14 KiB
14 KiB
| 1 | uuid | event_id | category | type | value | comment | to_ids | date |
|---|---|---|---|---|---|---|---|---|
| 2 | 035cef0c-ab5b-4870-8a2d-3fffb2002a86 | 12 | Network activity | domain | www.blackboxmusic.co | 1 | 20161104 | |
| 3 | 04da6270-0f60-44e0-a68c-bb6d0eb89d84 | 12 | Artifacts dropped | md5 | 695db7dd3b1daf89f2c56d59faecc088 | CyberGate | 1 | 20161108 |
| 4 | 075b1d0f-b7b2-4571-bd0c-9a2ad1c98663 | 12 | Artifacts dropped | md5 | 93b630891db21a4a2350280a360c713d | CyberGate | 1 | 20161108 |
| 5 | 078ea337-c004-430a-87d7-982e517f81c4 | 12 | Artifacts dropped | md5 | 4a23a1d6779d199aaa582cf0a5868ad1 | Adzok | 1 | 20161108 |
| 6 | 080d5bfb-0924-48a0-8b75-37104a301e1c | 12 | Network activity | ip-dst | 201.52.24.126 | 1 | 20161104 | |
| 7 | 09e60b2e-a849-4dc3-9910-59cd78bc3f82 | 12 | Artifacts dropped | md5 | 5a8975873f52436377d8fb0b5ab0d87a | CyberGate | 1 | 20161108 |
| 8 | 0a4ead27-a700-45f4-bcd0-b469d002b231 | 12 | Network activity | ip-dst | 189.100.148.188 | 1 | 20161104 | |
| 9 | 0c0abe15-22aa-433f-9a15-0b8196c3a99a | 12 | Network activity | domain | venezuela365.com | 1 | 20161104 | |
| 10 | 0e4cc2f6-8b32-489a-8f86-6279b96ff313 | 12 | Network activity | url | http://ecuadorenvivo.co/videos/el-meme-que-volvio-loco-a-correa.html | 1 | 20161104 | |
| 11 | 0fabddd8-3837-4d33-bb62-efc4edfe67a5 | 12 | Network activity | domain | supportgmai1.com | 1 | 20161104 | |
| 12 | 1013af0f-98ea-44cf-8c57-d5dfcc2a9398 | 12 | Network activity | domain | conhost.servehttp.com | 1 | 20161104 | |
| 13 | 102812f0-1515-475b-85c9-fe3b9f298322 | 12 | Network activity | domain | mail-account-update.com | 1 | 20161104 | |
| 14 | 11c2de46-6ded-4948-914e-a8acff9ff027 | 12 | Artifacts dropped | md5 | ce6065346a918a813eeb58bbb0814a23 | CyberGate | 1 | 20161108 |
| 15 | 1242c1d0-3d53-48f2-a30f-f6566a46b262 | 12 | Artifacts dropped | md5 | efc0009d76a2057f86c5f00030378c72 | AlienSpy | 1 | 20161108 |
| 16 | 17548c65-6dd6-473f-b79c-9ad3095fb9b2 | 12 | Artifacts dropped | md5 | a73351623577f44a2b578fed1e78e37e | CyberGate | 1 | 20161108 |
| 17 | 19da57bf-1c40-4472-a9e1-696a56ff0d12 | 12 | Network activity | domain | update-outlook.info | 1 | 20161104 | |
| 18 | 1b9f7074-c66c-472d-8917-0592bd07202e | 12 | Network activity | domain | verify-gmail-support-secure.tk | 1 | 20161104 | |
| 19 | 1c9844bb-53a7-4c6d-859a-864d802fb755 | 12 | Network activity | ip-dst | 198.12.150.249 | 1 | 20161104 | |
| 20 | 1d17b791-20fd-4a0b-b074-36282e6fe9b9 | 12 | Network activity | domain | support-java.com | 1 | 20161104 | |
| 21 | 1f129d35-b9b2-42b4-81f6-8903c25c7080 | 12 | Network activity | domain | taskmgr.serveftp.com | 1 | 20161108 | |
| 22 | 1fcd075d-0b8f-42d9-852d-31813ae49879 | 12 | Network activity | domain | chavistas24.com | 1 | 20161104 | |
| 23 | 2034aaac-cd1a-4f24-9c9e-a622763cc35a | 12 | Artifacts dropped | md5 | 15ebe16cd9500de534d5bfd5eeceaf73 | CyberGate | 1 | 20161108 |
| 24 | 22c32e7b-f0a5-4e57-8821-a080cb880cdb | 12 | Network activity | domain | mesvr.com | 1 | 20161104 | |
| 25 | 2738530c-979b-43ef-a7a3-6e509d38d073 | 12 | Artifacts dropped | regkey | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msconfig | 1 | 20161104 | |
| 26 | 29d3b93f-a8c7-46f0-8aaa-d5b1d3a7efa6 | 12 | Network activity | domain | dllhost.servehttp.com | 1 | 20161104 | |
| 27 | 2b8e7578-2b1b-4ee4-b690-812825551490 | 12 | Network activity | domain | deyrep24.ddns.net | C2 server | 1 | 20161108 |
| 28 | 2bcfdd38-8a5d-4512-b575-9b06096bed81 | 12 | Network activity | domain | ns1.ukraine.com.ua | 1 | 20161104 | |
| 29 | 2cd0f135-c88d-4a89-8cd4-bbc6cd3efa0f | 12 | Artifacts dropped | md5 | 01dec1b1d0760d5a1a562edcfeb478d1 | CyberGate | 1 | 20161108 |
| 30 | 2de6d004-f85c-4967-9aaf-f6a2bd9f4349 | 12 | Network activity | ip-dst | 46.246.89.246 | 1 | 20161104 | |
| 31 | 32c1f9d8-b15a-4f28-a91d-1d781b28aaa0 | 12 | Network activity | domain | n1.login-office365.com | 1 | 20161104 | |
| 32 | 33a05e11-fe8c-47e0-b8a2-55b568df6adf | 12 | Network activity | domain | focusecuador.tk | 1 | 20161104 | |
| 33 | 341b2a91-d835-4766-8a27-d0a04cf9af90 | 12 | Artifacts dropped | md5 | a74ef893b1bf21c9df6d8e31285db981 | CyberGate | 1 | 20161108 |
| 34 | 378b1659-18cc-484d-aa90-df1a36849693 | 12 | Artifacts dropped | md5 | 1e6d0b59d4fb7650453c207688385f3a | CyberGate | 1 | 20161108 |
| 35 | 395f1ba8-c107-4622-a845-f2a2e2660b64 | 12 | Network activity | domain | movimientoanticorreista.com | 1 | 20161104 | |
| 36 | 3a638a7b-6cc4-4cfe-940c-921fb417e79c | 12 | Artifacts dropped | md5 | c2237e9d415f542ce6e73adb260af123 | Xtreme RAT | 1 | 20161108 |
| 37 | 3b6d91fc-6693-453e-b8d0-9a0955b12a9c | 12 | Network activity | url | http://ecuadorenvivo.com/videos/el-meme-que-volvio-loco-a-correa.html | 1 | 20161104 | |
| 38 | 3cd6d0dd-13e7-40b1-adaf-957bedfc212b | 12 | Artifacts dropped | md5 | 7b2cb5249d704cb1df8d4210e7c3d553 | CyberGate | 1 | 20161108 |
| 39 | 438fd35d-28ff-4669-a2c6-d3606ad95501 | 12 | Payload delivery | email-src | enripintos123@outlook.es | 1 | 20161104 | |
| 40 | 440b7b2b-7d18-4a95-a95c-f4d80412535c | 12 | Artifacts dropped | md5 | e03be1849ad7cecba1e20923074cd22f | CyberGate | 1 | 20161108 |
| 41 | 475c2ee5-d819-4a55-bb4d-1d909905c039 | 12 | Artifacts dropped | md5 | d2adecc6287dd4d559fe6ce2ce7a7e31 | Cybergate | 1 | 20161108 |
| 42 | 491292ff-d9e0-481e-aed8-575ac817cff9 | 12 | Network activity | domain | asambleanacional-gob-ec.cu9.co | 1 | 20161104 | |
| 43 | 4982d975-2425-4c0e-8709-8ea8c3743372 | 12 | Payload delivery | email-src | no-responder@supportgmai1.com | 1 | 20161104 | |
| 44 | 4e2e0b4c-8e54-40bc-9432-152d34b9980b | 12 | Network activity | domain | 24.com | 0 | 20161104 | |
| 45 | 4e37e013-f1ce-4df9-ae83-f04eb6b18ba9 | 12 | Network activity | domain | taskmgr.redirectme.com | 1 | 20161104 | |
| 46 | 50dd1978-ed90-48a0-8fae-f841d7d26c0e | 12 | Network activity | domain | cu9.co | 1 | 20161104 | |
| 47 | 521771b2-16c0-44e8-b1c6-0dedfe52a93f | 12 | Network activity | url | http://pancaliente.info/los-negocios-secretos-de-leocenis-garcia-y-gonzalo-tirado | 1 | 20161104 | |
| 48 | 53063744-8009-4309-823f-44ac089a9f4d | 12 | Network activity | domain | formmail.com | 1 | 20161104 | |
| 49 | 53d09cce-3d68-4a76-bddb-118176b5eda6 | 12 | Artifacts dropped | md5 | 2de51e74fd571319bbf763ec62781096 | AlienSpy | 1 | 20161108 |
| 50 | 55ab0c50-6ba9-44f0-bbf5-e30f13396fba | 12 | Artifacts dropped | md5 | 1e4265a0c37773c2372b97bb6630ae57 | Adzok | 1 | 20161108 |
| 51 | 55bc7d1d-b8c1-404a-ba53-0e81f893bf4f | 12 | Payload delivery | email-src | movimiento.anti.correista@gmail.com | 1 | 20161104 | |
| 52 | 568339a3-cddf-4539-8e40-f2d726a5341b | 12 | Network activity | domain | ecuadorenvivo.com | 1 | 20161104 | |
| 53 | 56e407af-b034-469f-833e-4261d12f4e3f | 12 | Network activity | ip-dst | 179.208.187.216 | 1 | 20161104 | |
| 54 | 576bf524-78bd-47b8-9ae0-54ecea1bb4af | 12 | Network activity | domain | ns1.deyrep.com | 1 | 20161104 | |
| 55 | 581c127f-fca8-4148-9a35-497a8e96ca05 | 12 | External analysis | link | https://citizenlab.org/2015/12/packrat-report/ | 0 | 20161108 | |
| 56 | 582243bb-0f34-4775-9d56-49798e96ca05 | 12 | Payload type | text | CyberGate | 0 | 20161108 | |
| 57 | 582243bb-28a4-4ba0-bb04-49798e96ca05 | 12 | Payload type | text | Adzok | 0 | 20161108 | |
| 58 | 582243bb-c8d8-4986-a6f6-49798e96ca05 | 12 | Payload type | text | Xtreme RAT | 0 | 20161108 | |
| 59 | 582243bb-f194-4e73-8e86-49798e96ca05 | 12 | Payload type | text | AlienSpy | 0 | 20161108 | |
| 60 | 5f6ed532-7034-4529-8f1f-eca4f3ead06a | 12 | Network activity | domain | soporte-login-account-yahoo.tk | 1 | 20161104 | |
| 61 | 613fc81a-9472-402a-864f-ba796bd820f9 | 12 | Network activity | domain | n4.pancaliente.info | 1 | 20161104 | |
| 62 | 63f47613-ca7a-4a85-859b-55acf0440a1a | 12 | Network activity | ip-dst | 50.63.202.57 | 1 | 20161104 | |
| 63 | 64c9eefd-aabd-47be-8a66-56a3f777fca0 | 12 | Network activity | domain | taskmgr.redirectme.net | 1 | 20161104 | |
| 64 | 65be605b-ce44-483a-9398-c9b6c1d2584f | 12 | Network activity | domain | s1.mgoogle.us | 1 | 20161104 | |
| 65 | 665a391e-0346-477b-8062-0e093fba3333 | 12 | Artifacts dropped | md5 | a09f100ddc7cf29f8a93a3d7a79c58b9 | CyberGate | 1 | 20161108 |
| 66 | 668f1383-b9db-44fb-ab01-49537c77ad1e | 12 | Network activity | domain | blackboxmusic.co | 1 | 20161104 | |
| 67 | 694b6503-2ef8-4da9-8adf-1eaf5b0393c8 | 12 | Artifacts dropped | md5 | 2d722592a4e3c8030410dccccb221ce4 | CyberGate | 1 | 20161108 |
| 68 | 69d8d573-3f23-493b-97f4-8fa6b4cf9f1b | 12 | Artifacts dropped | md5 | 2827450763b55c5e71fda3caaf8e75f9 | Xtreme RAT | 1 | 20161108 |
| 69 | 6cb4f4a0-1cf6-4cf4-98c2-5b9b93ff9867 | 12 | Artifacts dropped | md5 | 8fb96dfab7e4c0acb1eb9f4e950ba4b9 | AlienSpy | 1 | 20161108 |
| 70 | 74bc6c34-77bb-4328-9edc-75059585e539 | 12 | Network activity | domain | mgoogle.us | 1 | 20161104 | |
| 71 | 77cc5d54-a422-4f1b-ab2f-167cdfde8bef | 12 | Network activity | domain | focusecuador.net | 1 | 20161104 | |
| 72 | 7908fe7c-4346-4810-9f79-3ad2a8b93fd6 | 12 | Network activity | domain | n2.login-office365.com | 1 | 20161104 | |
| 73 | 7a7a2e9e-8e1e-45c7-ba5d-c6d6ce59465a | 12 | Network activity | domain | ns1.hostinger.ru | 1 | 20161104 | |
| 74 | 7a948702-dd5c-46da-93e6-37d7bc088693 | 12 | Network activity | ip-dst | 190.20.180.181 | 1 | 20161104 | |
| 75 | 7b018a95-eb5d-4226-a5ca-9e32f4b288e4 | 12 | Network activity | domain | deyrep.com | 1 | 20161104 | |
| 76 | 7ca51a3d-b093-497f-accf-00bca0964287 | 12 | Network activity | domain | ns2.deyrep.com | 1 | 20161104 | |
| 77 | 809f7cd8-5a6f-4e4e-baca-d148180828b7 | 12 | Network activity | url | http://mail.asambleanacional.gob.ec | 1 | 20161104 | |
| 78 | 8149df18-d5b8-4b8f-9ebf-48676f586058 | 12 | Network activity | ip-dst | 193.105.134.27 | 1 | 20161104 | |
| 79 | 823b71a4-5bcc-4c16-bd79-816b1b6e70d9 | 12 | Network activity | domain | justicia-desvinculados.com | 1 | 20161104 | |
| 80 | 83aa404a-cb12-407c-993c-1ff9b7fa1947 | 12 | Network activity | domain | ftp.server.com | 1 | 20161104 | |
| 81 | 83bc4a8a-fe39-48d7-b26c-f4e4bfe08cde | 12 | Network activity | domain | lolinha.no-ip.org | 1 | 20161104 | |
| 82 | 85d91d34-8222-4b2e-b154-0b394ec75fe3 | 12 | Artifacts dropped | md5 | 3a61d64986ee6529cee271ab6754faa5 | CyberGate | 1 | 20161108 |
| 83 | 887aba05-4662-4967-8d93-09cb8b3d7685 | 12 | Network activity | domain | n1.support-java.com | 1 | 20161104 | |
| 84 | 88a1c5b7-d445-49fc-aa75-7ee28b069510 | 12 | Payload delivery | email-src | focusedtior1@gmail.com | 1 | 20161104 | |
| 85 | 89db0f38-a183-45b8-9503-69828bf29412 | 12 | Network activity | ip-dst | 192.169.243.65 | IP address linked to deyrep24.ddns.net | 1 | 20161108 |
| 86 | 8ae2e6c9-806a-4a57-aa17-aed767339990 | 12 | Artifacts dropped | md5 | d7f34168b1a7dd7cbd8e62a5ab1ebc0e | Xtreme RAT | 1 | 20161108 |
| 87 | 8d8d0ac6-1cbe-4d9c-9b3c-8b7dbd1a1ce4 | 12 | Artifacts dropped | md5 | 779a79c11f581b84e7c81f321fd8d743 | CyberGate | 1 | 20161108 |
| 88 | 8ea723f1-5e6d-4984-80a1-c844988006d9 | 12 | Network activity | url | http://venezuela365.com/wp-content/uploads/2014/10/tirado-g-300×169.jpg | 1 | 20161104 | |
| 89 | 8eecda70-e625-413f-b7fc-8451d76f4765 | 12 | Network activity | domain | ec.cu9.co | 1 | 20161104 | |
| 90 | 8f38d4c7-dff5-484f-be90-3aaa3fba6753 | 12 | Artifacts dropped | md5 | d2f151312f7dee2483ddcab9766b56db | AlienSpy | 1 | 20161108 |
| 91 | 9096fec9-6b26-4c94-a9a1-8bfe16caf1b5 | 12 | Artifacts dropped | md5 | 8e0f021dcbbfa586a1c6780e77ac0fb6 | CyberGate | 1 | 20161108 |
| 92 | 93541388-7cc4-436a-bf73-1e1584776a59 | 12 | Network activity | domain | www.movimientoanticorreista.com | 1 | 20161104 | |
| 93 | 9e0ea90e-1dae-4fd3-9fe2-a95bf8ff29c7 | 12 | Network activity | ip-dst | 190.210.180.181 | 1 | 20161104 | |
| 94 | 9f3c0a52-cf4e-434c-852b-a93df8a857e1 | 12 | Payload delivery | email-src | claudiobonadio88@gmail.com | 1 | 20161108 | |
| 95 | 9fbc655c-1010-4057-8af4-d29425574e3e | 12 | Artifacts dropped | md5 | 13d939b2412c6adbab3cc1b539166671 | CyberGate | 1 | 20161108 |
| 96 | a0787877-1f51-45a2-a268-99585abd3753 | 12 | Network activity | domain | android-flash.com | 1 | 20161104 | |
| 97 | a179e1f8-66e4-4055-a762-ed5d9166afa2 | 12 | Artifacts dropped | md5 | 74613eae84347183b4ca61b912a4573f | AlienSpy | 1 | 20161108 |
| 98 | a38d5330-38f4-4016-a6a5-82fefed9aacd | 12 | Network activity | domain | wjwjwjwj.no-ip.org | 1 | 20161104 | |
| 99 | a391d94a-2311-4420-a315-067f450915c2 | 12 | Network activity | domain | ftp.ftpserver.com | 1 | 20161104 | |
| 100 | a723650f-2306-48f3-a588-e57822f92448 | 12 | Artifacts dropped | regkey | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\Policies | 1 | 20161104 | |
| 101 | a8d6eb71-318f-4516-b319-5e50d6996770 | 12 | Artifacts dropped | md5 | dd1101adc86fd282f5f183942cc2f3b7 | CyberGate | 1 | 20161108 |
| 102 | ab318121-5622-4ea7-aca3-59e972601644 | 12 | Network activity | domain | n3.pancaliente.info | 1 | 20161104 | |
| 103 | abb6b95e-2364-4aad-b826-7c925b587d0a | 12 | Network activity | domain | lavozmericana.info | 1 | 20161104 | |
| 104 | abc292cf-5485-4189-8c0a-b18d830cc7f2 | 12 | Network activity | domain | pancaliente.info | 1 | 20161104 | |
| 105 | ac5dde92-e97e-4b57-9305-5e439f9bbb40 | 12 | Artifacts dropped | md5 | ea50bf8abcf9c0c40c4490dc15fb0a2a | CyberGate | 1 | 20161108 |
| 106 | aea5a3f5-d174-47c1-81a0-c97a5a478e00 | 12 | Network activity | domain | n1.lavozamericana.info | 1 | 20161104 | |
| 107 | b0bd3917-ba04-4d95-a5d3-928993f331a9 | 12 | Artifacts dropped | md5 | a988235ad7d47acbeca5ccb4ea5a1ed5 | CyberGate | 1 | 20161108 |
| 108 | b0df1407-9653-4f07-8f2e-5cd7f1c1a212 | 12 | Network activity | domain | n1.update-outlook.info | 1 | 20161104 | |
| 109 | b373771f-54f4-4559-8297-52779ee94c28 | 12 | Network activity | domain | soporte-login-account-gmail.tk | 1 | 20161104 | |
| 110 | b5b19817-6112-4eeb-b3d1-666f92b33ee7 | 12 | Network activity | domain | no.response.delivery.es | 1 | 20161104 | |
| 111 | b66ec73a-4faf-4873-bdd8-8fdde6207ca4 | 12 | Network activity | domain | ecuadorenvivo.co | 1 | 20161104 | |
| 112 | b812855c-8fdc-41f2-8857-8966aa84ea89 | 12 | Network activity | domain | ruley.no-ip.org | 1 | 20161104 | |
| 113 | bc40a9ee-df43-4ba3-ad9d-529dc845d04b | 12 | Network activity | domain | s2.mgoogle.us | 1 | 20161104 | |
| 114 | bd9e3887-abea-465a-9f42-4ca38ea31d17 | 12 | Artifacts dropped | md5 | 0ae0038ffe8cf5c3170734a71ff2213d | AlienSpy | 1 | 20161108 |
| 115 | c00a3cd4-3530-4a3d-a0b2-4231aad495ad | 12 | Network activity | domain | login-office365.com | 1 | 20161104 | |
| 116 | c103e0dc-7fb4-4e6d-a3d1-d6dfadc90045 | 12 | Artifacts dropped | md5 | 08a3bb5b220eb1e0dc2ecccbbc6859f5 | Adzok | 1 | 20161108 |
| 117 | c67572b2-b7f4-4f32-9e4d-a8892079fec4 | 12 | Network activity | domain | wjwjwj.no-ip.org | 1 | 20161104 | |
| 118 | c6f40987-2e22-495f-9fcf-ce681c67e901 | 12 | Network activity | domain | daynews.sytes.net | domain linked to deyrep24.ddns.net | 1 | 20161108 |
| 119 | c7d3ba98-9951-45a1-864f-ad1c6c000aad | 12 | Artifacts dropped | regkey | HKLM\SOFTWARE\Microsoft\Active | 1 | 20161104 | |
| 120 | c891c678-1cf0-4842-bcec-fe93b9479a28 | 12 | Network activity | ip-dst | 50.62.133.49 | IP address linked to deyrep24.ddns.net | 1 | 20161108 |
| 121 | cbdf99c3-ac02-49e1-bd44-aa95c5e2acac | 12 | Network activity | domain | wjwj.no-ip.org | 1 | 20161104 | |
| 122 | ced4acdc-8a7e-4766-b6c6-431b37b0e332 | 12 | Payload delivery | email-src | cfed.bonadio@gmail.com | Phishing source pretending to be Claudio Bonadio | 1 | 20161108 |
| 123 | cf896608-add9-45a1-8a66-8a04096b70f1 | 12 | Network activity | domain | mail.asambleanacional.gob.ec | 1 | 20161104 | |
| 124 | cfd9e067-855e-4c38-af7b-b1ec7b9c5e0f | 12 | Network activity | domain | support-whatsapp.com | 1 | 20161104 | |
| 125 | d036cf1a-59fb-4c11-9da9-cbf99f5733a7 | 12 | Artifacts dropped | md5 | ed8d7ed45b64890b8901b735018318f3 | CyberGate | 1 | 20161108 |
| 126 | d605e928-93ec-4aec-897e-0de476fe3f0e | 12 | Network activity | domain | s1.support | 1 | 20161104 | |
| 127 | d736d788-19c3-47d3-85ba-6f1b8a3f0897 | 12 | Network activity | ip-dst | 186.220.1.84 | 1 | 20161104 | |
| 128 | d79f9f17-548f-4712-afdf-a8dc5dc43be1 | 12 | Network activity | domain | taskmgr.servehttp.com | 1 | 20161104 | |
| 129 | da13fa70-4007-4c44-b611-a890dd8b1f31 | 12 | Artifacts dropped | md5 | ea7bcf58a4ccdecb0c64e56b9998a4ac | Adzok | 1 | 20161108 |
| 130 | dad67427-90fd-429f-94cc-15aab9efefc7 | 12 | Artifacts dropped | md5 | bc97437fec7e7e8634c2eabae3cc4832 | CyberGate | 1 | 20161108 |
| 131 | e4567864-ed20-4a52-8ebc-280bb84bc259 | 12 | Payload delivery | email-src | no.response.delivery.es@gmail.com | 1 | 20161104 | |
| 132 | ec9d62d6-4906-45a7-a781-a4b3939e77bc | 12 | Network activity | domain | gmail.com.msg07.xyz | 1 | 20161104 | |
| 133 | f4ce5713-8486-4eff-be64-f04899ad0e63 | 12 | Network activity | ip-dst | 186.220.11.67 | 1 | 20161104 | |
| 134 | f5818138-37c1-412a-8cf7-2d7bcb538367 | 12 | Network activity | domain | lavozamericana.info | 1 | 20161104 | |
| 135 | f7508074-3443-4ceb-a1b6-08e87bc65b44 | 12 | Network activity | domain | support-login-validate-outlook.tk | 1 | 20161104 | |
| 136 | f7dbcb2a-96c1-48d9-8bda-785348f8d91b | 12 | Artifacts dropped | md5 | 6c34d4296126679d9c6a0bc2660dc453 | CyberGate | 1 | 20161108 |
| 137 | fd6b3ff2-e441-4bc1-ba2d-d3d9dd50ab24 | 12 | Network activity | domain | ns.update-outlook.info | 1 | 20161104 |