SmartHawk

9.8

极危

36 个模型检测该样本为恶意！

重新分析

下载样本

6bdea2f3a3e8a1b0c1ffad01e8ddd0d9ffba5ce1feca13f5c8872d7ca122feb3

cb18c47fe6811bca7c49199222388e7a.exe

分析耗时

148s

最近分析

文件大小

789.1KB

静态报毒动态报毒 A@8HHA8A AI SCORE=75 ARTEMIS BSCOPE CCUJ CGENERIC CLASSIC COMPONENT CROSSRIDER CROSSRIDER1 ELDORADO FVCEOE GENERIC ML PUA GRAYWARE HIGH CONFIDENCE NPJII PLAYTECH PRESENOKER QVM20 R277261 SCORE UNSAFE 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!CB18C47FE681	20200908	6.0.6.653
Alibaba		20190527	0.3.0.5
Avast		20200908	18.4.3895.0
Baidu		20190318	1.0.0.2
Kingsoft		20200908	2013.8.14.323
Tencent		20200908	1.0.0.1
CrowdStrike		20190702	1.0

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619942805.218751 IsDebuggerPresent		failed	0	0

This executable is signed

Tries to locate where the browsers are installed (3 个事件)

registry	HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome
registry	HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Mozilla Firefox
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619906638.21825 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.ndata

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:875655008&cup2hreq=35c0cfb530cbbdc5177113fbb2a6859697f5e0d39d39ad77b5f30e4b389b83c4

Performs some HTTP requests (34 个事件)

request	GET http://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/index.7ze
request	GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/index.7ze
request	GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
request	GET http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
request	GET http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
request	GET http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEHSfdSPcp6pyLdnEz5lZ6ec%3D
request	GET http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze
request	GET http://cache.download2.casino.com/download/casino/client_update_urls.php
request	GET http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom_new/casino[de].cab
request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913612&mv=m&mvi=1&pl=23&shardbypass=yes
request	HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m
request	GET http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=lTxLnE2Nph0focQCMBxk1LSuZ9RdVROUf37PaKwdAk5YzaNYJSReliQi%2BRt%2BW8yoUXuHvXIoYvKf0fDnHpdtMx6sQ2oowhva%2FzYVxcjS2AbgAN7J%2BYQYa0ZPRrZlhBp8tG3GhQ%2FD%2FQjCqleUjO7DlhIIp4AQ5yXCEit5ny%2B0WAvGNY8VOBXOsH%2Fch7Z095nmwXSidAYjDA0SFyrRgvLegLXMh9D66f9U4xNcoHILIUaWHsUn6%2FxUvOiMrivxPANnZin%2FQHr%2FsfOmZjg1XOOlI8MT8G50jBEHGFkOJ7krpXTkMM%2BNtJaI7vBAduWDw31dCD52yA6FB1MApOf5z2SZLtcAxf0VxtevBbbe%2BV%2Bt1xDPz%2BXsSbWFffR%2BwZ8PTsRwLHo5oQQcTjEMBgzCX8ArqTjZ0ej1zPQwPlQa0sjLjdr6O8mADXHHZP0lP9Snjjo7JCpJKR%2FS73PTAl%2FuzE1emoPH7mW0UqHK1RXLKEAk%2Fyb%2BuLk2qozlEWw3V0sCO%2F7OBljvSthp6c94VcFptiu1fdVVivS6GS0qlIZNZ3ZXzA%2FxoCLp8uOKF8DwfHuSTvZU3oEnOFz2QccuHPvQby59Nsp8oT%2FGzfCMBbIJSlybz4GgssK%2BL0KoBdXvfjbLFqqUpxCT15LWezIB5GyN1%2BpLi94Mts9IXpYQ%2FWsdo4L0FA8%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=WQ6UJcHBA7LhO9Vbjky2%2BvR%2Bh7ughnULduocYYB16GSI8gDJbP2Ha00cpdti2nRIXQjg0RfXZNDwbjBqsH8OB2OiZpvWSPFf4GkGvshfqe47Zmqo%2FkePJJhAHkmGUdpaGz3ND1khhS0KRcH6KtyPPJ%2FOcXKIzEfGa8MYiSpt9phJNqPkeqaTcA6jTUDpwD2zYvR1ykiUvJhYl0SOD%2B4Surc9e3CrTTPe8rkXvSLTBwCDm6r6mWBZucjcwGd%2BqWVgVWMZopp%2BonIhcOr9JUQTC6EFgvcj0R8rkRLKul4LAs%2Feu87I%2F%2F0p4Z8zaG7FwunrudTxajCsaBcbw77Uo8JIrqVGYLTG4ZfxM9jXlyvXtgbmFW0ZbYX%2Ft7XtRPDr4AhhT%2B7SbpT0aClD3UOMtseC5pE9CirVvPTs%2FD4p4g0dpJgdF3bPy3lVklXDBCEm7S%2FB%2Bi2TTOTjXrl0qUZba3xovDFC%2FV9Z1Ld3iFD0%2B7c1ysprrexiZGWQkpPu9yddDD0mRL6RcslIe9b0cO2RWO4VJSbSOCp7H4XzuTYA3iWpKsrWOmr2xxR0edENLbF6StZFAls41SPMxdDCE%2F3auj1A%2BgcRaFfIRcyKgg4%2Btz%2Fw51fK6keoskpobLGJFbmsikKkAU3FnDQEFnfyFIQXcvfOLTCCmNqYM0Ams5IIbbQZFdQ%3D
request	GET https://c6m7w2m9.ssl.hwcdn.net/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=AU0k5G3xBhpWisQRFSG4R6FPC3KJioZ4tt1Pk%2BW9EzgEFGU%2FEOboid1d7tlBupVViCJExv6WlDt2BYXFbFfYhkkF%2FUf1fmF1H8dNIoAZbt%2BxQE6N3%2F0H0OTYjYZpT9ivOSYdKT2zQb5Jl9MMwTvFbmtqz9aQ6r6nKEqz4KZY5yTNNM9j1D73lof5Wyk0eAYInUlkmLR2a%2FlkeJWKKw9VO8lLStEXdMJA9Eur%2BjatKTZu2oHUnSryR%2BKSE09ehZFBwlE9Y030nXb3dr3uVztgcl%2FNGCqtbcz%2B3GHSD%2FYWnqYiHsPxFpG6vv03YvGAH9C4TT8F0cNNNXs21n0Bpy4Vent8lGRHOOJNC1ILlApOiFBpgOF0jMGGJZyrt%2FCSK%2BxxfatMhwbBXj8EpHjhb6kutiov6bxm1keyNoZ2SeXSQcqGc%2BGWgl8vrK5AyyvCnrJ%2BS1g3YkR9qucOKqjteKsmjUH9O7p0KQMXziCRJYtH08VkGhZrHhUXCAWKkjSueOcqrranJYcM%2FgpSRl6Q8t0WtspiS1fMMiqyidhJYggGTRSLZF%2BR%2BjYwgtVkuYmK5sizd4bwZoRttPfPNg5TBD51ZIcX5iLWdWneaJIRmZ79AsqQT9PKIUEoB5flkGpbRhkwOULh36MZMdvrscGhyF5F%2BwO3C5UqqgyIBw8zv1WwgR%2BQxzCUcaWEKtMZIPF2P1BuPGX1EPzDYgiAjjDUnXtLcK3%2Fn3E%2BNnTRQFD4vEzYX2VuWHYv8lP1R1o0CBJotX7sGvi6wDgAbJGwr%2FMrcno3crJxhmzJqhbkpdVRDquCphX5uiqiDW46T6aW1eZnauAXRFh0SxzXLzdgf5JwKds8c4JwLOcdRiIZ9z8MeRXxRo6%2FRBvWdcWxYY34HPO%2BYYJ5A4zHwtRSKFH%2FIyZWHPbKf5kkSKxaDgHdckVA8KsqOqS5rzD%2F0sQZf2iBHEyZTCG1fWGzw4UvsP%2F95Y7chmR4fWtyfMbeGEmD5r8g7kAN4CzHmrbO5ierrIRGpsqccIwN3M5RLBwuc8gZWGm30V5J%2B9EPATawePJ5KMdkQzopwUdAOotAgCYnUZ8EIr61obZUQFocgeJHFy6JAbI9WeLEQUhAreAx1YH6Z9VZq1v2%2BTBeLyAVaQDlDBgOs%2F%2BdpCnr49ybOqNSX3ysiOEApwUeOjdx25LOiOQ7asz%2F9tFvqGCBQKPO%2F0A9hpJ752DIhK%2BbtPOBrfHcpR8%2BehvRqQn2TltXzLZq6eEr8CW%2Fif9vIxkyS%2BQzmHLnlLjZU%2BWAc%2Bk6FaOhcsRMc8cWrH43myBHwF3dm2GFZShSKeCC3f%2Bwm85uQfwHdYY%2FiFKNadEv8BftqH29VECBxZtPlSjsXq2X5w%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=rMkBvbL%2BuRBkxOjPso%2FOcggydXIhbzC0nUSvZlEanmJ7ajdkPMKWE7CRqYbG6eztZumAVgEFH488bDDYLR9MpXIUKA15khsn0JW9EqZy6th%2FY%2FU6E4TBmgr%2FraPJH2gqPlVAazKz7J5K0OVh6I798seZX9wjOVaHAN4is%2BDX34cw4Fr2vhqhhv0ncqnOkIVwMQb5eygXXnn0YkSdjitvG%2BDZCGcQbatp3nCsQUXlCSn0zgGA%2BUxweZmQWuD4IPZmintMEveXud35uz0UzuuDXr31zsaOQ%2Bdqv9C0cz7gdbwHGMQkWYCB689lCmaHrSIGeuQlcchucWUNUs6WuHEQvsRJ%2Bu%2FXVoZDR8yOF2N2ZoiSLvDHBnZpyHSAs8XzMLx88rM8OZFlwvHLFVDjQTte%2Bprg6JZWznpfNuredurwOjQTleiBqSenNktvwUcbamMEOh0rUjRpsug%2B5jYCtWMm1IzP3hO9gxKR9w9aRwo63PL8jgru6yqfDf27Yczw6Bi5DRSE%2BREq5XA3pXLmRKdgwZxNnIatuguzTL3KCrDqeIDP49MEm3UA7YELKyoF6HgdfZEJa4ErbpTueuXu1PwmcWAPnHVzUgPnhoZvVZtq0JtB5%2FIShwfiRyHVFbzp%2BQfitNS%2FHikQjC77X9hVvVXBcwYlK5Vz%2Bsbhsa1F6bPEEIZ%2BSWQuOXMQtWMBfmUa9pgiFAkv%2Bl3I7K4pX7OOSxEEw1AKhQmrxnm0Y9bhM7mtHppZy95vu4qiLGpDkIpeU589sPSmhBLAxIk3j8z4QTQgNv5J7qWoxyIhTpkUaXNClMyy26IF2eoR%2Btjz7932RZFGaU79pPhdj4q9KdIjpiGmTfxcU%2BmnqjEQ6aja4bvuxJBIMZiq5nWFYwk%2FGuKW1DpJeEvRVqka1AJA8Cbn3zeWLykUbSw4zIPH3qdPys01pYJHoV8XTWfICDynQ%2BDPRZ78Na7bxDarqe89r0DRVXGD3UpZmt%2F8CIaF4MMjjZGXsEu5Qa3J79VCiddLwXmLVNH9UgUoKmk%2FZ5%2BkBeE8v3BvPW7cKwtcGPqwuTjQl20J9oorm8H%2B9K4oEWk2uaWs0zDP34oFGloBjQiJ9Qz5Ldimy9lqQOrnTkW6WlHs6ikt5nG80dkaie6I4isPorG%2BVmp9CyuezI4DfI5pVdY0Vo6gRo4D%2FNS10%2B%2FnQzTCVw2j%2FpsrI77HD8koxIaLOkHmVZGJkVY0uCV3WtLJfoZYrd6MHXCcdzH5k8x4Ok8l1pln8jLf7nIzD3%2BK249Y3KzK09wsxPaGI%2BwQyXgdgFEt60QtS4tBxyYkn9RkVhd6pnT2nMtd%2B5HMlsBYNsl%2FLFpItY7c3NJxpnpt1mlsoA8qYGlGlw%3D%3D
request	GET https://c6m7w2m9.ssl.hwcdn.net/playtech_cabs/casino_casinocom_new/casino[de].cab
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=e5jj5NhS1x9rG1NHqCptDeh78i7ANIIKXuavEL41POtJQRxPI3UBwju0KWQJU3CQEuJ0bPzFap%2Fm3RfJlNrcrukgDFctf6iXjbHdjTz7QVVv2Inp8nWZMStl%2FUIaYjm%2F8Su0NKPshZnwIwEei6KUhdEUYtjbBi7oVcHska0mPxI11M6XolaYtHZVhtYxRies8YZ5ZT288m05UNgVFH3CYm94fcjXElzUTBS%2Fkn9aHxt0AnBl7oiLG0AKKxuc50OS8g34FEHrBoSExTvDsDyGSCtDtkaonL1Ek1wvrcSxIk0g6DUi77RRRlQ%2B6zNTZe3eQtkkbDVDpzqAgJkyIN6pgiQSrcKaGImfEYcX00VjasG4qKDxEg7CNswzLIM4f6Objrsl3qv8P7kpBmpFKXKRzDF8nNRZpCDj8YD2ZXl4%2FBIppJauePnwrPXR%2BDzJUHPdO1JhMNMc0hV8c%2FmCD4uNFGcs35sv9yzxqCNsJ%2FTI1DPm6b6cZPF%2B87bAIYUcSpjuQD7bJPpLfVRW3LzeDiTPsMNZP5z6d1WnBWDCsJ3%2BeCxucM6SwVm%2FdDU38Zg7leF4VV7%2Fx1SP0%2BikCs4DS%2FqVvg7qxVTxYKz8ZJlyZe2X58ekjuFjW7S2W19P4KzPoRLW%2BNYdWT%2BPrsbV7ELOpMYB7wMA8lm292M0jDXyRQ5VS2Up%2FODcRWpKEXZJE2Le9cnoRgP9ymC6aTyNF8YUGgdCRlx1%2BGGnclL3709kZ%2FMNvJr3bEHXixxmigp5hnBcRH4Eg9WwGMLnbHuFqIGadjPoEpDsmkKP7ZD%2FH9olm3r0aMRo51%2FizfYCg%2FG0Thvpb2ZYtFSfJ7QUbnjStaO3Hi8TD6wXa%2BxJatyuWt2ii%2Fwnq30eFf%2B454pHcAe0fyMepFxCwrcbcrXH3wb1pgAyRveBAcknw8dbHOaxJ2CiyIJaDK1C0QfZpm8xzrIIG6fJi4cnsukJA19IiBKKiUa2QwEG%2FkakSaCSwceAxN1wCQTTShJW2vRUqhmlRtSHmXxfvl0DR2%2BsrD%2Bkl5WmFP0C0msxhWs47umDW9SqnJ4FmrToyzdxLTmf0w80JxkfBQlafbUdT4ipHqez9RH3sHKSDYV2iLkbfE%2FKRknsWR7w5a1vMsrG5VFN37lA8LLD0my5kl%2BehPaEsdLh2tSRAwGoOWSd3Llie3nO1rz%2FdUJ6%2BTZtJlTSt9Yfz8a0ciJ2X8ZwuRxyfui1Zfq8tJB11oMP4HRp2H9Ym4fpJwUj630AiOjwtEmPcGUlSV9iPTiHliI7ibTeWn40kRFBl%2F5p78EhAgkfluIzUp6CJxwpLB4vA2Ex7OkL6aiybgzGAzEBxUKMoshEJPeydjfvPo1gxcVPZWDdlg%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=xNokFxkIPvuOGiwHYvm6kZs4nnH6NNno8cRm4rYtlXB09hf3Bii51e2hv6xielCz5GVlRux%2BO7f4HgpW0mNaDUxfzfybw7RwvllE5wsOPqXvCeabt1b1HVRLi%2BKNdROPhWrMKrGNyQGOw4iwBLbJl7JLR7D%2FZ%2B3RR1CVj%2BgXZdovmvg861xmlZW%2F80eJo9QrEHREoHxtvmmzqZDSagEfQCQCEn9lkNytBzxhg9u1pXoUxLksOb%2BiZkFq2KIu2ipLGHC89ALdOvWTQT3eQv5265BpG0tMzAdl7l%2Bw50%2Fu0Z2PJ5FaQEVVXLyVFaFbARotv9n1MC%2BoXPWlteEdnz39taKNdDNw9N4lW%2FHdEKGJO7e6QGurQ%2BLrRM7aGHMY0ur2Qkp%2BuEb9hIOMz2Nj62BbOFhZnMVm2Ee4Ot%2FGCIsSRp2jeYwFy56fU8oVUQP0m5UAWXLx42khs0wTm3CfZvmTFBvjYFBoRwLaxTVTmh8mQlvnJg%2Br3FK1HSNV0LuDQCw6Uqd8i6ZNlJN3hOK4fGJYHNCqKa2EedPvMqrYHC8lRmHRRYX4Dzzh6PCuMHtxEXv%2BYUNnfzgwjCQWPtdJc%2BYnbbDeJREyxX4tQfnFhKGYlMHRZnv8UAqly4ptyUerNCCXtgrrNivgxo7pt8mekJ%2FTpm6h5m7iUNAfF4a%2BrAQOvPI%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=sC0k9SUr0VP2XrzNm1CDB1KVmIYtotZicq6GQ3DYjjjw73u7yliTud8Exf5z3OBOiBMH9I%2BQq5K9W%2FP%2BdR1LudO4P0koY3Z2fPPeRceXReHjDrO0i0%2FA0pFbjG%2FuycvYY8YRMjXVkE55l9pMrYokOU0l%2BItRayp8Zd4bJM957ayNPQTB1YPKosudhK6U5Ia3eSGiB0gdC%2BnHjWyrVl6T8lzFM2KzDopKRivavzfnDotbyOQww55UNiR8nFS9UEsNGTIpU4liMAMb9YXDJznDoMfrklAdEotm4v58nx2q%2FcUENldK7M6L5gknUkKbAxy5UQs6wSJQfhuGwx8pQLGhKTqYNFiIweLF5ZyqZ709rZkCYWC4X6y2U5Dw84XafVVpzUS%2BKPgWLdovxMjIUAEjII59WX6xzIklsqq9zM6V6pP%2Bi%2F4pgIE37tkJNf7dzfnal%2FFlCczA6jFcngd31Qpg%2BMb3nuivAVu6tuV8yEMTNo%2F2FPm1w6SqMVEgrcSmNLcH5wL05J2Sv71SXj91nc03TGMFjdGPBlbIq05dmYLi55p58SI7KKM6WUXBqWIkYVc4JitY%2F1nes3T0m14Nui0W8cU3UhBWr71Rz0G%2FLI1j8%2FWb1Zhv%2F6%2BJMceEeVY%2B1p2P8QIkXr9asFm4tdpGxDh5vGaQ%2B3w6hUcZfgqx2BJi2TdCd8sUdt9Yqzz0%2FNzc6dO9qtvsSCZkefXpS7%2FohQMvfcc1Ssd%2FzjycsH3W%2FAwoy99cC9Pt1l0%2FJDD5TQJB2PieE3LQnMFJBLUU8pkDzlF3ODCBRB6zELD%2FEhHwQZCPgQMmWixyN85v4CWUHem8UiHzN5pQHL3%2BcEEDYUjfFhKsAv7srNofi6hA80ptmdwpedzeanX2C0nwQ817Xgwtrd5cXTVkmg2%2FYbVAmE7u%2Fmfgp09Gkk5K2U90OI7TLGuYGjXBBBvrFR3wzAS6gHKDR9yuUK9pcauskJ0IbuXM836MUU6N%2BQ8OFu1jZOod0qJclF0zW6AWskB8%2Ft7HvygGGt1A3w2OuWvdO%2BBw9gxVT1MuXfsU%2FPj0%2FjSUUppq2AXRDLQ240hC6m9kFFggUsFDO1V7i%2BVbAQqgIR8DwYXdhei2Ul9ZtChwWg3kn2LBKk77fb6HrCw%2BLzHJ5968c73xQkhAnaOLRx8%2F2VK5acSfu1yLvL73TFNpDUprJgeNk6f7ivIjnTbTKbzesChefUrDrPu4damesdrWkkerpjyvUobS%2BHVD0uTi29B%2FIQMd%2BD3lLye58ACvtIZoxCPC2CzRgkGc6MXjOVbA%2BNo11hqYMeJnCLDMoEUUf4WIHehruINfbsD6uhzUhCyhgTsVtJj%2BeUBA16Sksjx0WMVnbdhKDrPV1A%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=wih5RUlkcpHQuhmiJqER0nAeSWN79ott5M4XAaWNsOYX9%2FVAycZQffYcFceF2SoR5ccwMxC87bXal43yaPaJS6DRNoXu3F4YzN1K3yGucU79XEJVJfcW95A8NIEsWQEG9s38Xw59nrbyfauW5rl77svnT1u4PFz2yabhPDalMLlzKfVojucGfFesOMNVypsq8WjJtL%2BBHIQJ5KSI4GkeS9HS90PVqq%2BmwDUrdn8%2BfisZgcjHuJhslNGZ9xpqbAfoUnjj4IYX9UZDRYHYkggL2GT1qNKmQw3k4i1Dur2cpamciBmNEaA%2BNqAxHKvuQxZ1%2BIKqF%2BN9INK46LlPnRCdqvESLRRp9MFA0A2y7I46z2X8zBJLxPh%2F1OB8OpAKeHTA65ISYhGKrwow0QXI%2BfVo%2BsEXTur%2F1ckPfHYdda4bWFY83aAnqPNnIFmfTuuk5A1HNoCbXxUO4qf1zQL9vWUaUNg6So3xLoJEzDaxNE5W0fce4OctxzNCCZ5f78bhk2kXDBUxPRUGTp1uqSUX97FiIjTQrd%2BkIucSHp3nnAGdNgUw7u8UzKT8Znkha3Ro6RfzDZ9QTZj7MTfmohxOlh7DVwkalmKDI4yCai6Vc93iEAjvq61vE9FNgCK%2Fobsql9orpYgYSiz%2Fw9gTu27n68QjRCxFN6J4R31a1uSGKKwz2fQsyWJmrvVkm%2FaNrGaFxUa%2BIc985wA492hjw25Rwx5b%2FgRhYQ2jdG%2FxqS8bC5eWYlCKzvpIiFMyQ%2FHG5Z3j2smlEJenrNRhsbpKIe9jFf3k4vjdH1X3xOAOSMjRs5X%2BmuHq29eJKTu7Jae8ZKlDUwfcpivdztF9BJW1xFPFrPePPVQeBa0anJg1RbKxttfjggd0j9Ypiqp%2BgxP7Dldou%2F2IaOjVZQ%2FezJyWoi05IDVO0Z70xLHgImkEpZvfd5loDHG2FPKuirz%2FHgtcDMli2Ag946H1PwR9%2FDCNxaML665HmEIo93Bd4Dcb%2FBh23t2Gij6IASVRTaqzcs5p7i%2BTNjzziJk4kTdmqnVMYHuogZHD2y1%2BrSBiPX%2BBpLj9IGW78n13Mi4vP1n5qWB52vUB60YEdEZv5ImMS9X%2Fwha3%2ByOt7C%2Fp023H%2BlryzaYNfH6JqRwFTEa7fi%2BlsKogZwD15UsXqXtqBPCGyFwmVURCqeuEpNLvPgykWnG1TP3x6vpm9lrnNyXMsIHMlSqyvXnyttiN8YfZAyqCAltCq5pAg3wypbLGjMY4bNl9VAqDMw4MdThtTvSzrdqRA3pxZQdF4SrADwaLDJ6kFqnArU1nGJcVuB88MWw4O124TW%2FHeACooKl5maN00CAYpTrTZ35fRnuofie5FKX5enE43Csy1QbBcg%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=nqFjJIVV9IENmGxg%2B2zWDNkKL4%2BVLjeTPEFDRathspuo36oiVUUN2q4DDds3VRVYMsjCVkdZPQ2gz1DGbpIqte2GlsgwC1qwi5APVUhR2Sdb%2Fm8LLrqB5d1Pr7dyFiw9pYs3KMg91tAQFhAdvCJpk0XtG3Tui8bfexlS8A9jj%2BHK5sTjwIWzMzWO35tMyndkapO%2B7tA0AO7p5RF4vtYNt1TSBqkH5IMZslqga1wihsDNEItJMMXWTJrWKZ%2FfHvkI4l2ISHxo%2FZePQWx2zGPm2oSdQK1BBdom%2B80DV7CW1vR1GshkdJy%2BBmB7sDve53WJcYdRnNgl2mTJyChmy6%2F9fhJVCPxFLQ2nrqfytmUkwBOT93WxjHLh8BuQM8rkM07c6a3VGBAzizg37il8yTNk9y8etjw9q0yRQyef3cwCw2fgbUAAUpNg1A%2BAtNCU8MqAWoff9tcyXslX%2FpRJSs%2B%2FgMXKfUgloZVTRVhvMw3A6qbY0FVOJaba6gn0uNu7CQM7T6bD7jtIGqg2QCQyGg9SCab6FR3Vt7l8pWoI5Vm5SOJScxSfCxRRa%2B7zkL%2FLDg3Lg%2FRxqIbqFVeGt8ecRONWkKNb1YiMSXBqtYlTozc1z3gOLkfLI3GO3MTOUb6fMrgQH2f%2BFYesHGyvy4jgokLVwhykitu4qWvIwag2pmksXsxlFFqibtIlxsCygM98xfF5j81FHdjwLacvMuymZdKGmcPti0k4s5MUIthHiCeaUgINVXLtzibsvc0zt6K2hY%2FtfZz5CQ5hQbe37htCXIuf5CA20C%2Fhu7OKHTlrc3qhyqplOuAdx4VZp3OV38PgCoK1JXFWR7hoaMSDD99JjpCubH0dgYxHg8oiEz4BzgeO%2Bt9xMGbD34B0fV6svr0IL1Le2MOL0I5RaJtv3fuDx2hbO8biY2sdDhBaUlzlJOwvs%2FwnRSf11UGPv%2F0XLIYKth%2BC5hAd%2FiPLACviw842mmCUXem0tg1RZfli3s2h54SC%2FliHe%2BgV0PZ4cponJWgzFwo91tjaj8AACXob15J%2FNm%2FWn6P2d56ix7GR6CSzRczR1ceCbJy2kCf7fMtdPPqV%2BF2pE%2FuBupblJ%2FMILeWJQeW%2FD97q6lqyELH%2FXtV6xH9UkotdmctRROJKTYHM1yuGaVuzKvKxVmSiN0v5z%2BaY66H4lq30d8Ll2UXJE%2Fh9ShEl1TFWcVGS9xZkkK421LyzbZhoMB6OEOiyHgoNnrmUdCzgLnjyc9eiHXeafZ4%2BK%2B67mY6dChSdxYI9l9UesXftl423paiZJWcKK5oA7SsgylZV9MB3u9Vmqa6t4azAOXLyauEEdjGucTuX7kYAERYKa6rmkdCPdaLB5O8f9hhcdxqF3g%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=jSY1FmMt5FqlwahrWXWuK%2Bn2YjiXiDRdFEYrbTGw%2BLoMQawS1nBrFCIi6FrQLcT0U8DPvSYH%2FZebsF09nTh9ffgchjOhumya%2Fht4%2FPqp5SU0OAKKXZwW1rT7FMrJsJmzJLvD%2BJOZGpZV9cM9%2BG2HUX6Wb%2BsLVqdELdXJxYIuMhvCsWwyremY7R4YCNR8t4WyGzdX8Vskg%2FkrUQQCyG3e74Jg6zAZAYTNeCZoUs%2FnX%2BCSCE5DFyjFtAbhVbJAgedye%2F4UYpkubtJ8gcjzLeXkZJbivEf0EtiOq1Z89OelYi0%2FwzhFAvBmhdJ1RNULbQEvLdhPxBJaiWa5GWTlYFj%2F9hDLRxNYvfmVcCQuOqx6Dx2EUit4hjyYEEvCEsS0O1p%2FspJJ%2BMzU9P3nh9IyDMFuDi2tNEqp8FzgK%2BCzaXxtdIU14RwBR2%2FneSPIyaU5jkgTw6jC3ETGZOi11W9rbLl1niQ6dxh%2BkJLsso5CPkefEt6zpgSKBGzYgVyvY5Y5eV8b1NyDOunYt7lY%2BCpVkNuNZ2UeeyrlyxJDdqqFEzwbW0wm3Jmql0oEGuVzEKNdOC2m19JZnyBDoPYJmDwyODYD21aycWKV%2F1uEsvIOuYKhCvg6p4UGbJV9kC0Uo6W9SeHMefZYT7TEOoxOB7tt8sNVyPE09BaWjVlPA3EBPxh8ah0%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=j3%2Bk24UeqhmkP3ywo2EDK5NSbMLw8lXBSi2%2Fa4uCD%2FJFuMPjn5Zv4ofWlQq%2FhMjMvs86h8JtsWdS9tYNddGG5MnRU6ofsSVsLvcmttvqD%2B9iS3Q6bcw6oK5SBBk7eI0eI54U%2BGfL%2Fro53uJIBbElxUxQ9TaxpwJShb4nY9Vhx%2BkmhMvX9hLM4BW39sWHcuQzex2m56dPL8%2BPvVDUv0qz4Wn6PTTU8%2F3jo3DAgaULuQ4TDx4uoh%2Bu5jJnvIvx52sLLcyB8x9zkO5xjLMTF1LiLKhtTtaDPsVnEpjV9p2z8hbTS5hkuA1nl71s3jl82dEl7ThplWw1T9xA9OSEYf%2B6WrVlzZ0BX7gik%2FNfcFpWahdtKGVuVstCoh%2FJjrE53j3vho808GZmmR8zC9sJOCzjCXQw2pvAzWKfW9w0CwCcISl5sBtvf2zZiExBn35VW%2F%2BK%2FRS5irHlGJZcKd2np939fmXaQyIVd3uHyjvJSjP3%2FqT2gZc%2FjgXPoPHRZXeYbyI792pVbKACrdAJGlWcxTtuaOrS8A220Q6ty%2Bwok0iSdEkKmlNLLr80j7x8os53HVFA38iICjscqgW65DZpnHKXRNp1vQaVHc%2BUyadW%2FGNRmM3vMeIV%2FXeyvjwCWW6X6ch%2B6kGY6sFo07QARu6tTU2%2FB6LNwJsczidlcsAUEepyxtSGmMOBy%2FJo5M%2BcTE%2BXW%2BbWt%2FX3L3Jqn1%2BOa2tBX7Qzp2LWaEApbaZ%2FM%2Fj1q5ykNcwIZjA7DUWINVLUqWQFdFgQz8Pv%2FFM%2FCU5hF0nJBfd6gnjZ2xcfv7QLLfNQxMP79m7oQ3uxXMoPA9jLOb8gRurni3qM%2FgH6yZdlvM1KHxtmFcVlLd9L22TE0T6%2FWeODmd78DPXVOF7prfIy6WIpTOnDCLBad0fWwtIv3b%2F1uSl7NcmOu0SpCLMUnhwrbehFmXsfS0lFNXlRMAM4XiUdEXbrIWdNXQpzg8fD6ZlsXYZRgXCixdreYTcZAWNojJUppLGvgubwiSjRCkaUCfFdrZtjpL0haePEYoVaWc9AOy%2BvEkS3naUBlMQoR67o6%2FowCukfpyNU3NHdvtbOct0eVoCmT%2Bw0Md5zChutlZ%2F4EXiRMf4F1%2BqSMGhBO%2BTNMibaStEISQzA5yXNwomKBp8TgQYHMpgMCromWijWMdUEa60spXpKFzs34AUXzunNe1dqBvzX7XIvK0WSK%2BBcR3Hfua1l7ZaFQ1%2By8iK8Jc5UGtlrqZUDX1rlXHKygf2zusoc%2FdNdQJWGY6wnPa48nv68dtxX9BC9%2BQicR5jiX4IO22jQsrQ2%2BlSePHsXn6kTKzeJvSmgHd015JQ75QeehIJg5oVC1wRz1vN%2Bg4vbgtOEdymheQ%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=LBnMGqom80OtBfYtp5ZGqCQqWi4yV%2FoiR0walqrZTLDNaETSrUm4qo9EQ6gm9L04LAIKRNAQBS1pt0MFBrXX14EQf0l%2BGhDhxKHjwm3QCPEqMoaLNRRbM5m%2F451XT8d7H28az13z76feBV3%2FxMiibMaKDN2LGsUAZsKVBdYvpmgRwiT%2FvYa1HIUSfmoQlCVT6KwHew%2BbX3lB3%2F2Ml7hmPPt3wMZM4rbPcPeFRm7a3HhDDgJT6zaqNtOUuH6IvFvZfXA3FvjPSgyNUSbSwr2CcunzzmvShsYJ48k3NxMIYA7aWqZnpb6w0pHB07qGB%2Fr0FnMWHpYn2q5%2FoYcwEz45TbYzsOf2znmzAfuRoUfWi6%2FO2IUDrcxGjV7glvGfYparCykbFIxYBjrzbpREL75UlHHqwWlFje29mfnKYPdi6alhpRpbJjgMXB%2FCnUZ%2FIqQ8hfDMh20zNcqun87ZZjJ%2BVPAO05NzaW5SoIOsTjS7iRI3JCPMCPbGtCNULWsBmvCMC4YQnbiguJNy%2FoqeEV6y0SC8k5eaSsDkmdlFBpqZoh9v5MHoeLF2rUVgSKlKAYDRXY2YW9yAmvhWbagSGwfzG3BP1Yi8FrSLSFnJ8MtwtjyGuiXJBvxgAsG8lp%2F%2BUvMCExrAIjrp6co6ZS5q3EHPUfqIo5ZkOqHLc1vvofm4pXs%2BNDANZHxlb0l%2Frc2MnENBr0HMXiNJQIzYVSAO0dxv2geCq98KNeZmO0hNt5TC8QR01nOHlRRMQLc%2Bj3%2B8jelAleYpRv%2B4U7QwkJI3vBAvPpDNrkJraL92%2FGQS8xUcN8HUPDHxxHYVixVg2LN8uS%2F97hOUJTee%2BRYZaFtRavg%2FUTQiel2Bma1SZ14XoVpC%2FBbqvpv6s7TbEQnWKSAwFUaUGd3wDMqihaNehIG%2B2g1YZdScjhvNv8MsBPMSYTjRjVKv2p9XyrrtMCa0y7d%2Ba63EqfbOYjNmu0L8ujWV8u7l%2FmbsUgwMLvlimWTRqaUlUQ%2F6RUSQjKuJxzfkQ%2FhpHlSIlmQDRzTLdZIHEFOkvQ0goWs%2Fy8lbvfJ%2FAfojX4fV7RlIpg07BjN0ugevjrNJYkDJP9ipKNs%2FJkbE9LBRV0t%2FrFNQuxmYAXVmHq1u8d9MjQacnCiPG3Gma53DCN7knLACW23imD2lCKOol5qMtn3IS6jBea93ahPQ1t7uaHD08zZ2yStVsNstbhyhT5%2BGDg%2BKO9AM2PdRVyEcO10rzEoYy8%2FPyKBiixRQmysBaP%2B3yzRfqGtLIJFzfsdN%2FGvIvUcws8htEXIrGl%2FGTH%2Bq7qzNa%2FGjOmWgeriFvm%2FdwvRFqoRUARUrkLvDVUacyPk8E2utBxlAWqsq3V8YP2lZhQa6yw%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=qDEGHcc7yfsvJtSHnoPFbUAK0O1HiHCSDZH5jIYV4HRusREBHuurRjjha9gwS5sw2HYWq7PAWRN8emkwgeT35sC8aatvLMsGD6dPZwJ4%2FQRduKqqvDI6uXIsXCi6LbtNCmYUcUzbR4EzvfkQgbZpF2GqGaht1AZwuu%2BC6QFiISdejdziYORSQu6vcijl%2FzJSMFBJaoAI5ygtCkm6Yru%2BmV6OP1dou1Bzkh1grfLEu%2B6orsYoVhm88WydAQJ7whIivDTnEGze7RcmHg6r9SLkl8IIEp2Sy1Pv2vYnlBKZQ8PEYAtlxZH73CJAjZrXf3Ll%2FXqfge%2F867WJlCsRtLI%2FplvmiLI9u3J3t0RJG6PPwsdlPDVBw9RftYQtNYahyEiYlWZXO%2F0ddxAjqDpRqKLEGfxz2JYjxGZDyDdRh0HUPW%2BL7FuCtR4KAOozhM%2F0I643fuE5bXf%2BucZP6QFtVq7qOoCn244GCGNmWxd4ze5Ijvo1bRjCQRoFMVLbe%2FsLLnpVWy7PCrMY6smih%2FHavU1PPIN8D2dRZRkzOAmZdOKeRzU3OMd4yZ%2BjS6e%2B3G6CpDuIwp0wg3dY1KzQKXjTzDlp6CtBGal7TT2WMxjODHnbz2E9InnCaRL3thGCUajRT1TypRlvwiAQclc%2BGEI5JsU1uxUZU0pQeTnJyE2shZGdQWjPODFK%2Fg6iOYGDKdmcyAMvxf4r0D18DJWF%2BBQJSbYPQg6Km9%2Bd39qmbVW5ELLABm7SF9%2BqbFCOM9aLO92Mp1bRrwR59OXRrYtahmjbCxJsC42MWvt1JwQGHIsVQrz1v0xCxginElJeDdQt52O0K%2FXacPvmu9tNGBt0EXKHiupnT0oD8Hbg1NXchCwE8%2B5i9vMmn93L9fZoVGwsTADuuPhcNh6Rq63T5%2FuoXjddD6OSUMDecN9j4MZKAljZ5n3eSd5YiWtwVfNaxsQ%2FlE%2BxSUucz%2FwlZDVoah%2F2lNxsIYDJp6eohR6Wa78dQdb1Y5pVg73JOOkYKVbmuKfhpNVRHdadayhBBdbq4inwBdOG447vFUrALymeXxF2uTAAbrLxi2Eq3B%2FZbBeoZhApi%2FnA5soWY6rSjuivlywn625IFKGlcbs7Yn1Vo6BE5ehybnTrUTTntLe0%2BqA%2FU9aZQnRLX4x0Gy1gmO0ORVUTXvOT0mnIYQtlvQWzO6FDyKrMYDjMl501kgDfNEtq9lnPcIZvhd0a5BBwd%2BwBMpvT876jYbVRmm6Eo1HYjttk%2BJ2iPHZ2MuFDoIe7M4hANWu6w7QoHrDwQyszhzVPn6%2FZa0yIO9XqsQ1lRtJDzmLG9OMeQYxACmdoy3BtkgbuHmiUbU7J97u%2BzYMbm5TcuYvttJZtd7MJOQ%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=H2ibpcJ1ZRPiqGdbW4fT0uTFNm%2BgHIWeNM503PFUllUD%2F8ZT1F3xPgDMGtx8FrtbWGwsc45bqfUrXJvliQzxk9tcjZ1WZ4Ino9z9sct0hFRLQ9GhqXxSDhIR2ssGetyulynpfWXhisdyzLhto%2BPCBTBIO3L1nbdjskoxqV4ojuR4mFr4gZIrX7qul3JuZdwLai2nPDYKqDTh7tucvFRU%2F3ymD33CxsNl2VtK8iLABSwnONtDPZ%2BpT97wbczKDiTgJIb%2Fh2sPKP0uWNRbAzcxKYtnOP8Bo2p1uOO6nHSc7vQvFeKDAicDHXeAhMehdqVATtTEJkdu3y8nbYBeS2e51%2F4OMv4fqM0%2Fpo%2FE9SY%2FtkmBpTdgTsgxUU%2BoTcabpCyocR54%2BGaEfolMBUT3QqLrIt7Kj85gUZWqYYLvxoKP2gQr9ImqPVkKxy44utOXVaHPFA%2FvDaUM68EU6RQwSBY8vTnvCQss1bi5IWgCqkTqPpvEZu6vjcxADpmXR%2BcbIvqjdP%2FpTVuK2xmgry8uChVCS7Z8KoF%2FZ86%2BwzLQjVeLajgwttSnw9wJjRnM7JxWjctuNGGyMeGtpPcYLJwKXOq5%2FoZDesYxqu6o52kf7jJAyr87xJWZMvh%2FkUfYm7wh7CEgEvI6yvwLXMXKSbRdEqVBv0N%2Fz71iTOiVbU7evnUZaoRcog71gIkXIQnUlpz2KdHRI298%2FCdv%2B6IqYyMEY9TJfMx1oYCO5jWuZXVhS2Tdlo9A%2FFFWSbtyj%2BtuHeWCkD19YeJdEsVCGO6RFVofNrK%2FQbHfSB7fS52rkLNi88wdyHBvK4VTkYXKRCpgqT%2BADH729YnUp4L2qB97zUFxT%2BNoymrlu7IjpjiVAMrxSvMfd3r%2B2AV9IuH7N9URPpArn3JqWZPolh5R7Pxmq1F6ga9hKNUY7353zZhQ7esYy0ioL49ttvFIXDzgkcKzt5KB0ahVGW21SydCjAWnCbQlnTDEYO6DQVqB9vb69Np3WiakrorbBgCIjt7AXUNPLEgnJiiI3bNGY7dSgMGO%2FebK0k8DY9uIaOApSmMdO7BtwzbZe0MiHJ886QZrEIt83hZRY42PwaBv4eoCUh6OZlHhTmBgIMHpsXMD7BMRUnTKJShhxrMnWeg5Ko62aQ0AXqakxPDudmLmRlmYxR2ALwb%2Fg%2BnMduNWn%2FsUT6V%2B%2FtDS6VtS6GW3q3%2BD4nmR0pAN026NdkaqndxG%2BTSrzSfqvWKFBAAPk2BJHszLW1PMP3axkflNZ%2BFwGO57I8I6Z8HzffSYJAN02IdqOTiKp2X7w1BPUhyP123ZiK%2BHa8s2ltlxOHYzWfmb7hwigVEo%2F3WUcdfxC19fKkpwt8aP9WIQcIdgacTK3Q%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=PptsY2RzLPircBTWUnUMS1drmtk4JR%2B2vK%2BiD08IAkQh3jvI6xzPsMRvBUaY8BP0g0HdOLvpu8qup1Rl7LEXkMcarEDS1pjT%2BXr2K5A5EqdbAuQYhHsd84lACWmFt%2FVrRrzjHNocQHP324hRCX7lVtfhtP%2Frb8Ftca1ed9fAkwMeknBH5AkcpVJgymoCkasuyJGjo%2BP6E%2FJ5onO867Svnx0%2FYpqdOBgjhKsPYuP8PrdA2OXd2sywql4XN7x1nP5frUNZXBSRC%2BLUnhedJLJIsblbguT3BzJG0p3vghr4WG2mLLbyZQ%2BGgKrHbj%2Br%2FCgzQETJHrAUBpToLyd0Z6dUQPNcb%2BZkfDagwlHOqpvQ%2BX%2FHzsQ7cgJcqvMuRXlvFLMs%2F2yB0WRr1CwqsY24AbLSVlOPTRn6GLUD%2F8Bknt1zfpPJiumm4erFUSYkMCabbvVDKVnLmyaADdmCRATU9H6YzohvIidoUqBCRxT0oSjnXLevA8QZebxVin8%2B95I0J4QLyxuu26UA4Sn1Ngvg1irP8d%2FVFzmHu64113pmV4FAvV3CXo3ve1lGpsaZvtNATPpGaR1R6qMLGIrGshMLA6QOKcf05xYVAh7kaJClA%2FAxkbaOOBJFR7wKSH1%2BQ%2F6ugG6iePMEVuwuIYcY8LJRqfWjBQIfhNyX3TPqR%2BVXMN3HkuSSuOfEgnhpzH3T4HDvDwXIYntvjyZRvDfAEAPC%2BN9Bby09FB%2FWpEMJVbT0ZtdqWNZD%2Bc8LsAZ8fP0O2zov2H8VUv8Y%2BB5ghnFhkIIFpmizYcXLM63OnCI9JTa2wzcAjn3WcZIAudtxC2a9SytkTFhVmXT5f2mMMQcqtX9%2Fk%2FmfZqe%2BeUYdR2%2FPt5EDcrh3narS6bca8kCgRFLrGh%2B7B%2FwQv7FPQ28PLG6hOXBpjRzCQIPD71L0whVG7itFeBzK0PDAsOFPhfSR3aUfcjf2aRCEbMVrnqTS%2F19LByjL3slPbpXDn9jxfUWY6YguF8UzGFgTFMQ9I%2FLDRLgTIHlWXffxfx1H%2F67s8Qt44WzItAMzysn6nbt8p5pG79wcwR6oIhmFzN96EZBdyuj75L1Sxw7LfwfP%2Fsf60YGQOrgVqfLFc65SiQf%2Fa9CCKjybYxNIzajiTa8yKogkKupwaYxVrKcl%2BdGFCYu5FiBzjhcyyD8m%2FZo4yjf8amhUqdgWzIb7B7CDMd%2F76dTGUJ7o0gFo%2B%2BI0YMrGuz0iykhO%2FNwDagywHEKnvnKrGTqH%2BrPIk5HJM30Sq2kYo1ctb7Jn04E9hkU7AWIpUU%2F%2Fz%2B6sb5xFeYYk8aykjxAQzuoRBC3m4o70w%2BYmIZnbETP5Y3y1uLvdJ05orq08%2F%2FRXpJzNqi5iQhX5bA%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=IJOu6IyoUCj2yd66ggHrCNLzHGI0swUPsBR4gLME%2B1ASg9YIspZAg2ofaXn6wI2S%2FFYqg3UXYyQPBroyD2iqGRAvAjLs8l4R1fnoP0rw4zIYHJIzC9lzZ4QyK0Chqzs%2FtgIS%2BYMl4qsKTD2LQHSAIth%2FkqBv98NIYzACxxN%2BlQYX7h7D7ngptHGrgK45htNUtVH7wpn9RPHmxBVWXvt%2B33Ft0zrnOsJ8qj9RAPNEbSTPenj61u0hLvWZ%2BItMpBx1ejnwUwI4%2FG6tnO1xzVfIsGfAj1g5YKDoMaSNO0Ck%2BjZaL3iwPXqHFkMobraDbqsTMvrSgG7VE%2BD5ywCNDvzOONfFUcKzkNeNUSCCh7%2BVPjxiP5h8icbmhRIINiNIn4tqlKtM9m%2Fbk0%2FZa0nY8ipWu6F6VgNT%2FiOs4FigTGJJMGE0E3zAIslTJGN7NNI6KJLtvJviLvI8fYdG2JsfazY27Q5kwRKYXmeFprf1PNH6aMW%2Fma13xhzIFz9Bxr%2BCrLSen5S3t2NYkC%2Bm42SjXnNhYzE4MCgIr0zCUJcHcSSWoP%2Fpu8lxTvABEKxH0RDk4ThbFMd0YVjyVBLtFU6bYAG0O2rcQTymAY3gd9ecJ21wHZ8xr4Qnfl8VN2sxaTxeA7HCpql2aLcjeaOC5uznUrRX6n1vCMAqGrnDIXw%2BowmLtKtPt0wQiLp5xtZXsCIFGZuiKqxqz2znfCESDv%2FLP10u7eloLfK0yIUrNQqZXWiWA0JegPa89Kk22%2By90lS3alnO1D8e4JfqffOT5eeCDv1gMuaV63URoY219sUI62THMXPzQPMVITUgMVskbrM9fYapkNzt1e1uDpqi9KtevQdRt3tSJeL3Kq2ZfDxu3xLNpgwmuxqyoxKg54%2FlxtN8coEFCpkSX2jceTcckaMUfw7AlxiZp4Ws1wKj%2FNicLdQbhkpbYs5%2BghJYZWs6YeEK0AWfEXF4TzD3cft1lL07PhdXEnaDJ60RyE9q55YSmkOfa7t31tXIYAKJyiIFswdYc4jBvUzpSCct6WiyxAJqPju32jJHLug8MsgKIwBc3M%2Bd%2FLRZOrxS32Ssez%2FkPcQ6PuQsjxcOp4PqzVYT%2F%2FzQPhp3FfxOjLvUcO%2BWeTfYYGfSx7YD6dHaEHZ9ymUZV3FcZ626seDzybZ22BtYSX71xBwBb4cyCJjd5S%2BJOtvK3NrArcklW11Qy2XS0u4kaNHP0%2BMFupFUaMrdNvI9tsx16HU5qvYNxxs%2BgjqgwSoKWupN51vgpy4HyiE%2F6oVgFrZYQM9X%2BpfQ0sCGy6s2pUwdmL%2B7Nj2qCZjfsTjQ8dms3Xm0pe3hoj681h4wk%2BOvbvs%2Fff2RyJPSlFRshs0TERViwMN%2Brg%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=QXImCGpRsWy7PmNN2y95UvHym4avxr1QF%2BFOZgUQ8YRpSkOJMOX%2FDboyEI6KwxWCmLiZoL0Gq6SXWs93rgPW6wIh7lm7lizbBhgwEE7ZC0XUePKxPUcXxcAV0zYqp7kO%2FdkxPHAI7QzlH%2F2nos1A0SogGpURbhGhwLrL62F72fj2Gc4Ygu8EB28UV%2FbeddzzUOMlY1V7O%2B4mO62alkH0jRCqVj6E%2BSqiTALqpmf%2BuKu5b9DMRb1s%2FDABuZhaoR1l4EeDDinR%2B2txaW2q2L0ZDwsDoLe03HwAO8%2BCaPtZQkGi8psa5DV%2BGBM5nbXRzOuB33YM2oX6yErI7zlo13qSQmaj9QCr63jMskuoQ0%2F%2BEJe0chee7y5cHtULp3X1j8b3O%2FEsENtA%2FSxYUtOuSXMo%2BhHT8qEUNf%2B0fzxbAEpDzt5J8lEvYvr%2Fk3J%2Fm14kwpMF6J%2BYUxc56JEDt43l7Pgpfo7acd1Ko3UMRKPzwuhxL5EbgQVWj7XRfcm9bei0u3vygWzJMwJUhusZbdtOIR7hjqFQKh0Yvcvjfw3ydDOh77fEW2iEHLTothGD6SlFSpzu2Cax4EDP9HQsDy0Ozu7GfsCeoAAYJ2Vz88GyAaQn7GdJOGOL6mPi0ueSOKgT0aRFtuP9CA5E1uq7n%2FK97g2GkHz7k7OFv%2FCrLl8emM7IihLHaXaMC7SX97QdFYHXPSePoZgr51cncGL4TTf2fk9QCbjBJ2SkEc1PeHhAv4YdZiJPiSgSkHpv2vZ4GUwTnPVswTbfGVbVleF1bvQ%2BlJswiAzCh4%2F7ZoTzIX3lyQEIqlrilDAE81IflagtYGaQ7RpobOWLQi6UK2LPb%2BzA9uHRzemZxb6XP5Ld%2F%2FVC4otMg429Kc3luSgRyWe2mHDq6LFUdUm2uuRmAfRlAFmxwro6xWdvAbrI7tD8ULqpKrB8nG4qeh3QXiVAB2lk26%2FTHXvCFoI%2Bizsjr%2BSa9tssIswiKvuuTryuG20RBKISli9C%2BI6uCVg6NTO3Nm3JXMewz33mGJ18zWc%2BOD5cDNyEkhbSv%2BlZuCBeQeIrT59WOV7YMURgfhgiqfTtBeOtZ8AllibI0nB%2Fqi2ETnnWSjYE0S6OqYsVyGrYFgmXqV9vCcds7oOGw6Nhf9iJI0f1q7CKBbUIdmlSDh1FnibpthmcTobp%2FmPR2YCubfJfSFZlP3koxxAcLqdKHR7i6HmkixopL19HeYX0Wc%2FMmR6YeAYB6dxhQkQBTBWNd4FsHYg8RgrrySzWKAX82nrmaeqnnyqG4L7WekYqzgvj%2BG9GLtWLKlK5pdyz3DzKAW2QP0LBW9Fkd9hoQ6EBUvNctxJ3s09d8Yuq3s9HcH0mZJkO4knfHv2h9g%3D%3D
request	GET https://t8u4n6u7.ssl.hwcdn.net/stats.gif?data=WRfXvvfC9q6bIRVRQ2n%2Bs0Ozuj4Z9O8%2FY9LfRcw05SDAg7Yic2iARZFhhD0UVY9z5FW8mxM%2FFJbcd7RHbpeHKmtUGWp4%2ByuL6TUt%2FqTo3ubisZbat%2BqnFpwCk%2BFlS7u4J5ocSzQo%2BiJkRnMkgahYXGsAxelgmQXO3olh3Cq8lkQqCLJG6fVz%2BlY8AhMx%2BNuJLuWcSTHZmj7KoKkzQtuYEnGs%2F4lsdXv1BdoesApNUoaOtbB3877%2BtLoSPcpqOyie2nF8776MrD3RP1p1u0GI98GE1H0Pp0IzmUEtLTktq27bRSKUYPVzWenoPd%2BB55k7mNk9d2PrNkxZV7C9cAp6h%2Br0iKh088%2BeA7HExP92d%2FiDgH7%2F7XBi2uePH%2BE%2FvGg2I1M2lL8Ij7CjpssGkq2yIpnpK1gBdrXj%2F6pQL15L%2BPr%2FoifiQM69Cy5b2DKl9tDYbjY3MCoNNy8gX7WZg93BoCY4%2FCEHb3f0ykcud%2Ba6PV6NektRnk9dI8GarCkSKF%2BK5CPS%2FQa6o1G4YMZaACopbgKllFzg%2BaMhyz3WU4iNYaBKGP9sXBqqfQir5Qb%2Beeewi29X4PhDobU1EplsaGUt1J3ts%2BHWhGIKpfI%2FkggxbIM3meREj8HH02dlzc%2FJq0rZ0D7ivHdW8QC8%2FRjrnZ%2BVSGzbkDrYl8tyloXI49m7ESSE1TOlK9PJkt01T2FqAL%2Fpeq1txOytujJCrtAovuCkJa4PdEICqEe2km%2B7UmZBfNEH1A2S9esFIHzLiI84FKTXLQjQd8%2BKZLtvPUXQOiHov%2BWyfGZgQ8MPmwhwOx1%2FQvFK579p1xfblLouMLCAv9ibphSWRA%2FeYmoYXE7Ci6naZIaVhUzYgHChdVW3jwZWEks2VGnS%2FvkfW9zY3MPhHBRRxQzSu5c6MHELiG0EKjuKgpNgZwC2LAO3IdSjzj1LC5VLwOlzu13ry4XEDxyATZutteWBn%2BooVq%2Fxq8H0%2Fts7G4lz48YfZ4JfxzvJKrBrdgsFlh1ZqQin5fkzLD4YwiSeZOe4p%2BZNbZuXkyFSaCd40Dgwl6L1yM6nvC6%2Fm6JSYvttmbE%2Bm3P9hM9Ywq2KQJi3V1xAYd%2BY4NIzTk1OwsR%2ByqdNx4tHGec9HsIzCUz%2FhB1CGHgRMMEXWVeTOCrkZT65R8zBULpRRCWsDQZXTzu0ex0TtFji1olhvwvoYlJw1OairWP1wact0etaVex9jC18jMiSeIkuQpvJ13COfQjyNGxUcRknAP%2FWzhyW3J2%2FfqqXu3TDT3vTv3BvJK9MfP1DnSNzZNYMZ4qY9pOj%2FcWmItPobF20AEVrKu4iKcxfPgDg9UEKVE7mUrYi43RM7JmBBXdo2CKoxrDfrB1ZKZ6vNA%3D%3D
request	POST https://update.googleapis.com/service/update2?cup2key=10:875655008&cup2hreq=35c0cfb530cbbdc5177113fbb2a6859697f5e0d39d39ad77b5f30e4b389b83c4

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:875655008&cup2hreq=35c0cfb530cbbdc5177113fbb2a6859697f5e0d39d39ad77b5f30e4b389b83c4

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619942785.452751 NtAllocateVirtualMemory	process_identifier: 2308 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02a10000	success	0	0
1619942407.768645 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000041a0000	success	0	0

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Steals private information from local Internet browsers (2 个事件)

registry	HKEY_LOCAL_MACHINE\Software\Mozilla\Mozilla Firefox
registry	HKEY_CURRENT_USER\Software\Mozilla\Mozilla Firefox

Creates executable files on the filesystem (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nso83E2.tmp\StdUtils.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nso83E2.tmp\internalcb18c47fe6811bca7c49199222388e7a.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619942786.187751 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (4 个事件)

Time & API	Arguments	Status	Return
1619942804.749751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619942804.749751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619942804.765751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1
1619942804.765751 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1

Queries for potentially installed applications (6 个事件)

Time & API	Arguments	Status	Return
1619942781.702751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619942781.702751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x000000dc regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0
1619942798.843751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619942798.843751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x000004a4 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0
1619942798.843751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	failed	2
1619942798.843751 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x000004a4 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome options: 0	success	0

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619942798.874751 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Playtech WinClient Downloader/1.0	success	13369348	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Attempts to create or modify system certificates (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (15 个事件)

Time & API	Arguments	Status
1619942788.781751 RegSetValueExA	key_handle: 0x00000538 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619942788.781751 RegSetValueExA	key_handle: 0x00000538 value: ÐMÎB'?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619942788.781751 RegSetValueExA	key_handle: 0x00000538 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619942788.781751 RegSetValueExW	key_handle: 0x00000538 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619942788.781751 RegSetValueExA	key_handle: 0x00000554 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619942788.781751 RegSetValueExA	key_handle: 0x00000554 value: ÐMÎB'?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619942788.781751 RegSetValueExA	key_handle: 0x00000554 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619942788.812751 RegSetValueExW	key_handle: 0x00000534 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success
1619942789.593751 RegSetValueExA	key_handle: 0x000005fc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619942789.593751 RegSetValueExA	key_handle: 0x000005fc value: 4JC'?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619942789.593751 RegSetValueExA	key_handle: 0x000005fc value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619942789.593751 RegSetValueExW	key_handle: 0x000005fc value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619942789.593751 RegSetValueExA	key_handle: 0x00000604 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619942789.609751 RegSetValueExA	key_handle: 0x00000604 value: 4JC'?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619942789.609751 RegSetValueExA	key_handle: 0x00000604 value: 0 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success

File has been identified by 36 AntiVirus engines on VirusTotal as malicious (36 个事件)

Elastic	malicious (high confidence)
DrWeb	Trojan.Crossrider1.63134
MicroWorld-eScan	Application.Downloader.AUG
FireEye	Generic.mg.cb18c47fe6811bca
CAT-QuickHeal	Trojan.CGeneric
McAfee	Artemis!CB18C47FE681
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
SUPERAntiSpyware	PUP.PlayTech/Variant
K7AntiVirus	Adware ( 005513a71 )
K7GW	Adware ( 005513a71 )
Arcabit	Application.Downloader.AUG
Invincea	Generic ML PUA (PUA)
Cyren	W32/PlayTech.A.gen!Eldorado
ESET-NOD32	Win32/PlayTech.A potentially unwanted
Zoner	PUA.Win32.65045
TrendMicro-HouseCall	PUA.Win32.PlayTech.AK.component
BitDefender	Application.Downloader.AUG
NANO-Antivirus	Trojan.Win32.PlayTech.fvceoe
ViRobot	Adware.Playtech.808072.CCUJ
Rising	PUF.PlayTech!1.B889 (CLASSIC)
Ad-Aware	Application.Downloader.AUG
Comodo	Application.Win32.PlayTech.A@8hha8a
F-Secure	Adware.ADWARE/Crossrider.npjii
TrendMicro	PUA.Win32.PlayTech.AK.component
Avira	ADWARE/Crossrider.npjii
MAX	malware (ai score=75)
Antiy-AVL	GrayWare/Win32.Presenoker
Microsoft	PUA:Win32/Playtech
GData	Application.Downloader.AUG
Cynet	Malicious (score: 100)
AhnLab-V3	PUP/Win32.Playtech.R277261
VBA32	BScope.Trojan.Crossrider
APEX	Malicious
Fortinet	W32/Agent.F7A5!tr
Qihoo-360	Generic/HEUR/QVM20.1.B817.Malware.Gen

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.27.142:443
dead_host	172.217.24.14:443
dead_host	192.168.56.101:49199

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-02-19 23:01:49

Imports

Library ADVAPI32.dll:

• 0x429340 RegCloseKey

• 0x429344 RegCreateKeyExA

• 0x429348 RegDeleteKeyA

• 0x42934c RegDeleteValueA

• 0x429350 RegEnumKeyA

• 0x429354 RegEnumValueA

• 0x429358 RegOpenKeyExA

• 0x42935c RegQueryValueExA

• 0x429360 RegSetValueExA

Library COMCTL32.DLL:

• 0x429368 ImageList_AddMasked

• 0x42936c ImageList_Create

• 0x429370 ImageList_Destroy

• 0x429374 InitCommonControls

Library GDI32.dll:

• 0x42937c CreateBrushIndirect

• 0x429380 CreateFontIndirectA

• 0x429384 DeleteObject

• 0x429388 GetDeviceCaps

• 0x42938c SelectObject

• 0x429390 SetBkColor

• 0x429394 SetBkMode

• 0x429398 SetTextColor

Library KERNEL32.dll:

• 0x4293a0 CloseHandle

• 0x4293a4 CompareFileTime

• 0x4293a8 CopyFileA

• 0x4293ac CreateDirectoryA

• 0x4293b0 CreateFileA

• 0x4293b4 CreateProcessA

• 0x4293b8 CreateThread

• 0x4293bc DeleteFileA

• 0x4293c0 ExitProcess

• 0x4293c4 ExpandEnvironmentStringsA

• 0x4293c8 FindClose

• 0x4293cc FindFirstFileA

• 0x4293d0 FindNextFileA

• 0x4293d4 FreeLibrary

• 0x4293d8 GetCommandLineA

• 0x4293dc GetCurrentProcess

• 0x4293e0 GetDiskFreeSpaceA

• 0x4293e4 GetExitCodeProcess

• 0x4293e8 GetFileAttributesA

• 0x4293ec GetFileSize

• 0x4293f0 GetFullPathNameA

• 0x4293f4 GetLastError

• 0x4293f8 GetModuleFileNameA

• 0x4293fc GetModuleHandleA

• 0x429400 GetPrivateProfileStringA

• 0x429404 GetProcAddress

• 0x429408 GetShortPathNameA

• 0x42940c GetSystemDirectoryA

• 0x429410 GetTempFileNameA

• 0x429414 GetTempPathA

• 0x429418 GetTickCount

• 0x42941c GetVersion

• 0x429420 GetWindowsDirectoryA

• 0x429424 GlobalAlloc

• 0x429428 GlobalFree

• 0x42942c GlobalLock

• 0x429430 GlobalUnlock

• 0x429434 LoadLibraryA

• 0x429438 LoadLibraryExA

• 0x42943c MoveFileA

• 0x429440 MulDiv

• 0x429444 MultiByteToWideChar

• 0x429448 ReadFile

• 0x42944c RemoveDirectoryA

• 0x429450 SearchPathA

• 0x429454 SetCurrentDirectoryA

• 0x429458 SetErrorMode

• 0x42945c SetFileAttributesA

• 0x429460 SetFilePointer

• 0x429464 SetFileTime

• 0x429468 Sleep

• 0x42946c WaitForSingleObject

• 0x429470 WriteFile

• 0x429474 WritePrivateProfileStringA

• 0x429478 lstrcatA

• 0x42947c lstrcmpA

• 0x429480 lstrcmpiA

• 0x429484 lstrcpynA

• 0x429488 lstrlenA

Library ole32.dll:

• 0x429490 CoCreateInstance

• 0x429494 CoTaskMemFree

• 0x429498 OleInitialize

• 0x42949c OleUninitialize

Library SHELL32.DLL:

• 0x4294a4 SHBrowseForFolderA

• 0x4294a8 SHFileOperationA

• 0x4294ac SHGetFileInfoA

• 0x4294b0 SHGetPathFromIDListA

• 0x4294b4 SHGetSpecialFolderLocation

• 0x4294b8 ShellExecuteA

Library USER32.dll:

• 0x4294c0 AppendMenuA

• 0x4294c4 BeginPaint

• 0x4294c8 CallWindowProcA

• 0x4294cc CharNextA

• 0x4294d0 CharPrevA

• 0x4294d4 CheckDlgButton

• 0x4294d8 CloseClipboard

• 0x4294dc CreateDialogParamA

• 0x4294e0 CreatePopupMenu

• 0x4294e4 CreateWindowExA

• 0x4294e8 DefWindowProcA

• 0x4294ec DestroyWindow

• 0x4294f0 DialogBoxParamA

• 0x4294f4 DispatchMessageA

• 0x4294f8 DrawTextA

• 0x4294fc EmptyClipboard

• 0x429500 EnableMenuItem

• 0x429504 EnableWindow

• 0x429508 EndDialog

• 0x42950c EndPaint

• 0x429510 ExitWindowsEx

• 0x429514 FillRect

• 0x429518 FindWindowExA

• 0x42951c GetClassInfoA

• 0x429520 GetClientRect

• 0x429524 GetDC

• 0x429528 GetDlgItem

• 0x42952c GetDlgItemTextA

• 0x429530 GetMessagePos

• 0x429534 GetSysColor

• 0x429538 GetSystemMenu

• 0x42953c GetSystemMetrics

• 0x429540 GetWindowLongA

• 0x429544 GetWindowRect

• 0x429548 InvalidateRect

• 0x42954c IsWindow

• 0x429550 IsWindowEnabled

• 0x429554 IsWindowVisible

• 0x429558 LoadBitmapA

• 0x42955c LoadCursorA

• 0x429560 LoadImageA

• 0x429564 MessageBoxIndirectA

• 0x429568 OpenClipboard

• 0x42956c PeekMessageA

• 0x429570 PostQuitMessage

• 0x429574 RegisterClassA

• 0x429578 ScreenToClient

• 0x42957c SendMessageA

• 0x429580 SendMessageTimeoutA

• 0x429584 SetClassLongA

• 0x429588 SetClipboardData

• 0x42958c SetCursor

• 0x429590 SetDlgItemTextA

• 0x429594 SetForegroundWindow

• 0x429598 SetTimer

• 0x42959c SetWindowLongA

• 0x4295a0 SetWindowPos

• 0x4295a4 SetWindowTextA

• 0x4295a8 ShowWindow

• 0x4295ac SystemParametersInfoA

• 0x4295b0 TrackPopupMenu

• 0x4295b4 wsprintfA

Library VERSION.dll:

• 0x4295bc GetFileVersionInfoA

• 0x4295c0 GetFileVersionInfoSizeA

• 0x4295c4 VerQueryValueA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
cache.download2.casino.com	CNAME cache.download2.casino.com.cdnga.net A 14.0.41.202 A 14.0.41.244	14.0.41.244
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
ocsp.sectigo.com	A 151.139.128.14	151.139.128.14
r3---sn-j5o7dn7e.gvt1.com	CNAME r3.sn-j5o7dn7e.gvt1.com A 113.108.239.196	113.108.239.196
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
t8u4n6u7.ssl.hwcdn.net	A 205.185.208.154	205.185.208.154
c6m7w2m9.ssl.hwcdn.net	A 205.185.208.154	205.185.208.154
fallback.playtech-installer.com	CNAME s3-website-eu-west-1.amazonaws.com CNAME pt-installer.s3-website-eu-west-1.amazonaws.com A 52.218.49.58	52.218.62.44
clients2.google.com	CNAME clients.l.google.com A 172.217.27.142	172.217.160.78
ocsp.usertrust.com	A 151.139.128.14	151.139.128.14
www.download.windowsupdate.com	A 124.225.105.97 CNAME 2-01-3cf7-0009.cdx.cedexis.net CNAME www.download.windowsupdate.com.cdn.dnsv1.com CNAME windowsupdate.sched.s11.tdnsv5.com CNAME 3573033.pack.cdntip.com CNAME wu-fg-shim.trafficmanager.net	124.225.105.97
r1---sn-j5o7dn7e.gvt1.com	A 113.108.239.194 CNAME r1.sn-j5o7dn7e.gvt1.com	113.108.239.194
redirector.gvt1.com	A 203.208.41.65	203.208.41.33
update.googleapis.com	A 203.208.41.98	203.208.41.34
ocsp.comodoca.com	A 151.139.128.14	151.139.128.14
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49256	113.108.239.194 r1---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49257	113.108.239.196 r3---sn-j5o7dn7e.gvt1.com	80
192.168.56.101	49186	124.225.105.97 www.download.windowsupdate.com	80
192.168.56.101	49187	124.225.105.97 www.download.windowsupdate.com	80
192.168.56.101	49199	14.0.41.244 cache.download2.casino.com	80
192.168.56.101	49188	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49189	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49190	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49191	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49192	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49193	151.139.128.14 ocsp.comodoca.com	80
192.168.56.101	49255	203.208.41.65 redirector.gvt1.com	80
192.168.56.101	49250	203.208.41.98 update.googleapis.com	443
192.168.56.101	49182	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	80
192.168.56.101	49183	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49184	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49197	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49198	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49200	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443
192.168.56.101	49201	205.185.208.154 c6m7w2m9.ssl.hwcdn.net	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	49710	114.114.114.114	53
192.168.56.101	50849	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53500	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	54178	114.114.114.114	53
192.168.56.101	54260	114.114.114.114	53
192.168.56.101	54991	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56743	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	58070	114.114.114.114	53
192.168.56.101	58970	114.114.114.114	53
192.168.56.101	60088	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	60911	114.114.114.114	53
192.168.56.101	61522	114.114.114.114	53

HTTP & HTTPS Requests

URI	Data
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m	GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT Range: bytes=7247-19749 User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: / If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com
http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom_new/casino[de].cab	GET /playtech_cabs/casino_casinocom_new/casino[de].cab HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\1BD0A0F89E474568A4BC7924596C4002\pack (2).cab User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913612&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913612&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o7dn7e.gvt1.com
http://cache.download2.casino.com/download/casino/client_update_urls.php	GET /download/casino/client_update_urls.php HTTP/1.1 Accept: / User-Agent: Playtech WinClient Downloader/1.0 Host: cache.download2.casino.com Connection: Keep-Alive Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_cabs/casino_casinocom_new/casino[de].cab	GET /playtech_cabs/casino_casinocom_new/casino[de].cab HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\1BD0A0F89E474568A4BC7924596C4002\pack (3).cab User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze	GET /playtech_compressed_assets/casino_casinocom_new/templates/installer/casinocom_2016.7ze HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\1BD0A0F89E474568A4BC7924596C4002\casinocom_2016 (1).7z User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://fallback.playtech-installer.com/playtech_compressed_assets/casino_casinocom_new/index.7ze	GET /playtech_compressed_assets/casino_casinocom_new/index.7ze HTTP/1.1 Accept: / C: \Users\Administrator.Oskar-PC\AppData\Local\Temp\1BD0A0F89E474568A4BC7924596C4002\index.7ze User-Agent: Playtech WinClient Downloader/1.0 Host: fallback.playtech-installer.com Connection: Keep-Alive Cache-Control: no-cache
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m	GET /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=76294317973a01c5&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619913853&mv=m HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 13 Apr 2021 03:03:58 GMT Range: bytes=101800-189860 User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r3---sn-j5o7dn7e.gvt1.com
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D	GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.