sig=FAE8C3CEBE793516508948ED9D9332A4&fwd
_ip=127.0.0.1&version=4.5.0.2912:55:24
ury.AJ potentially unwanted application","sample_id": "a variant of Win32/Toolba
r.Linkury.AJ potentially unwanted application","sample_hashes": {"SHA1": "78EBFF
980773701AED1ECFB205B2BA5488F65AEF",},}&report_sig=6AEA050F32D16329858D7E61DAF76
D52&fwd_ip=127.0.0.1&version=4.5.0.2912:55:25
.1&version=4.5.0.2912:55:27
.1&version=4.5.0.2912:55:39
.1&version=4.5.0.2912:55:43
.1&version=4.5.0.2912:55:49
_ip=127.0.0.1&version=4.5.0.2912:55:53

_ip=127.0.0.1&version=4.5.0.2912:55:53
r.Linkury.AQ potentially unwanted application","sample_hashes": {"SHA1": "41B190
2D55396A636D8827B895057C2C381A9237",},}&report_sig=295557245A2A7F65F6DFA4ED5F7AB
98F&fwd_ip=127.0.0.1&version=4.5.0.2912:55:53
98F&fwd_ip=127.0.0.1&version=4.5.0.2912:55:53
.1&version=4.5.0.2912:55:54
,"event_type": "DETECTED","sample_name": "a variant of Win32/TrojanDropper.Addro
p.AH trojan","sample_id": "a variant of Win32/TrojanDropper.Addrop.AH trojan","s
ample_hashes": {"SHA1": "25E0FC7E2CEAFE842A14396984F5BF9FFBEB3D5B",},}&report_si
g=FC2569EFCC192CDB436CFD42833D7E96&fwd_ip=127.0.0.1&version=4.5.0.2912:55:54
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/TrojanDroppe
r.Addrop.AH trojan","sample_id": "a variant of Win32/TrojanDropper.Addrop.AH tro
jan","sample_hashes": {"SHA1": "25E0FC7E2CEAFE842A14396984F5BF9FFBEB3D5B",},}&re
port_sig=8F20C461BC53AE4B36AFA201A3C30141&fwd_ip=127.0.0.1&version=4.5.0.2912:55
:55
,"event_type": "DETECTED","sample_name": "a variant of Win64/Toolbar.Linkury.L p
otentially unwanted application","sample_id": "a variant of Win64/Toolbar.Linkur
y.L potentially unwanted application","sample_hashes": {"SHA1": "B1E44B3ABFDA51B
AC57E8FF811776A1D658AB99D",},}&report_sig=D323D7F2F9EB30228C3A12CD017E7EE8&fwd_i
p=127.0.0.1&version=4.5.0.2912:55:56

7&fwd_ip=127.0.0.1&version=4.5.0.2912:55:57
_ip=127.0.0.1&version=4.5.0.2912:55:57
98F&fwd_ip=127.0.0.1&version=4.5.0.2912:55:57
_ip=127.0.0.1&version=4.5.0.2912:55:58 1443300579261932/malware_scanner12:55:58
,"event_type": "DETECTED","sample_name": "a variant of Win64/Toolbar.Linkury.L p
otentially unwanted application","sample_id": "a variant of Win64/Toolbar.Linkur
y.L potentially unwanted application","sample_hashes": {"SHA1": "B1E44B3ABFDA51B
AC57E8FF811776A1D658AB99D",},}&report_sig=D323D7F2F9EB30228C3A12CD017E7EE8&fwd_i
p=127.0.0.1&version=4.5.0.2912:55:58
7&fwd_ip=127.0.0.1&version=4.5.0.2912:55:59
98F&fwd_ip=127.0.0.1&version=4.5.0.2912:55:59
.1&version=4.5.0.2912:55:59
ample_hashes": {"SHA1": "864AA78CD746EAA36A4BF9BA761FCA87F1AE47FA",},}&report_si
g=313B29EAD8078A2BF1BF05074320C36D&fwd_ip=127.0.0.1&version=4.5.0.2912:56:01
ample_hashes": {"SHA1": "864AA78CD746EAA36A4BF9BA761FCA87F1AE47FA",},}&report_si
g=313B29EAD8078A2BF1BF05074320C36D&fwd_ip=127.0.0.1&version=4.5.0.2912:56:01
jan","sample_hashes": {"SHA1": "864AA78CD746EAA36A4BF9BA761FCA87F1AE47FA",},}&re
port_sig=0D0310C460A1957AC70B77DC9BA2E339&fwd_ip=127.0.0.1&version=4.5.0.2912:56
:01
jan","sample_hashes": {"SHA1": "864AA78CD746EAA36A4BF9BA761FCA87F1AE47FA",},}&re
port_sig=0D0310C460A1957AC70B77DC9BA2E339&fwd_ip=127.0.0.1&version=4.5.0.2912:56
:02
12:56:03 Response: 12:56:03 Request query: 12:56:03 1443300579261932/malware_sca
nner12:56:03
,"event_type": "DETECTED","sample_name": "Win32/Adware.ConvertAd.AGE application
","sample_id": "Win32/Adware.ConvertAd.AGE application","sample_hashes": {"SHA1"
: "C6E310F6E780160B817AF2F7CE3D416BB800585F",},}&report_sig=C8F905AB67B06CA72167
1914FC841A26&fwd_ip=127.0.0.1&version=4.5.0.2912:56:03
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/Adware.ConvertAd.AGE appl
ication","sample_id": "Win32/Adware.ConvertAd.AGE application","sample_hashes":
{"SHA1": "C6E310F6E780160B817AF2F7CE3D416BB800585F",},}&report_sig=74B9DA9165842
4037CB20CCB67153C1C&fwd_ip=127.0.0.1&version=4.5.0.2912:56:04
,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.AF
W application","sample_id": "a variant of Win32/Adware.ConvertAd.AFW application
","sample_hashes": {"SHA1": "5CA718AEC1D8437F5EA991F1ABE1917F26F9EBBE",},}&repor
t_sig=48F0221675C08331D9E6A2F756702476&fwd_ip=127.0.0.1&version=4.5.0.2912:56:04
Response: 12:56:05 {"status":true}12:56:05

,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Adware.Conve
rtAd.AFW application","sample_id": "a variant of Win32/Adware.ConvertAd.AFW appl
ication","sample_hashes": {"SHA1": "5CA718AEC1D8437F5EA991F1ABE1917F26F9EBBE",},
}&report_sig=F4571E2F78EECED8CBCDCAA07B07CBEA&fwd_ip=127.0.0.1&version=4.5.0.291
2:56:05
ESS","progress": 50,}&report_sig=05980A3532EB3CECCA06D12560BE0BD8&fwd_ip=127.0.0
.1&version=4.5.0.2912:56:06
.1&version=4.5.0.2912:56:14
.1&version=4.5.0.2912:56:24
.1&version=4.5.0.2912:56:36
.1&version=4.5.0.2912:56:44
.1&version=4.5.0.2912:56:46
.1&version=4.5.0.2912:57:03
.1&version=4.5.0.2912:57:05

.1&version=4.5.0.2912:57:13
.1&version=4.5.0.2912:57:15
.1&version=4.5.0.2912:57:24
.1&version=4.5.0.2912:57:25
.1&version=4.5.0.2912:57:34
.1&version=4.5.0.2912:57:35
.1&version=4.5.0.2912:58:00
.1&version=4.5.0.2912:58:06
.1&version=4.5.0.2912:58:10
.1&version=4.5.0.2912:58:11

.1&version=4.5.0.2912:58:20
.1&version=4.5.0.2912:58:21
.1&version=4.5.0.2912:58:30
.1&version=4.5.0.2912:58:31
.1&version=4.5.0.2912:58:40
.1&version=4.5.0.2912:58:41
.1&version=4.5.0.2912:58:50
.1&version=4.5.0.2912:58:51
.1&version=4.5.0.2912:59:00
.1&version=4.5.0.2912:59:01

.1&version=4.5.0.2912:59:10
.1&version=4.5.0.2912:59:11
.1&version=4.5.0.2912:59:20
.1&version=4.5.0.2912:59:21
e_scanner12:59:32
.1&version=4.5.0.2912:59:32
,"event_type": "DETECTED","sample_name": "a variant of Win32/ELEX.HI potentially
unwanted application","sample_id": "a variant of Win32/ELEX.HI potentially unwa
nted application","sample_hashes": {"SHA1": "9525E00A568430D6DC0EADD11A8D7F2D8D5
254D9",},}&report_sig=D45B7D4BA751615EF02ACFE7E2807D9E&fwd_ip=127.0.0.1&version=
4.5.0.2912:59:33 Request query: 12:59:33 1443300579261932/malware_scanner12:59:3
3
,"event_type": "DETECTED","sample_name": "a variant of Win32/ELEX.HI potentially
unwanted application","sample_id": "a variant of Win32/ELEX.HI potentially unwa
nted application","sample_hashes": {"SHA1": "9525E00A568430D6DC0EADD11A8D7F2D8D5
254D9",},}&report_sig=D45B7D4BA751615EF02ACFE7E2807D9E&fwd_ip=127.0.0.1&version=
4.5.0.2912:59:33
12:59:34 Request body: 12:59:34 Request query: 12:59:34
12:59:34
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/ELEX.HI pote
ntially unwanted application","sample_id": "a variant of Win32/ELEX.HI potential
ly unwanted application","sample_hashes": {"SHA1": "9525E00A568430D6DC0EADD11A8D
7F2D8D5254D9",},}&report_sig=5D26D51E29BB33EA47FC3BD96F272F1D&fwd_ip=127.0.0.1&v
ersion=4.5.0.2912:59:34
12:59:34 Response: 12:59:34 Response: 12:59:34
12:59:34

,"event_type": "DETECTED","sample_name": "Win32/Adware.Imali.J application","sam
ple_id": "Win32/Adware.Imali.J application","sample_hashes": {"SHA1": "22BC0AAEB
F83CAB61F2247253E92649916611AB2",},}&report_sig=0ADDE1592E16DB4AD10D6C1E84731ACB
&fwd_ip=127.0.0.1&version=4.5.0.2912:59:34
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/Adware.Imali.J applicatio
n","sample_id": "Win32/Adware.Imali.J application","sample_hashes": {"SHA1": "22
BC0AAEBF83CAB61F2247253E92649916611AB2",},}&report_sig=D70C4A757F80573E2457EF1AB
C5534D3&fwd_ip=127.0.0.1&version=4.5.0.2912:59:35
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/Adware.Imali.J applicatio
n","sample_id": "Win32/Adware.Imali.J application","sample_hashes": {"SHA1": "22
BC0AAEBF83CAB61F2247253E92649916611AB2",},}&report_sig=D70C4A757F80573E2457EF1AB
C5534D3&fwd_ip=127.0.0.1&version=4.5.0.2912:59:35
,"event_type": "DETECTED","sample_name": "a variant of Win32/Amonetize.EA potent
ially unwanted application","sample_id": "a variant of Win32/Amonetize.EA potent
ially unwanted application","sample_hashes": {"SHA1": "67F85EA92F0350937D824D1C3
39C63522CC0571D",},}&report_sig=E0D989DA482677B901F43C4D8B83BACA&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:00
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Amonetize.EA
potentially unwanted application","sample_id": "a variant of Win32/Amonetize.EA
potentially unwanted application","sample_hashes": {"SHA1": "67F85EA92F0350937D
824D1C339C63522CC0571D",},}&report_sig=B7E12B5ED305E0E02F64E1AFDD0C7FAA&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:01
.1&version=4.5.0.2913:00:01
ially unwanted application","sample_hashes": {"SHA1": "67F85EA92F0350937D824D1C3
39C63522CC0571D",},}&report_sig=E0D989DA482677B901F43C4D8B83BACA&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:02
potentially unwanted application","sample_hashes": {"SHA1": "67F85EA92F0350937D
824D1C339C63522CC0571D",},}&report_sig=B7E12B5ED305E0E02F64E1AFDD0C7FAA&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:02
.1&version=4.5.0.2913:00:02
.1&version=4.5.0.2913:00:12
.1&version=4.5.0.2913:00:13
ially unwanted application","sample_hashes": {"SHA1": "305F2404AA29D4635B1381952
3B065156A2D5B57",},}&report_sig=BBF2D6AA993F82CE4A9E0BCEF2D1578F&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:30
potentially unwanted application","sample_hashes": {"SHA1": "305F2404AA29D4635B
13819523B065156A2D5B57",},}&report_sig=3860733EBBD513CE8635361AF72A3505&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:31
.1&version=4.5.0.2913:00:32
ially unwanted application","sample_hashes": {"SHA1": "305F2404AA29D4635B1381952
3B065156A2D5B57",},}&report_sig=BBF2D6AA993F82CE4A9E0BCEF2D1578F&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:32
potentially unwanted application","sample_hashes": {"SHA1": "305F2404AA29D4635B
13819523B065156A2D5B57",},}&report_sig=3860733EBBD513CE8635361AF72A3505&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:33
.1&version=4.5.0.2913:00:33
ially unwanted application","sample_hashes": {"SHA1": "37AFD060C0346196BD6828794
3ABCCFB04D7A392",},}&report_sig=01E8DAC90CA9E309DD15D7377C0929EA&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:51
potentially unwanted application","sample_hashes": {"SHA1": "37AFD060C0346196BD
68287943ABCCFB04D7A392",},}&report_sig=86F32C1784A13E93F72685A47CC93B9A&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:51
13:00:52
en=1190765804291424&report={"report_type": "SCANNER_DATA","event_type": "DETECTE
D","sample_name": "a variant of Win32/Amonetize.EA potentially unwanted applicat
ion","sample_id": "a variant of Win32/Amonetize.EA potentially unwanted applicat
ion","sample_hashes": {"SHA1": "37AFD060C0346196BD68287943ABCCFB04D7A392",},}&re
port_sig=01E8DAC90CA9E309DD15D7377C0929EA&fwd_ip=127.0.0.1&version=4.5.0.2913:00
:52 access_token=1443300579261932|cfedb1bd1113405e097902a8602d76ed&user_token=11
90765804291424&report={"report_type": "SCANNER_PROGRESS","progress": 50,}&report
_sig=05980A3532EB3CECCA06D12560BE0BD8&fwd_ip=127.0.0.1&version=4.5.0.2913:00:52
13:00:53 Response: 13:00:53 {"status":true}13:00:53 {"status":true}13:00:53 Requ
est query: 13:00:53 1443300579261932/malware_scanner13:00:53
potentially unwanted application","sample_hashes": {"SHA1": "37AFD060C0346196BD
68287943ABCCFB04D7A392",},}&report_sig=86F32C1784A13E93F72685A47CC93B9A&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:53
.1&version=4.5.0.2913:00:53
,"event_type": "DETECTED","sample_name": "a variant of Win32/OutBrowse.CL potent

ially unwanted application","sample_id": "a variant of Win32/OutBrowse.CL potent
ially unwanted application","sample_hashes": {"SHA1": "7503B03CA35F0EF3647EC5A9F
5B6D5B7903DB387",},}&report_sig=74713DBFC4A256BD8FB4FA5906784D90&fwd_ip=127.0.0.
1&version=4.5.0.2913:00:54
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/OutBrowse.CL
potentially unwanted application","sample_id": "a variant of Win32/OutBrowse.CL
potentially unwanted application","sample_hashes": {"SHA1": "7503B03CA35F0EF364
7EC5A9F5B6D5B7903DB387",},}&report_sig=657658970724C14E1507B3CA9893C7C4&fwd_ip=1
27.0.0.1&version=4.5.0.2913:00:54
.1&version=4.5.0.2913:01:02
.1&version=4.5.0.2913:01:03
.1&version=4.5.0.2913:01:12
.1&version=4.5.0.2913:01:15
.1&version=4.5.0.2913:01:22
,"event_type": "DETECTED","sample_name": "a variant of Win32/HideBaid.L potentia
lly unwanted application","sample_id": "a variant of Win32/HideBaid.L potentiall
y unwanted application","sample_hashes": {"SHA1": "D7A2453F45614CBA61790F9EF04E5
48667724EDA",},}&report_sig=15F07768F139374EBDEBE8B6521A4916&fwd_ip=127.0.0.1&ve
rsion=4.5.0.2913:01:26
y unwanted application","sample_hashes": {"SHA1": "D7A2453F45614CBA61790F9EF04E5
48667724EDA",},}&report_sig=15F07768F139374EBDEBE8B6521A4916&fwd_ip=127.0.0.1&ve
rsion=4.5.0.2913:01:26
13:01:27
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/HideBaid.L p
otentially unwanted application","sample_id": "a variant of Win32/HideBaid.L pot
entially unwanted application","sample_hashes": {"SHA1": "D7A2453F45614CBA61790F
9EF04E548667724EDA",},}&report_sig=49CB2D013F0EB8C6236D0A986364AFAB&fwd_ip=127.0
.0.1&version=4.5.0.2913:01:27
13:01:27 Response: 13:01:27 {"status":true}13:01:27 Response: 13:01:27 {"status"
:true}13:01:27
.1&version=4.5.0.2913:01:27
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Adware.Imali.C appli
cation","sample_id": "a variant of MSIL/Adware.Imali.C application","sample_hash
es": {"SHA1": "F0CF92C5E55FF53C63523632D97F6B62688B4D50",},}&report_sig=9A1603B6
69F79FA2F140606F5060E62B&fwd_ip=127.0.0.1&version=4.5.0.2913:01:27
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Adware.Imali.
C application","sample_id": "a variant of MSIL/Adware.Imali.C application","samp
le_hashes": {"SHA1": "F0CF92C5E55FF53C63523632D97F6B62688B4D50",},}&report_sig=D
7086BBF804F84699835BB995BE11379&fwd_ip=127.0.0.1&version=4.5.0.2913:01:28
.1&version=4.5.0.2913:01:32
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Kryptik.EWB trojan",
"sample_id": "a variant of MSIL/Kryptik.EWB trojan","sample_hashes": {"SHA1": "3
53DB5062D5EF823888949B62C1D563AB6D47301",},}&report_sig=73DCBDA1F61BB6ECBEE4D13B
DA7F8302&fwd_ip=127.0.0.1&version=4.5.0.2913:01:34
13:01:35

,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Kryptik.EWB t
rojan","sample_id": "a variant of MSIL/Kryptik.EWB trojan","sample_hashes": {"SH
A1": "353DB5062D5EF823888949B62C1D563AB6D47301",},}&report_sig=39A56A05F9A4445A1
A5166B5B5C329FA&fwd_ip=127.0.0.1&version=4.5.0.2913:01:35
,"event_type": "DETECTED","sample_name": "a variant of Win32/Amonetize.AT potent
ially unwanted application","sample_id": "a variant of Win32/Amonetize.AT potent
ially unwanted application","sample_hashes": {"SHA1": "DFB3229431D84205BAF05E00B
EB3E04727CEC776",},}&report_sig=E630AA9BB4BB2D88EDF4FE3B9D4CD07E&fwd_ip=127.0.0.
1&version=4.5.0.2913:01:55
,"event_type": "DETECTED","sample_name": "a variant of Win32/Amonetize.AT potent
ially unwanted application","sample_id": "a variant of Win32/Amonetize.AT potent
ially unwanted application","sample_hashes": {"SHA1": "DFB3229431D84205BAF05E00B
EB3E04727CEC776",},}&report_sig=E630AA9BB4BB2D88EDF4FE3B9D4CD07E&fwd_ip=127.0.0.
1&version=4.5.0.2913:01:55
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Amonetize.AT
potentially unwanted application","sample_id": "a variant of Win32/Amonetize.AT
potentially unwanted application","sample_hashes": {"SHA1": "DFB3229431D84205BA
F05E00BEB3E04727CEC776",},}&report_sig=C6F7D0D17CBAFA9AB0F485441A1024D4&fwd_ip=1
27.0.0.1&version=4.5.0.2913:01:55
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Amonetize.AT
potentially unwanted application","sample_id": "a variant of Win32/Amonetize.AT
potentially unwanted application","sample_hashes": {"SHA1": "DFB3229431D84205BA
F05E00BEB3E04727CEC776",},}&report_sig=C6F7D0D17CBAFA9AB0F485441A1024D4&fwd_ip=1
27.0.0.1&version=4.5.0.2913:01:55
13:01:56 Request query: 13:01:56 access_token=1443300579261932|cfedb1bd1113405e0
97902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_PROG
RESS","progress": 50,}&report_sig=05980A3532EB3CECCA06D12560BE0BD8&fwd_ip=127.0.
0.1&version=4.5.0.2913:01:56
.1&version=4.5.0.2913:01:56
ially unwanted application","sample_hashes": {"SHA1": "F8A38007B0EF1C71C08D261CE
87AF11DA7E286FF",},}&report_sig=29D15B32CC4C862FC7C57E43F7EFF4DC&fwd_ip=127.0.0.
1&version=4.5.0.2913:01:57
ially unwanted application","sample_hashes": {"SHA1": "F8A38007B0EF1C71C08D261CE
87AF11DA7E286FF",},}&report_sig=29D15B32CC4C862FC7C57E43F7EFF4DC&fwd_ip=127.0.0.
1&version=4.5.0.2913:01:57
potentially unwanted application","sample_hashes": {"SHA1": "F8A38007B0EF1C71C0
8D261CE87AF11DA7E286FF",},}&report_sig=3FC9D6AA09EB2F09FFCAB76B07709DB7&fwd_ip=1
27.0.0.1&version=4.5.0.2913:01:58
potentially unwanted application","sample_hashes": {"SHA1": "F8A38007B0EF1C71C0
8D261CE87AF11DA7E286FF",},}&report_sig=3FC9D6AA09EB2F09FFCAB76B07709DB7&fwd_ip=1
27.0.0.1&version=4.5.0.2913:01:58
,"event_type": "DETECTED","sample_name": "a variant of Win32/WuJi.K potentially
unwanted application","sample_id": "a variant of Win32/WuJi.K potentially unwant
ed application","sample_hashes": {"SHA1": "4E1E84A2015A82EFD86096BA13A709F071D1B
9BD",},}&report_sig=CBF35936B8AA4CFFD8144C38ACE64CE1&fwd_ip=127.0.0.1&version=4.
5.0.2913:01:58
5.0.2913:01:59
13:01:59
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WuJi.K poten
tially unwanted application","sample_id": "a variant of Win32/WuJi.K potentially
unwanted application","sample_hashes": {"SHA1": "4E1E84A2015A82EFD86096BA13A709
F071D1B9BD",},}&report_sig=EF751F35D573D104A6C2AFAD4E81BC1D&fwd_ip=127.0.0.1&ver
sion=4.5.0.2913:01:59
,"event_type": "DETECTED","sample_name": "a variant of Win32/WuJi.M potentially
unwanted application","sample_id": "a variant of Win32/WuJi.M potentially unwant
ed application","sample_hashes": {"SHA1": "7C7D7DE738B57994C18502BF20E28A8A662C3
511",},}&report_sig=37964C7515B39E56DD42A44DF4886AD8&fwd_ip=127.0.0.1&version=4.
5.0.2913:02:00
5.0.2913:02:00
13:02:00
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WuJi.M poten
tially unwanted application","sample_id": "a variant of Win32/WuJi.M potentially
unwanted application","sample_hashes": {"SHA1": "7C7D7DE738B57994C18502BF20E28A
8A662C3511",},}&report_sig=5B6AD53E6BE8C44DF47BE93324C424C3&fwd_ip=127.0.0.1&ver
sion=4.5.0.2913:02:00
.1&version=4.5.0.2913:02:07
.1&version=4.5.0.2913:02:07
.1&version=4.5.0.2913:02:17
.1&version=4.5.0.2913:02:17
.1&version=4.5.0.2913:02:28
.1&version=4.5.0.2913:02:37
.1&version=4.5.0.2913:02:38
.1&version=4.5.0.2913:02:51
.1&version=4.5.0.2913:02:51
.1&version=4.5.0.2913:03:01
97902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_PROG
RESS","progress": 50,}&report_sig=05980A3532EB3CECCA06D12560BE0BD8&fwd_ip=127.0.
0.1&version=4.5.0.2913:03:11
.1&version=4.5.0.2913:03:11
.1&version=4.5.0.2913:03:23
.1&version=4.5.0.2913:03:24
.1&version=4.5.0.2913:03:33
.1&version=4.5.0.2913:03:34
.1&version=4.5.0.2913:03:44
.1&version=4.5.0.2913:03:45
.1&version=4.5.0.2913:03:54
13:03:55 Request query: 13:03:55 {"status":true}13:03:55
.1&version=4.5.0.2913:03:55
.1&version=4.5.0.2913:04:04
.1&version=4.5.0.2913:04:06
.1&version=4.5.0.2913:04:14
.1&version=4.5.0.2913:04:16
.1&version=4.5.0.2913:04:24
,"event_type": "DETECTED","sample_name": "Win32/InstallMonetizer.BK potentially
unwanted application","sample_id": "Win32/InstallMonetizer.BK potentially unwant
ed application","sample_hashes": {"SHA1": "1F4F5C8AF912F865032DB58E476D7AE6DCF98

77C",},}&report_sig=C82B1555049A04573A170826938565E8&fwd_ip=127.0.0.1&version=4.
5.0.2913:04:25
.1&version=4.5.0.2913:04:26
13:04:26 Request query: 13:04:26 1443300579261932/malware_scanner13:04:26 Respon
se: 13:04:26 {"status":true}13:04:26
5.0.2913:04:28
5.0.2913:04:28
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/InstallMonetizer.BK poten
tially unwanted application","sample_id": "Win32/InstallMonetizer.BK potentially
unwanted application","sample_hashes": {"SHA1": "1F4F5C8AF912F865032DB58E476D7A
E6DCF9877C",},}&report_sig=5E4877416B984D77CFAB2D752DEC495A&fwd_ip=127.0.0.1&ver
sion=4.5.0.2913:04:29
.1&version=4.5.0.2913:04:35
.1&version=4.5.0.2913:04:36
.1&version=4.5.0.2913:04:58
.1&version=4.5.0.2913:05:01
.1&version=4.5.0.2913:05:07
.1&version=4.5.0.2913:05:11
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Adware.Imali.E appli
cation","sample_id": "a variant of MSIL/Adware.Imali.E application","sample_hash
es": {"SHA1": "9F650F399F426203134E0ED53BF37F438E8230BD",},}&report_sig=70B6AE09
FA5692DB35FF9CDB8DC580C8&fwd_ip=127.0.0.1&version=4.5.0.2913:05:11
E application","sample_id": "a variant of MSIL/Adware.Imali.E application","samp
le_hashes": {"SHA1": "9F650F399F426203134E0ED53BF37F438E8230BD",},}&report_sig=3
7FCABF760A1406DF9409097914D7431&fwd_ip=127.0.0.1&version=4.5.0.2913:05:12
"sample_id": "a variant of MSIL/Kryptik.EWB trojan","sample_hashes": {"SHA1": "B
A1CA60CFDFCCD2F3AB47080A643BA09262E7B01",},}&report_sig=2BF577A682DA581196A3B9A2
D5E1E418&fwd_ip=127.0.0.1&version=4.5.0.2913:05:13
"sample_id": "a variant of MSIL/Kryptik.EWB trojan","sample_hashes": {"SHA1": "B
A1CA60CFDFCCD2F3AB47080A643BA09262E7B01",},}&report_sig=2BF577A682DA581196A3B9A2
D5E1E418&fwd_ip=127.0.0.1&version=4.5.0.2913:05:13
A1": "BA1CA60CFDFCCD2F3AB47080A643BA09262E7B01",},}&report_sig=8E65DA627720BD530
D65877E47297DEC&fwd_ip=127.0.0.1&version=4.5.0.2913:05:13
A1": "BA1CA60CFDFCCD2F3AB47080A643BA09262E7B01",},}&report_sig=8E65DA627720BD530
D65877E47297DEC&fwd_ip=127.0.0.1&version=4.5.0.2913:05:13

es": {"SHA1": "C5C811DDD4A56955C628565FE88C145F7A7432CD",},}&report_sig=3F66DDD1
657525B7BA221B777943C34A&fwd_ip=127.0.0.1&version=4.5.0.2913:05:14
es": {"SHA1": "C5C811DDD4A56955C628565FE88C145F7A7432CD",},}&report_sig=3F66DDD1
657525B7BA221B777943C34A&fwd_ip=127.0.0.1&version=4.5.0.2913:05:14
le_hashes": {"SHA1": "C5C811DDD4A56955C628565FE88C145F7A7432CD",},}&report_sig=2
8B8E24F331DB56410B54F73EEF7C534&fwd_ip=127.0.0.1&version=4.5.0.2913:05:14
le_hashes": {"SHA1": "C5C811DDD4A56955C628565FE88C145F7A7432CD",},}&report_sig=2
8B8E24F331DB56410B54F73EEF7C534&fwd_ip=127.0.0.1&version=4.5.0.2913:05:14
5.0.2913:05:16
5.0.2913:05:16
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WuJi.K poten
tially unwanted application","sample_id": "a variant of Win32/WuJi.K potentially
unwanted application","sample_hashes": {"SHA1": "4E1E84A2015A82EFD86096BA13A709
F071D1B9BD",},}&report_sig=EF751F35D573D104A6C2AFAD4E81BC1D&fwd_ip=127.0.0.1&ver
sion=4.5.0.2913:05:17
13:05:17 Request query: 13:05:17 Response: 13:05:17

13:05:17
en=1190765804291424&report={"report_type": "SCANNER_DATA","event_type": "CLEANUP
_SUCCESS","sample_name": "a variant of Win32/WuJi.K potentially unwanted applica
tion","sample_id": "a variant of Win32/WuJi.K potentially unwanted application",
"sample_hashes": {"SHA1": "4E1E84A2015A82EFD86096BA13A709F071D1B9BD",},}&report_
sig=EF751F35D573D104A6C2AFAD4E81BC1D&fwd_ip=127.0.0.1&version=4.5.0.2913:05:17
.1&version=4.5.0.2913:05:18
Q.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AFQ.gen app
lication","sample_hashes": {"SHA1": "4834D25A9E96499ACA795DECF47FB07F0A5EB237",}
,}&report_sig=4BFE439E67B7DBF592A87B89CDE6EF9F&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:18
rtAd.AFQ.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AFQ.
gen application","sample_hashes": {"SHA1": "4834D25A9E96499ACA795DECF47FB07F0A5E
B237",},}&report_sig=8E84BE71041CB7F880A37BEAD37BBCDB&fwd_ip=127.0.0.1&version=4
.5.0.2913:05:19
lication","sample_hashes": {"SHA1": "A48F11BF9B30CB11654FA0CD632761A1632E28F8",}
,}&report_sig=3BFE15D39A5A92B4D53C118EBE0A4A29&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:19
gen application","sample_hashes": {"SHA1": "A48F11BF9B30CB11654FA0CD632761A1632E
28F8",},}&report_sig=04047F060E8BDB0974940F0C4C919759&fwd_ip=127.0.0.1&version=4
.5.0.2913:05:20
T application","sample_id": "a variant of Win32/Adware.ConvertAd.AFT application
","sample_hashes": {"SHA1": "209F225B5EA0FFB6A8682304CC0B6999D3E02E96",},}&repor
t_sig=EDF3EB814DC4F1C5909B6853FDA7A5E8&fwd_ip=127.0.0.1&version=4.5.0.2913:05:21

rtAd.AFT application","sample_id": "a variant of Win32/Adware.ConvertAd.AFT appl
ication","sample_hashes": {"SHA1": "209F225B5EA0FFB6A8682304CC0B6999D3E02E96",},
}&report_sig=6CCF9EBA0ED3D4251B8DD5FC8FE71A84&fwd_ip=127.0.0.1&version=4.5.0.291
3:05:22
3:05:22
.1&version=4.5.0.2913:05:22
,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.AE
R.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AER.gen app
lication","sample_hashes": {"SHA1": "5A08DDC8A37395DB6F4676CFB5C107140919CBB4",}
,}&report_sig=058A75862EA882B80D203136B7660E25&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:32
rtAd.AER.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AER.
gen application","sample_hashes": {"SHA1": "5A08DDC8A37395DB6F4676CFB5C107140919
CBB4",},}&report_sig=3663C91CDFD67520400BF7C4A077379A&fwd_ip=127.0.0.1&version=4
.5.0.2913:05:33
.1&version=4.5.0.2913:05:33
,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.AE

R.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AER.gen app
lication","sample_hashes": {"SHA1": "5A08DDC8A37395DB6F4676CFB5C107140919CBB4",}
,}&report_sig=058A75862EA882B80D203136B7660E25&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:34
rtAd.AER.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AER.
gen application","sample_hashes": {"SHA1": "5A08DDC8A37395DB6F4676CFB5C107140919
CBB4",},}&report_sig=3663C91CDFD67520400BF7C4A077379A&fwd_ip=127.0.0.1&version=4
.5.0.2913:05:34
.1&version=4.5.0.2913:05:35
,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.XC
.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.XC.gen appli
cation","sample_hashes": {"SHA1": "E0118A55956BB3448D5D6F45EF7E9BD43C8224D8",},}
&report_sig=63F97FD4976663591047218BCFB0870D&fwd_ip=127.0.0.1&version=4.5.0.2913
:05:36
rtAd.XC.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.XC.ge
n application","sample_hashes": {"SHA1": "E0118A55956BB3448D5D6F45EF7E9BD43C8224
D8",},}&report_sig=2B3337C4934D32A6601CA7CC1CB7C9FA&fwd_ip=127.0.0.1&version=4.5
.0.2913:05:37
13:05:38
13:05:38

.5.0.2913:05:39
.5.0.2913:05:39
,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.AD
W application","sample_id": "a variant of Win32/Adware.ConvertAd.ADW application
","sample_hashes": {"SHA1": "88670B276767D37F6E07CF6909C8B8FDEFE70E0E",},}&repor
t_sig=63172359D6EC4C331E48CE9021D935B9&fwd_ip=127.0.0.1&version=4.5.0.2913:05:40
rtAd.ADW application","sample_id": "a variant of Win32/Adware.ConvertAd.ADW appl
ication","sample_hashes": {"SHA1": "88670B276767D37F6E07CF6909C8B8FDEFE70E0E",},
}&report_sig=AA97972FB577D804B49BFB23A0E5E002&fwd_ip=127.0.0.1&version=4.5.0.291
3:05:40
3:05:40
13:05:40 Response: 13:05:40 {"status":true}13:05:40 Response: 13:05:40 {"status"
:true}13:05:40
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Amonetize.AF potenti
ally unwanted application","sample_id": "a variant of MSIL/Amonetize.AF potentia
lly unwanted application","sample_hashes": {"SHA1": "95C463BD0BD11C00E0F12AD834F
712BAE1BF96E6",},}&report_sig=B9E52D73D0C66501FAFEF8630674CBA7&fwd_ip=127.0.0.1&
version=4.5.0.2913:05:41

,"event_type": "DETECTED","sample_name": "a variant of MSIL/Amonetize.AF potenti
ally unwanted application","sample_id": "a variant of MSIL/Amonetize.AF potentia
lly unwanted application","sample_hashes": {"SHA1": "95C463BD0BD11C00E0F12AD834F
712BAE1BF96E6",},}&report_sig=B9E52D73D0C66501FAFEF8630674CBA7&fwd_ip=127.0.0.1&
version=4.5.0.2913:05:41
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Amonetize.AF
potentially unwanted application","sample_id": "a variant of MSIL/Amonetize.AF p
otentially unwanted application","sample_hashes": {"SHA1": "95C463BD0BD11C00E0F1
2AD834F712BAE1BF96E6",},}&report_sig=D2423F74B21A8C7A2639268596EADA30&fwd_ip=127
.0.0.1&version=4.5.0.2913:05:42
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Amonetize.AF
potentially unwanted application","sample_id": "a variant of MSIL/Amonetize.AF p
otentially unwanted application","sample_hashes": {"SHA1": "95C463BD0BD11C00E0F1
2AD834F712BAE1BF96E6",},}&report_sig=D2423F74B21A8C7A2639268596EADA30&fwd_ip=127
.0.0.1&version=4.5.0.2913:05:42
13:05:42
lication","sample_hashes": {"SHA1": "C95C84CD570748CDC7B17E09E2DD4494C1F1D675",}
,}&report_sig=FC4DD8DB99F59675E519EED1208995A3&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:43
13:05:44 Response: 13:05:44 Response: 13:05:44 Request query: 13:05:44
13:05:44
97902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_DATA
","event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Adware.Conv
ertAd.AFQ.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AFQ
.gen application","sample_hashes": {"SHA1": "C95C84CD570748CDC7B17E09E2DD4494C1F
1D675",},}&report_sig=0D9A83473A81E5CC27419C8592E3BA67&fwd_ip=127.0.0.1&version=
4.5.0.2913:05:44 Request body: 13:05:44 access_token=1443300579261932|cfedb1bd11
13405e097902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANN
ER_DATA","event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Adwa
re.ConvertAd.AFQ.gen application","sample_id": "a variant of Win32/Adware.Conver
tAd.AFQ.gen application","sample_hashes": {"SHA1": "C95C84CD570748CDC7B17E09E2DD
4494C1F1D675",},}&report_sig=0D9A83473A81E5CC27419C8592E3BA67&fwd_ip=127.0.0.1&v
ersion=4.5.0.2913:05:44
13:05:44
.1&version=4.5.0.2913:05:44
lication","sample_hashes": {"SHA1": "499CADC8E24B1B1723961C29319F59D8B0880E9C",}
,}&report_sig=4A03ED464354E58CE23FA591F9BE5965&fwd_ip=127.0.0.1&version=4.5.0.29
13:05:46
13:05:46
gen application","sample_hashes": {"SHA1": "499CADC8E24B1B1723961C29319F59D8B088
0E9C",},}&report_sig=D85F596164A6ADDC944FB801BCFB4EB2&fwd_ip=127.0.0.1&version=4
.5.0.2913:05:47
.5.0.2913:05:47
.1&version=4.5.0.2913:05:47
13:05:47 {"status":true}13:05:47
13:05:49
13:05:50
13:05:50 Response: 13:05:50 {"status":true}13:05:50 Response: 13:05:50
13:05:50
e_scanner13:05:50

.5.0.2913:05:50
3:05:52
3:05:52
13:05:54
13:05:54
.5.0.2913:05:54
.5.0.2913:05:55
.1&version=4.5.0.2913:05:55
,"event_type": "DETECTED","sample_name": "Win32/InstallMonetizer.BJ potentially
unwanted application,Win32/InstallMonetizer.BK potentially unwanted application"
,"sample_id": "Win32/InstallMonetizer.BJ potentially unwanted application,Win32/
InstallMonetizer.BK potentially unwanted application","sample_hashes": {"SHA1":
"9E75346A6B9BB5EFBE8E47A0453E1249325407DC",},}&report_sig=5C8F3F522F8EAC1D951346
CB95FDA1E2&fwd_ip=127.0.0.1&version=4.5.0.2913:05:57
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/InstallMonetizer.BJ poten
tially unwanted application,Win32/InstallMonetizer.BK potentially unwanted appli
cation","sample_id": "Win32/InstallMonetizer.BJ potentially unwanted application
,Win32/InstallMonetizer.BK potentially unwanted application","sample_hashes": {"
SHA1": "9E75346A6B9BB5EFBE8E47A0453E1249325407DC",},}&report_sig=94503836553A0D4
40DFAB1FF7C9A49DD&fwd_ip=127.0.0.1&version=4.5.0.2913:05:57

.1&version=4.5.0.2913:05:58
13:05:59 Response: 13:05:59 {"status":true}13:05:59 Request query: 13:05:59 1443
300579261932/malware_scanner13:05:59
13:05:59
.5.0.2913:06:00

3:06:02
13:06:05 Request body: 13:06:05
13:06:05 Request query: 13:06:06 Response: 13:06:06 {"status":true}13:06:06
3:06:06
13:06:08 Response: 13:06:08 {"status":true}13:06:08 Response: 13:06:08 144330057
9261932/malware_scanner13:06:08

.1&version=4.5.0.2913:06:09
y unwanted application","sample_hashes": {"SHA1": "5F5BFFCCF20FF1CA36C25B892F984
B29D29575D5",},}&report_sig=0BF99A154E989C0D18B45B42A4021C81&fwd_ip=127.0.0.1&ve
rsion=4.5.0.2913:06:11
entially unwanted application","sample_hashes": {"SHA1": "5F5BFFCCF20FF1CA36C25B
892F984B29D29575D5",},}&report_sig=D565BEC3D63551C948349D322402B207&fwd_ip=127.0
.0.1&version=4.5.0.2913:06:12
y unwanted application","sample_hashes": {"SHA1": "5F5BFFCCF20FF1CA36C25B892F984
B29D29575D5",},}&report_sig=0BF99A154E989C0D18B45B42A4021C81&fwd_ip=127.0.0.1&ve
rsion=4.5.0.2913:06:12
,"event_type": "DETECTED","sample_name": "VBS/TrojanDownloader.Agent.NSW trojan"
,"sample_id": "VBS/TrojanDownloader.Agent.NSW trojan","sample_hashes": {"SHA1":
"EF0A464BD77C13A8BD7E800FBD0C417EE35704EB",},}&report_sig=B6F645B6130DB94646CBE3
C1EF277674&fwd_ip=127.0.0.1&version=4.5.0.2913:06:12
entially unwanted application","sample_hashes": {"SHA1": "5F5BFFCCF20FF1CA36C25B
892F984B29D29575D5",},}&report_sig=D565BEC3D63551C948349D322402B207&fwd_ip=127.0
.0.1&version=4.5.0.2913:06:12
,"event_type": "CLEANUP_SUCCESS","sample_name": "VBS/TrojanDownloader.Agent.NSW
trojan","sample_id": "VBS/TrojanDownloader.Agent.NSW trojan","sample_hashes": {"
SHA1": "EF0A464BD77C13A8BD7E800FBD0C417EE35704EB",},}&report_sig=34770FCC885060A
A4EFC60D3D2813A38&fwd_ip=127.0.0.1&version=4.5.0.2913:06:13

5.0.2913:06:13
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WuJi.M poten
tially unwanted application","sample_id": "a variant of Win32/WuJi.M potentially
unwanted application","sample_hashes": {"SHA1": "7C7D7DE738B57994C18502BF20E28A
8A662C3511",},}&report_sig=5B6AD53E6BE8C44DF47BE93324C424C3&fwd_ip=127.0.0.1&ver
sion=4.5.0.2913:06:14
.1&version=4.5.0.2913:06:16
.1&version=4.5.0.2913:06:19
.1&version=4.5.0.2913:06:26
.1&version=4.5.0.2913:06:29
.1&version=4.5.0.2913:06:36
.1&version=4.5.0.2913:06:39
.1&version=4.5.0.2913:06:46
.1&version=4.5.0.2913:06:49
.1&version=4.5.0.2913:06:56
.1&version=4.5.0.2913:06:59
.1&version=4.5.0.2913:07:06
.1&version=4.5.0.2913:07:09
.1&version=4.5.0.2913:07:16
.1&version=4.5.0.2913:07:19
.1&version=4.5.0.2913:07:26
.1&version=4.5.0.2913:07:29
.1&version=4.5.0.2913:07:36
13:07:38 1443300579261932/malware_scanner13:07:38
.1&version=4.5.0.2913:07:39
,"event_type": "DETECTED","sample_name": "multiple threats,Win32/Adware.ConvertA
d.AEY application,a variant of Win32/Adware.ConvertAd.AFO application,a variant
of Win32/Adware.ConvertAd.AFQ.gen application","sample_id": "multiple threats,Wi
n32/Adware.ConvertAd.AEY application,a variant of Win32/Adware.ConvertAd.AFO app
lication,a variant of Win32/Adware.ConvertAd.AFQ.gen application","sample_hashes
": {"SHA1": "FB17CCAE1039E9BB682046D94CB74201504197B8",},}&report_sig=519A36CAAB
D8C1C4A324BE42A9205956&fwd_ip=127.0.0.1&version=4.5.0.2913:07:46
,"event_type": "DETECTED","sample_name": "multiple threats,Win32/Adware.ConvertA
d.AEY application,a variant of Win32/Adware.ConvertAd.AFO application,a variant
of Win32/Adware.ConvertAd.AFQ.gen application","sample_id": "multiple threats,Wi
n32/Adware.ConvertAd.AEY application,a variant of Win32/Adware.ConvertAd.AFO app
lication,a variant of Win32/Adware.ConvertAd.AFQ.gen application","sample_hashes
": {"SHA1": "FB17CCAE1039E9BB682046D94CB74201504197B8",},}&report_sig=519A36CAAB
D8C1C4A324BE42A9205956&fwd_ip=127.0.0.1&version=4.5.0.2913:07:46
,"event_type": "CLEANUP_SUCCESS","sample_name": "multiple threats,Win32/Adware.C
onvertAd.AEY application,a variant of Win32/Adware.ConvertAd.AFO application,a v
ariant of Win32/Adware.ConvertAd.AFQ.gen application","sample_id": "multiple thr
eats,Win32/Adware.ConvertAd.AEY application,a variant of Win32/Adware.ConvertAd.
AFO application,a variant of Win32/Adware.ConvertAd.AFQ.gen application","sample
_hashes": {"SHA1": "FB17CCAE1039E9BB682046D94CB74201504197B8",},}&report_sig=B59
961D7750823C17AFE5C1F0DB7CDF3&fwd_ip=127.0.0.1&version=4.5.0.2913:07:47

,"event_type": "CLEANUP_SUCCESS","sample_name": "multiple threats,Win32/Adware.C
onvertAd.AEY application,a variant of Win32/Adware.ConvertAd.AFO application,a v
ariant of Win32/Adware.ConvertAd.AFQ.gen application","sample_id": "multiple thr
eats,Win32/Adware.ConvertAd.AEY application,a variant of Win32/Adware.ConvertAd.
AFO application,a variant of Win32/Adware.ConvertAd.AFQ.gen application","sample
_hashes": {"SHA1": "FB17CCAE1039E9BB682046D94CB74201504197B8",},}&report_sig=B59
961D7750823C17AFE5C1F0DB7CDF3&fwd_ip=127.0.0.1&version=4.5.0.2913:07:47
13:07:47
.1&version=4.5.0.2913:07:47
,"event_type": "DETECTED","sample_name": "Win32/Adware.ConvertAd.AEY application
","sample_id": "Win32/Adware.ConvertAd.AEY application","sample_hashes": {"SHA1"
: "93E28C91476F1EE247F3CAFB8931ABCCC2A12CE1",},}&report_sig=E47B90964A0F3CA45143
63248006F1EF&fwd_ip=127.0.0.1&version=4.5.0.2913:07:48
,"event_type": "DETECTED","sample_name": "Win32/Adware.ConvertAd.AEY application
","sample_id": "Win32/Adware.ConvertAd.AEY application","sample_hashes": {"SHA1"
: "93E28C91476F1EE247F3CAFB8931ABCCC2A12CE1",},}&report_sig=E47B90964A0F3CA45143
63248006F1EF&fwd_ip=127.0.0.1&version=4.5.0.2913:07:48
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/Adware.ConvertAd.AEY appl
ication","sample_id": "Win32/Adware.ConvertAd.AEY application","sample_hashes":
{"SHA1": "93E28C91476F1EE247F3CAFB8931ABCCC2A12CE1",},}&report_sig=6AD372E488491
2FBDBD515A656B96048&fwd_ip=127.0.0.1&version=4.5.0.2913:07:49
,"event_type": "CLEANUP_SUCCESS","sample_name": "Win32/Adware.ConvertAd.AEY appl
ication","sample_id": "Win32/Adware.ConvertAd.AEY application","sample_hashes":
{"SHA1": "93E28C91476F1EE247F3CAFB8931ABCCC2A12CE1",},}&report_sig=6AD372E488491
2FBDBD515A656B96048&fwd_ip=127.0.0.1&version=4.5.0.2913:07:49
.1&version=4.5.0.2913:07:49
.1&version=4.5.0.2913:07:57

.1&version=4.5.0.2913:07:59
.1&version=4.5.0.2913:08:08
.1&version=4.5.0.2913:08:09
.1&version=4.5.0.2913:08:18
.1&version=4.5.0.2913:08:19
e_scanner13:08:29
.1&version=4.5.0.2913:08:29
.1&version=4.5.0.2913:08:38
.1&version=4.5.0.2913:08:39
.1&version=4.5.0.2913:08:53
.1&version=4.5.0.2913:08:54
.1&version=4.5.0.2913:09:21
.1&version=4.5.0.2913:09:22
.1&version=4.5.0.2913:09:55
.1&version=4.5.0.2913:09:55
e_scanner13:10:04
,"event_type": "DETECTED","sample_name": "a variant of Win32/WinWrapper.L potent
ially unwanted application","sample_id": "a variant of Win32/WinWrapper.L potent
ially unwanted application","sample_hashes": {"SHA1": "7C98ECFB485CD62359318ED00
47DD6B84F97E0CC",},}&report_sig=6EB2ABB093B5A151B83181D8DD523D89&fwd_ip=127.0.0.
1&version=4.5.0.2913:10:04
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WinWrapper.L
potentially unwanted application","sample_id": "a variant of Win32/WinWrapper.L
potentially unwanted application","sample_hashes": {"SHA1": "7C98ECFB485CD62359
318ED0047DD6B84F97E0CC",},}&report_sig=0A6046AEABA878626DFE2E42AF7D90A8&fwd_ip=1
27.0.0.1&version=4.5.0.2913:10:04
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/WinWrapper.L
potentially unwanted application","sample_id": "a variant of Win32/WinWrapper.L
potentially unwanted application","sample_hashes": {"SHA1": "7C98ECFB485CD62359
318ED0047DD6B84F97E0CC",},}&report_sig=0A6046AEABA878626DFE2E42AF7D90A8&fwd_ip=1
27.0.0.1&version=4.5.0.2913:10:05
13:10:05 Response: 13:10:05 Request query: 13:10:05 1443300579261932/malware_sca
nner13:10:05
.1&version=4.5.0.2913:10:05

.1&version=4.5.0.2913:10:15
.1&version=4.5.0.2913:10:25
.1&version=4.5.0.2913:10:25
.1&version=4.5.0.2913:10:35
.1&version=4.5.0.2913:10:35
.1&version=4.5.0.2913:11:02
.1&version=4.5.0.2913:11:05
.1&version=4.5.0.2913:11:29
.1&version=4.5.0.2913:11:34
.1&version=4.5.0.2913:11:55
.1&version=4.5.0.2913:12:00
.1&version=4.5.0.2913:12:18
.1&version=4.5.0.2913:12:24
.1&version=4.5.0.2913:12:35
.1&version=4.5.0.2913:12:42
.1&version=4.5.0.2913:13:03
.1&version=4.5.0.2913:13:14
,"event_type": "DETECTED","sample_name": "a variant of Win32/Amonetize.OG potent
ially unwanted application","sample_id": "a variant of Win32/Amonetize.OG potent
ially unwanted application","sample_hashes": {"SHA1": "5BAD50329E7D574860407ED60
53578CF7B7132CD",},}&report_sig=B75C43F96BD0F3335D727F99BE63D9A1&fwd_ip=127.0.0.
1&version=4.5.0.2913:13:32
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of Win32/Amonetize.OG
potentially unwanted application","sample_id": "a variant of Win32/Amonetize.OG
potentially unwanted application","sample_hashes": {"SHA1": "5BAD50329E7D574860
407ED6053578CF7B7132CD",},}&report_sig=42AE617391B59A4267A84EB5F915DDC1&fwd_ip=1
27.0.0.1&version=4.5.0.2913:13:32
.1&version=4.5.0.2913:13:33
ially unwanted application","sample_hashes": {"SHA1": "5BAD50329E7D574860407ED60
53578CF7B7132CD",},}&report_sig=B75C43F96BD0F3335D727F99BE63D9A1&fwd_ip=127.0.0.
1&version=4.5.0.2913:13:43
.1&version=4.5.0.2913:13:43
potentially unwanted application","sample_hashes": {"SHA1": "5BAD50329E7D574860
407ED6053578CF7B7132CD",},}&report_sig=42AE617391B59A4267A84EB5F915DDC1&fwd_ip=1
27.0.0.1&version=4.5.0.2913:13:43
.1&version=4.5.0.2913:13:43
13:13:53 Request query: 13:13:53 1443300579261932/malware_scanner13:13:53 144330
0579261932/malware_scanner13:13:53 Request body: 13:13:53 Request body: 13:13:53
13:13:53
.1&version=4.5.0.2913:14:03
.1&version=4.5.0.2913:14:03
.1&version=4.5.0.2913:14:13
.1&version=4.5.0.2913:14:13
.1&version=4.5.0.2913:14:23
.1&version=4.5.0.2913:14:25
.1&version=4.5.0.2913:14:35
.1&version=4.5.0.2913:14:35
.1&version=4.5.0.2913:14:45
.1&version=4.5.0.2913:14:45
.1&version=4.5.0.2913:14:59
.1&version=4.5.0.2913:15:00
13:15:00 {"status":true}13:15:00
.1&version=4.5.0.2913:16:50
.1&version=4.5.0.2913:16:54
ially unwanted application","sample_hashes": {"SHA1": "AD353541A0F3ADBEAA263ED05
0562EB677A87E83",},}&report_sig=BFA084226444F7473566357EFE7F29C2&fwd_ip=127.0.0.
1&version=4.5.0.2913:17:15
potentially unwanted application","sample_hashes": {"SHA1": "AD353541A0F3ADBEAA
263ED050562EB677A87E83",},}&report_sig=93B312FD30B212A4D231A4C9AA6354C1&fwd_ip=1
27.0.0.1&version=4.5.0.2913:17:16
.1&version=4.5.0.2913:17:16
ially unwanted application","sample_hashes": {"SHA1": "AD353541A0F3ADBEAA263ED05
0562EB677A87E83",},}&report_sig=BFA084226444F7473566357EFE7F29C2&fwd_ip=127.0.0.
1&version=4.5.0.2913:17:19
potentially unwanted application","sample_hashes": {"SHA1": "AD353541A0F3ADBEAA
263ED050562EB677A87E83",},}&report_sig=93B312FD30B212A4D231A4C9AA6354C1&fwd_ip=1
27.0.0.1&version=4.5.0.2913:17:20
.1&version=4.5.0.2913:17:20
.1&version=4.5.0.2913:17:27
.1&version=4.5.0.2913:17:30
ESS","progress": 56,}&report_sig=E90BD11899688B77F684A0AA0FFF07A6&fwd_ip=127.0.0
.1&version=4.5.0.2913:17:37
ESS","progress": 61,}&report_sig=2C0252EB82AD3C80EC89A0CB7CAC85F3&fwd_ip=127.0.0
.1&version=4.5.0.2913:17:40
ESS","progress": 80,}&report_sig=E2A70107B3D066CEC3BFB72625E01640&fwd_ip=127.0.0
.1&version=4.5.0.2913:17:47
.1&version=4.5.0.2913:17:51
,"event_type": "DETECTED","sample_name": "a variant of MSIL/StartPage.BG trojan"
,"sample_id": "a variant of MSIL/StartPage.BG trojan","sample_hashes": {"SHA1":
"73F88F8639B03F3BA8431254E7FD126FCABF09A4",},}&report_sig=14B9821E4B88568975D1C1
D323BAE295&fwd_ip=127.0.0.1&version=4.5.0.2913:17:54
13:17:55
13:17:55
en=1190765804291424&report={"report_type": "SCANNER_DATA","event_type": "CLEANUP
_SUCCESS","sample_name": "a variant of MSIL/StartPage.BG trojan","sample_id": "a
variant of MSIL/StartPage.BG trojan","sample_hashes": {"SHA1": "73F88F8639B03F3
BA8431254E7FD126FCABF09A4",},}&report_sig=B43076A95D0140C56099C666F2AFFDDF&fwd_i
p=127.0.0.1&version=4.5.0.2913:17:55 access_token=1443300579261932|cfedb1bd11134
05e097902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_
DATA","event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/StartPag
e.BG trojan","sample_id": "a variant of MSIL/StartPage.BG trojan","sample_hashes
": {"SHA1": "73F88F8639B03F3BA8431254E7FD126FCABF09A4",},}&report_sig=B43076A95D
0140C56099C666F2AFFDDF&fwd_ip=127.0.0.1&version=4.5.0.2913:17:55
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Toolbar.Linkury.AF p
otentially unwanted application","sample_id": "a variant of MSIL/Toolbar.Linkury

.AF potentially unwanted application","sample_hashes": {"SHA1": "E433E05A0F7EED3
2EE4E5C0314B3DDC75F9B7D19",},}&report_sig=66CAE6DDC3F44098F1B1E4F57DD05ABB&fwd_i
p=127.0.0.1&version=4.5.0.2913:17:56
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Toolbar.Linkury.AF p
.AF potentially unwanted application","sample_hashes": {"SHA1": "C69F2C10395430F
0D61E25124C9C29C4C4DA4DE5",},}&report_sig=E6624CCFB31AA3D3358E3668F5BB0BBD&fwd_i
p=127.0.0.1&version=4.5.0.2913:17:56
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Toolbar.Linku
ry.AF potentially unwanted application","sample_id": "a variant of MSIL/Toolbar.
Linkury.AF potentially unwanted application","sample_hashes": {"SHA1": "E433E05A
0F7EED32EE4E5C0314B3DDC75F9B7D19",},}&report_sig=0BC161AE2D93D57A260BC66ABD9D192
3&fwd_ip=127.0.0.1&version=4.5.0.2913:17:56
ry.AF potentially unwanted application","sample_id": "a variant of MSIL/Toolbar.
Linkury.AF potentially unwanted application","sample_hashes": {"SHA1": "C69F2C10
395430F0D61E25124C9C29C4C4DA4DE5",},}&report_sig=FD201FD969A3B4483DC84052342F15F
3&fwd_ip=127.0.0.1&version=4.5.0.2913:17:57
.1&version=4.5.0.2913:17:57
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Amonetize.AE potenti
ally unwanted application","sample_id": "a variant of MSIL/Amonetize.AE potentia
lly unwanted application","sample_hashes": {"SHA1": "814913B99C6EF62F9BD1EB168E5
F88C769AA00DE",},}&report_sig=18014D281F29D29FCE8C326380EBEA44&fwd_ip=127.0.0.1&
version=4.5.0.2913:17:58
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Amonetize.AE
potentially unwanted application","sample_id": "a variant of MSIL/Amonetize.AE p
otentially unwanted application","sample_hashes": {"SHA1": "814913B99C6EF62F9BD1
EB168E5F88C769AA00DE",},}&report_sig=02E810503EAD88064C09866E5E0BFFBC&fwd_ip=127
.0.0.1&version=4.5.0.2913:17:58
,"event_type": "CLEANUP_SUCCESS","sample_name": "a variant of MSIL/Amonetize.AE
potentially unwanted application","sample_id": "a variant of MSIL/Amonetize.AE p
otentially unwanted application","sample_hashes": {"SHA1": "814913B99C6EF62F9BD1
EB168E5F88C769AA00DE",},}&report_sig=02E810503EAD88064C09866E5E0BFFBC&fwd_ip=127
.0.0.1&version=4.5.0.2913:17:58
13:17:58 Response: 13:17:58 {"status":true}13:17:58 {"status":true}13:17:58
.1&version=4.5.0.2913:18:01
.1&version=4.5.0.2913:18:07
.1&version=4.5.0.2913:18:12
.1&version=4.5.0.2913:18:17
.1&version=4.5.0.2913:18:22
.1&version=4.5.0.2913:18:34
.1&version=4.5.0.2913:18:38
.1&version=4.5.0.2913:18:44
,"event_type": "DETECTED","sample_name": "a variant of MSIL/Toolbar.Linkury.AG p
.AG potentially unwanted application","sample_hashes": {"SHA1": "499575E182AF4E5

E60E86D42F80B0A91D8CD49FE",},}&report_sig=E92F24528168AC55E6DBAE06B355898F&fwd_i
p=127.0.0.1&version=4.5.0.2913:18:46
ry.AG potentially unwanted application","sample_id": "a variant of MSIL/Toolbar.
Linkury.AG potentially unwanted application","sample_hashes": {"SHA1": "499575E1
82AF4E5E60E86D42F80B0A91D8CD49FE",},}&report_sig=94E3386E315604463306A8CA81CCD30
6&fwd_ip=127.0.0.1&version=4.5.0.2913:18:47
.1&version=4.5.0.2913:18:48
.1&version=4.5.0.2913:18:54
.1&version=4.5.0.2913:18:58
.1&version=4.5.0.2913:19:04
.1&version=4.5.0.2913:19:13
.1&version=4.5.0.2913:19:14
.1&version=4.5.0.2913:19:25
.1&version=4.5.0.2913:19:26

.1&version=4.5.0.2913:19:35
.1&version=4.5.0.2913:19:35
.1&version=4.5.0.2913:19:45
.1&version=4.5.0.2913:19:45
.1&version=4.5.0.2913:19:55 Request query: 13:19:55 1443300579261932/malware_sca
nner13:19:55
.1&version=4.5.0.2913:19:55
13:20:05 1443300579261932/malware_scanner13:20:05
.1&version=4.5.0.2913:20:05
.1&version=4.5.0.2913:20:15
.1&version=4.5.0.2913:20:15
.1&version=4.5.0.2913:20:25
.1&version=4.5.0.2913:20:35
.1&version=4.5.0.2913:20:35
.1&version=4.5.0.2913:20:45 Request query: 13:20:45 1443300579261932/malware_sca
nner13:20:45
.1&version=4.5.0.2913:20:45
13:20:55
en=1190765804291424&report={"report_type": "SCANNER_PROGRESS","progress": 80,}&r
eport_sig=E2A70107B3D066CEC3BFB72625E01640&fwd_ip=127.0.0.1&version=4.5.0.2913:2
0:55 access_token=1443300579261932|cfedb1bd1113405e097902a8602d76ed&user_token=1
190765804291424&report={"report_type": "SCANNER_PROGRESS","progress": 80,}&repor
t_sig=E2A70107B3D066CEC3BFB72625E01640&fwd_ip=127.0.0.1&version=4.5.0.2913:20:55
13:21:05 Request query: 13:21:05 Request body: 13:21:05 Request body: 13:21:05
.1&version=4.5.0.2913:21:15
13:21:15 1443300579261932/malware_scanner13:21:15
.1&version=4.5.0.2913:21:15
.1&version=4.5.0.2913:21:25

.1&version=4.5.0.2913:21:35
13:21:35 1443300579261932/malware_scanner13:21:35
.1&version=4.5.0.2913:21:35
.1&version=4.5.0.2913:21:45
.1&version=4.5.0.2913:21:55
.1&version=4.5.0.2913:21:55
.1&version=4.5.0.2913:22:06
.1&version=4.5.0.2913:22:16
13:22:16
.1&version=4.5.0.2913:22:26
.1&version=4.5.0.2913:22:36

13:22:46 1443300579261932/malware_scanner13:22:46
13:22:56 Request query: 13:22:56 1443300579261932/malware_scanner13:22:56 Reques
t query: 13:22:56 Request body: 13:22:56
13:22:56
.1&version=4.5.0.2913:23:06
.1&version=4.5.0.2913:23:17
.1&version=4.5.0.2913:23:17
.1&version=4.5.0.2913:23:27
.1&version=4.5.0.2913:23:29
.1&version=4.5.0.2913:23:38
.1&version=4.5.0.2913:23:39
.1&version=4.5.0.2913:23:49

.1&version=4.5.0.2913:23:50
.1&version=4.5.0.2913:24:00
.1&version=4.5.0.2913:24:09
.1&version=4.5.0.2913:24:10
.1&version=4.5.0.2913:24:19
.1&version=4.5.0.2913:24:20
ESS","progress": 100,}&report_sig=38179CAEFE86A682F37B9182AAB91D97&fwd_ip=127.0.
0.1&version=4.5.0.2913:24:23
ESS","progress": 100,}&report_sig=38179CAEFE86A682F37B9182AAB91D97&fwd_ip=127.0.
0.1&version=4.5.0.2913:24:23
13:24:23 Reporting
13:24:23 Reporting
# version=8
# FBAV_user_token=1190765804291424
# FBAV_attack_id=945112655602197
# FBAV_status=0
# flags=2
# ESET.exe=4.5.0.29
# engine=29241
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# sfx_checked=true
# utc_time=2016-04-26 05:40:47
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 11706394 213283054 0 0
# scanned=37978
# found=50
# cleaned=50
# scan_time=1946
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="a varia
nt of Win32/Toolbar.Linkury.AQ potentially unwanted application (contained infec
ted files)" ac=C fn="${Memory}"
sh=D4ED1170BD3FD3E580FBEC6DF7BD4744DCA897EF ft=1 fh=0000000000083a00 vn="a varia
nt of Win32/Toolbar.Linkury.AN potentially unwanted application (cleaned by dele
ting (after the next restart))" ac=C fn="C:\Users\All Users\Airtostrong\Airtostr
ong.Vexe"
sh=B1E44B3ABFDA51BAC57E8FF811776A1D658AB99D ft=1 fh=0000000000058c00 vn="a varia
nt of Win64/Toolbar.Linkury.L potentially unwanted application (cleaned by delet
ing)" ac=C fn="C:\Users\All Users\Airtostrong\Plus-Job.dll"
sh=78EBFF980773701AED1ECFB205B2BA5488F65AEF ft=1 fh=0000000000061c00 vn="a varia
nt of Win32/Toolbar.Linkury.AJ potentially unwanted application (cleaned by dele
ting (after the next restart))" ac=C fn="C:\Users\All Users\DCHP\DCHP.Vexe"
sh=41B1902D55396A636D8827B895057C2C381A9237 ft=1 fh=000000000003ee00 vn="a varia
nt of Win32/Toolbar.Linkury.AQ potentially unwanted application (cleaned by dele
ting)" ac=C fn="C:\Users\All Users\serfe\Hatlax.dll"
sh=B1E44B3ABFDA51BAC57E8FF811776A1D658AB99D ft=1 fh=0000000000058c00 vn="a varia
nt of Win64/Toolbar.Linkury.L potentially unwanted application (cleaned by delet
ing)" ac=C fn="C:\Users\All Users\serfe\VoyaIs.dll"
sh=41B1902D55396A636D8827B895057C2C381A9237 ft=1 fh=000000000003ee00 vn="a varia
nt of Win32/Toolbar.Linkury.AQ potentially unwanted application (cleaned by dele
ting (after the next restart))" ac=C fn="C:\Users\All Users\yakdo\Alphalax.V02dl
l"
sh=864AA78CD746EAA36A4BF9BA761FCA87F1AE47FA ft=1 fh=0000000000081000 vn="a varia
nt of Win32/TrojanDropper.Addrop.AH trojan (cleaned by deleting)" ac=C fn="C:\Us
ers\All Users\yakdo\yakdo.exe"
sh=5CA718AEC1D8437F5EA991F1ABE1917F26F9EBBE ft=1 fh=000000000001e400 vn="a varia
nt of Win32/Adware.ConvertAd.AFW application (cleaned by deleting)" ac=C fn="C:\
Users\Caritas\AppData\Local\00000000-1453299875-0000-3412-000078563412\rnsb1678.
exe"
sh=14A380D9DDFDEE7AECF38C241C450BFE813D94E5 ft=0 fh=0000000000003f54 vn="" ac=S
fn="C:\Users\Caritas\AppData\Local\Google\Chrome\User Data\Default\Extensions\df
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\css\font\opensans-v10\OpenSans-300.wof
f2"
sh=EC2590BC030C185025FBC09AFE2F268AF6E38985 ft=0 fh=0000000000003cc4 vn="" ac=S
f2"
sh=808769B38614943B5116B559AC7528386B7CB020 ft=0 fh=0000000000003ed0 vn="" ac=S
f2"
sh=13DFDC32DA6EEC89246B1A77ED8BF8309B4C7589 ft=0 fh=0000000000006cb1 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\css\newtab.min.css"
sh=1E5867146988AB1DD2C4DBFDD15638B2B9F0742A ft=0 fh=000000000005bc8b vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\img\wallpaper\lost-valley-vietnam-HaiThinh.jpg"
sh=C8413E0C7966D1EB7FCF536154F83E38BB29221D ft=0 fh=000000000001bb9c vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\background.min.js"
sh=00AF31889BDC878A07CC24561EF27C3B3A287554 ft=0 fh=000000000000022f vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\cs_idle.min.js"
sh=7BF6D3B49DC440A36F33DA278FBDA8E1046C8381 ft=0 fh=00000000000001ad vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\cs_music-player.min.js"
sh=240B3EF66B0FE78A7CA5FE2C2A6C76B492F17C0C ft=0 fh=0000000000000166 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\cs_start.min.js"
sh=240B3EF66B0FE78A7CA5FE2C2A6C76B492F17C0C ft=0 fh=0000000000000166 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\inject.min.js"
sh=F664FE174CA3AE965EC56964280A56ED28B9DAB7 ft=0 fh=0000000000018014 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\install.min.js"
sh=1F0271771AF263F23E9A1AA7E88413E6614521D5 ft=0 fh=000000000001f3c4 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\js\newtab.min.js"
sh=36CD454DE32C3116EF8C3C1EB343ABC6DD209364 ft=0 fh=0000000000000080 vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\install.html"
sh=8D62EAA1C4338415BB8299C613CF17EA0C3611DF ft=0 fh=0000000000001a3f vn="" ac=S
achbhccemanebkkbeppgnnhkpicifp\2.2.3.38_0\newtab.html"
sh=A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB ft=0 fh=00000000000006cd vn="" ac=S
fn="C:\Users\Caritas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nm
mhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\css\craw_window.css"
sh=8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46 ft=0 fh=000000000000032a vn="" ac=S
mhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\html\craw_window.html"
sh=AAE78B89D46A4586BB8671A3EDB71157360E2499 ft=0 fh=000000000002e50e vn="" ac=S
mhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_background.js"
sh=8BA6DF5055FE99FE4843D9584397615240569800 ft=0 fh=00000000000358ad vn="" ac=S
mhkkegccagdldgiimedpiccmgmieda\0.1.2.0_0\craw_window.js"
sh=9525E00A568430D6DC0EADD11A8D7F2D8D5254D9 ft=1 fh=0000000000169cb8 vn="a varia
nt of Win32/ELEX.HI potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\81453274468\0Q1VEMFBRTA==2.exe"
sh=22BC0AAEBF83CAB61F2247253E92649916611AB2 ft=1 fh=0000000000038000 vn="Win32/A
dware.Imali.J application (cleaned by deleting)" ac=C fn="C:\Users\Caritas\AppDa
ta\Local\Temp\81453274468\1Q1VEMFBRTA==54.exe"
sh=67F85EA92F0350937D824D1C339C63522CC0571D ft=1 fh=0000000000215a58 vn="a varia
nt of Win32/Amonetize.EA potentially unwanted application (cleaned by deleting)"
ac=C fn="C:\Users\Caritas\AppData\Local\Temp\a8N4cyCP\free+icd+9+code+download_
_10924_i1827637192_il946891.exe"
sh=305F2404AA29D4635B13819523B065156A2D5B57 ft=1 fh=0000000000192538 vn="a varia
ac=C fn="C:\Users\Caritas\AppData\Local\Temp\b3zqhIaP\free+icd+9+code+download_
_10924_i1827637313_il946891.exe"
sh=37AFD060C0346196BD68287943ABCCFB04D7A392 ft=1 fh=00000000001a9130 vn="a varia
ac=C fn="C:\Users\Caritas\AppData\Local\Temp\b3zqhIaP\free+icd+9+code+download_
_10924_i1827637456_il946891.exe"
sh=D7A2453F45614CBA61790F9EF04E548667724EDA ft=1 fh=00000000001498e8 vn="a varia
nt of Win32/HideBaid.L potentially unwanted application (deleted)" ac=C fn="C:\U
sers\Caritas\AppData\Local\Temp\f9626892-7a78-3199-abd2-97bbce96297b\Extracted\a
dv_236.exe"
sh=353DB5062D5EF823888949B62C1D563AB6D47301 ft=1 fh=0000000000006e00 vn="a varia
nt of MSIL/Kryptik.EWB trojan (cleaned by deleting)" ac=C fn="C:\Users\Caritas\A
ppData\Local\Temp\Gx7TH\tlc.exe"
sh=DFB3229431D84205BAF05E00BEB3E04727CEC776 ft=1 fh=0000000000192b38 vn="a varia
nt of Win32/Amonetize.AT potentially unwanted application (cleaned by deleting)"
ac=C fn="C:\Users\Caritas\AppData\Local\Temp\Le7AnNcw\free+icd+9+code+download_
_10924_i1827637192_il946891.exe"
sh=F8A38007B0EF1C71C08D261CE87AF11DA7E286FF ft=1 fh=00000000000482ee vn="a varia
nt of Win32/OutBrowse.CL potentially unwanted application (deleted)" ac=C fn="C:
\Users\Caritas\AppData\Local\Temp\Le7AnNcw\setup.exe"
sh=4E1E84A2015A82EFD86096BA13A709F071D1B9BD ft=1 fh=0000000000044280 vn="a varia
nt of Win32/WuJi.K potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\Low\mslog.dll"
sh=7C7D7DE738B57994C18502BF20E28A8A662C3511 ft=1 fh=0000000000012480 vn="a varia
nt of Win32/WuJi.M potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\Low\Tinyxml2.dll"
sh=1F4F5C8AF912F865032DB58E476D7AE6DCF9877C ft=1 fh=000000000000e400 vn="Win32/I
nstallMonetizer.BK potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\nsiC41A.tmp\nsCBHTML5.dll"
sh=BA1CA60CFDFCCD2F3AB47080A643BA09262E7B01 ft=0 fh=000000000000dbc1 vn="a varia
nt of MSIL/Kryptik.EWB trojan (deleted)" ac=C fn="C:\Users\Caritas\AppData\Local
\Temp\Gx7TH.tmp"
sh=C5C811DDD4A56955C628565FE88C145F7A7432CD ft=1 fh=000000000004e800 vn="a varia
nt of MSIL/Adware.Imali.C application (cleaned by deleting)" ac=C fn="C:\Users\C
aritas\AppData\Local\Temp\hib15D9.exe"
sh=4E1E84A2015A82EFD86096BA13A709F071D1B9BD ft=1 fh=0000000000044280 vn="a varia
nt of Win32/WuJi.K potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\mslog.dll"
sh=4834D25A9E96499ACA795DECF47FB07F0A5EB237 ft=1 fh=00000000000276a7 vn="a varia
nt of Win32/Adware.ConvertAd.AFQ.gen application (cleaned by deleting)" ac=C fn=
"C:\Users\Caritas\AppData\Local\Temp\nsb4685.tmp"
sh=209F225B5EA0FFB6A8682304CC0B6999D3E02E96 ft=1 fh=000000000018d400 vn="a varia
nt of Win32/Adware.ConvertAd.AFT application (cleaned by deleting)" ac=C fn="C:\
Users\Caritas\AppData\Local\Temp\nsc6DC1.tmp"
sh=5A08DDC8A37395DB6F4676CFB5C107140919CBB4 ft=1 fh=0000000000092cfe vn="a varia
nt of Win32/Adware.ConvertAd.AER.gen application (cleaned by deleting)" ac=C fn=
"C:\Users\Caritas\AppData\Local\Temp\nsgB499.tmp"
sh=A48F11BF9B30CB11654FA0CD632761A1632E28F8 ft=1 fh=0000000000026c09 vn="a varia
"C:\Users\Caritas\AppData\Local\Temp\nshF717.tmp"
sh=88670B276767D37F6E07CF6909C8B8FDEFE70E0E ft=1 fh=0000000000027800 vn="a varia
nt of Win32/Adware.ConvertAd.ADW application (cleaned by deleting)" ac=C fn="C:\
Users\Caritas\AppData\Local\Temp\nsjF35C.tmp"
sh=95C463BD0BD11C00E0F12AD834F712BAE1BF96E6 ft=1 fh=000000000002a600 vn="a varia
nt of MSIL/Amonetize.AF potentially unwanted application (deleted)" ac=C fn="C:\
Users\Caritas\AppData\Local\Temp\nsl9BAC.exe"
sh=C95C84CD570748CDC7B17E09E2DD4494C1F1D675 ft=1 fh=0000000000033967 vn="a varia
"C:\Users\Caritas\AppData\Local\Temp\nsm2955.tmp"
sh=499CADC8E24B1B1723961C29319F59D8B0880E9C ft=1 fh=0000000000030058 vn="a varia
"C:\Users\Caritas\AppData\Local\Temp\nsnE3D4.tmp"
"C:\Users\Caritas\AppData\Local\Temp\nso9926.tmp"
Users\Caritas\AppData\Local\Temp\nspC223.tmp"
"C:\Users\Caritas\AppData\Local\Temp\nsrC23.tmp"
sh=9E75346A6B9BB5EFBE8E47A0453E1249325407DC ft=1 fh=00000000000388ef vn="Win32/I
nstallMonetizer.BJ potentially unwanted application,Win32/InstallMonetizer.BK po
tentially unwanted application (deleted)" ac=C fn="C:\Users\Caritas\AppData\Loca
l\Temp\nssB136.tmp"
l\Temp\nsvD3E1.tmp"
Users\Caritas\AppData\Local\Temp\nswF4B8.tmp"
l\Temp\nsyB2B.tmp"
sh=5F5BFFCCF20FF1CA36C25B892F984B29D29575D5 ft=1 fh=0000000000133049 vn="a varia
nt of Win32/HideBaid.L potentially unwanted application (deleted)" ac=C fn="C:\U
sers\Caritas\AppData\Local\Temp\set.exe"
sh=7C7D7DE738B57994C18502BF20E28A8A662C3511 ft=1 fh=0000000000012480 vn="a varia
nt of Win32/WuJi.M potentially unwanted application (cleaned by deleting)" ac=C
fn="C:\Users\Caritas\AppData\Local\Temp\Tinyxml2.dll"
sh=353DB5062D5EF823888949B62C1D563AB6D47301 ft=1 fh=0000000000006e00 vn="a varia
nt of MSIL/Kryptik.EWB trojan (cleaned by deleting)" ac=C fn="C:\Users\Caritas\A
ppData\Local\E-how.exe"
sh=FB17CCAE1039E9BB682046D94CB74201504197B8 ft=1 fh=000000000009e37b vn="multipl
e threats,Win32/Adware.ConvertAd.AEY application,a variant of Win32/Adware.Conve
rtAd.AFO application,a variant of Win32/Adware.ConvertAd.AFQ.gen application (cl
eaned by deleting)" ac=C fn="C:\Users\Caritas\AppData\Roaming\ASPackage\ASPackag
e.exe"
sh=93E28C91476F1EE247F3CAFB8931ABCCC2A12CE1 ft=1 fh=000000000000ecff vn="Win32/A
dware.ConvertAd.AEY application (cleaned by deleting)" ac=C fn="C:\Users\Caritas
\AppData\Roaming\ASPackage\Uninstall.exe"
sh=7C98ECFB485CD62359318ED0047DD6B84F97E0CC ft=1 fh=0000000000099ca8 vn="a varia
nt of Win32/WinWrapper.L potentially unwanted application (cleaned by deleting)"
ac=C fn="C:\Users\Caritas\Downloads\IcdCoderTool-75593702.exe"
sh=5BAD50329E7D574860407ED6053578CF7B7132CD ft=1 fh=00000000002eb458 vn="a varia
nt of Win32/Amonetize.OG potentially unwanted application (cleaned by deleting)"
ac=C fn="C:\Users\Caritas\Pictures\free+icd+9+code+download.zip-\free icd 9 cod
e download_10924_i126277951_il345.exe"
sh=AD353541A0F3ADBEAA263ED050562EB677A87E83 ft=0 fh=00000000002eb520 vn="a varia
nt of Win32/Amonetize.OG potentially unwanted application (deleted)" ac=C fn="C:
\Users\Caritas\Pictures\free+icd+9+code+download.zip-.zip"
sh=73F88F8639B03F3BA8431254E7FD126FCABF09A4 ft=1 fh=0000000000003a00 vn="a varia
nt of MSIL/StartPage.BG trojan (cleaned by deleting)" ac=C fn="C:\Program Files\
aotech\packages\2402be56-195d-4691-a179-5fa152423c0e\file.exe"
sh=C69F2C10395430F0D61E25124C9C29C4C4DA4DE5 ft=1 fh=000000000000ce00 vn="a varia
nt of MSIL/Toolbar.Linkury.AF potentially unwanted application (cleaned by delet
ing)" ac=C fn="C:\Program Files\aotech\packages\72295f64-3a31-4fc3-b10e-90fd23ad
97ed\xtc.exe"
sh=814913B99C6EF62F9BD1EB168E5F88C769AA00DE ft=1 fh=000000000005da00 vn="a varia
nt of MSIL/Amonetize.AE potentially unwanted application (cleaned by deleting)"

ac=C fn="C:\Program Files\aotech\aotech.exe"
13:24:26 EOS report sent
13:24:26 Finalizing Scanner
13:24:27 Finalizing DetectAV
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "REBOOT_PROMPT
",}&report_sig=2B0E1C581CDD0706BF99A0BF6D229F80&fwd_ip=127.0.0.1&version=4.5.0.2
913:24:27
13:24:27 Finalizing DetectAV
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "REBOOT_PROMPT
",}&report_sig=2B0E1C581CDD0706BF99A0BF6D229F80&fwd_ip=127.0.0.1&version=4.5.0.2
913:24:27
13:24:27 FB Restart Prompt sent
13:24:28 FB Restart Prompt sent
13:32:32 Restart dialog response: NO
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_ERROR
","reason": "User denied reboot",}&report_sig=5B9254C8D35F10BE54411692208F8575&f
wd_ip=127.0.0.1&version=4.5.0.2913:32:32
13:32:34 Restart dialog response: NO
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_ERROR
","reason": "User denied reboot",}&report_sig=5B9254C8D35F10BE54411692208F8575&f
wd_ip=127.0.0.1&version=4.5.0.2913:32:34
13:32:34 'User denied reboot' sent to FB
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_COMPL
ETE",}&report_sig=9C734DE4A183E52F911281E9D10DE4BF&fwd_ip=127.0.0.1&version=4.5.
0.2913:32:34
13:32:34 'User denied reboot' sent to FB
7902a8602d76ed&user_token=1190765804291424&report={"report_type": "SCANNER_COMPL
ETE",}&report_sig=9C734DE4A183E52F911281E9D10DE4BF&fwd_ip=127.0.0.1&version=4.5.
0.2913:32:34
13:32:35 FB Complete sent
13:32:35 Cleaning up
13:32:35 RecursiveRemoveDirectoryAndAllFiles: C:\Users\Caritas\AppData\Local\Tem
p\FBScanner_149902311\Modules\
13:32:35 FB Complete sent
13:32:35 Cleaning up
13:32:35 RecursiveRemoveDirectoryAndAllFiles: C:\Users\Caritas\AppData\Local\Tem
p\FBScanner_541624627\Modules\

Log

Hochgeladen von

Dokumentinformationen

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Log

Hochgeladen von

Copyright:

Verfügbare Formate

12:40:07 Switches begin

12:40:07 Switches end

12:40:47 Switches begin

12:41:14 Response: 12:41:14 {"status":true}12:41:14

12:42:15 Response: 12:42:15 {"status":true}12:42:15

12:43:11 Response: 12:43:11 {"status":true}12:43:11

12:44:24 Request query: 12:44:24 1443300579261932/malware_scanner12:44:24

12:45:30 Request query: 12:45:30 1443300579261932/malware_scanner12:45:30

12:46:23 Request query: 12:46:23 1443300579261932/malware_scanner12:46:23

12:47:23 Request query: 12:47:23 1443300579261932/malware_scanner12:47:23

12:48:36 Request query: 12:48:36 1443300579261932/malware_scanner12:48:36

12:49:59 Request query: 12:49:59 1443300579261932/malware_scanner12:49:59

12:52:07 Request query: 12:52:07 1443300579261932/malware_scanner12:52:07

12:53:00 Response: 12:53:00 {"status":true}12:53:00

12:54:45 Response: 12:54:45 {"status":true}12:54:45

12:55:23 Response: 12:55:23 {"status":true}12:55:23

,"event_type": "DETECTED","sample_name": "a variant of Win32/Toolbar.Linkury.AQ

ury.L potentially unwanted application","sample_id": "a variant of Win64/Toolbar

Response: 12:56:05 {"status":true}12:56:05

12:57:13 Request body: 12:57:13 access_token=1443300579261932|cfedb1bd1113405e09

12:58:20 Request body: 12:58:20 access_token=1443300579261932|cfedb1bd1113405e09

12:59:10 Request body: 12:59:10 access_token=1443300579261932|cfedb1bd1113405e09

12:59:34 Request query: 12:59:34 1443300579261932/malware_scanner12:59:34

,"event_type": "DETECTED","sample_name": "a variant of Win32/OutBrowse.CL potent

13:01:35 Request body: 13:01:35 access_token=1443300579261932|cfedb1bd1113405e09

ed application","sample_hashes": {"SHA1": "1F4F5C8AF912F865032DB58E476D7AE6DCF98

13:05:13 Response: 13:05:13 {"status":true}13:05:13

13:05:17 Request query: 13:05:17 Response: 13:05:17

13:05:21 Request body: 13:05:21 access_token=1443300579261932|cfedb1bd1113405e09

,"event_type": "DETECTED","sample_name": "a variant of Win32/Adware.ConvertAd.AE

rtAd.AFQ.gen application","sample_id": "a variant of Win32/Adware.ConvertAd.AFQ.

13:05:41 Request body: 13:05:41 access_token=1443300579261932|cfedb1bd1113405e09

13:05:50 Request body: 13:05:50 access_token=1443300579261932|cfedb1bd1113405e09

tially unwanted application,Win32/InstallMonetizer.BK potentially unwanted appli

13:06:02 Request body: 13:06:02 access_token=1443300579261932|cfedb1bd1113405e09

13:06:09 Request body: 13:06:09 access_token=1443300579261932|cfedb1bd1113405e09

unwanted application","sample_id": "a variant of Win32/WuJi.M potentially unwant

13:07:47 Request body: 13:07:47 access_token=1443300579261932|cfedb1bd1113405e09

13:07:57 Response: 13:07:57 {"status":true}13:07:57

13:10:06 Response: 13:10:06 {"status":true}13:10:06

otentially unwanted application","sample_id": "a variant of MSIL/Toolbar.Linkury

.AG potentially unwanted application","sample_hashes": {"SHA1": "499575E182AF4E5

13:19:26 Response: 13:19:26 {"status":true}13:19:26

13:21:25 Response: 13:21:25 {"status":true}13:21:25

13:22:36 Response: 13:22:36 {"status":true}13:22:36

13:23:50 Request body: 13:23:50 access_token=1443300579261932|cfedb1bd1113405e09

nt of MSIL/Amonetize.AE potentially unwanted application (cleaned by deleting)"

Das könnte Ihnen auch gefallen