24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 21098846464e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 21098846464e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 22/26 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93"],"about":{"@type":"SoftwareApplication","name":"Sadegh_khodabandehCrab.exe","applicationCategory":["peexe","executable"],"identifier":"21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":22,"total":26},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T494,"\Sessions\1\BaseNamedObjects\Global\pc_group=WORKGROUP&ransom_id=6407c8d4c1e50b54" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!8v2hevp!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!8v2hevp!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!8v2hevp!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "Global\pc_group=WORKGROUP&ransom_id=6407c8d4c1e50b54" "Local\WininetStartupMutex" "Local\ZoneAttributeCacheCounterMutex" "Local\_!MSFTHISTORY!_" "Local\c:!users!8v2hevp!appdata!roaming!microsoft!windows!cookies!" "Local\WininetProxyRegistryMutex" "IESQMMUTEX_0_208" "RasPbFile"26:T90e,Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00017165-00002740) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00018302-00003720) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00019436-00003664) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00020556-00002780) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00021677-00003192) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00022801-00003412) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00023921-00001736) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00025043-00002768) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00026176-00002372) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00027297-00002984) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00028414-00001632) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00029534-00003316) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00030654-00003276) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00031774-00003332) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00032893-00003416) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00034014-00002980) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00035144-00002496) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00036263-00002540) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00037391-00002212) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00038512-00003592)27:T6fe,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\en-US\crypt32.dll.mui" "" touched file "C:\Windows\system32\config\systemprofile" "" touched file "C:\Users\8V2HeVp\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\8V2HeVp\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\8V2HeVp\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\ipv4bot_whatismyipaddress_com[1].htm" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\nslookup.exe" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat"28:T5a0,"" wrote bytes "7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x74A21000" (part of module "WSHIP6.DLL") "" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "nslookup.exe" wrote bytes "7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x74A21000" (part of module "WSHIP6.DLL") "nslookup.exe" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "nslookup.exe" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL")29:Ta31,Spawned process "" (UID: 00016119-00003600) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00017165-00002740) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00018302-00003720) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00019436-00003664) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00020556-00002780) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00021677-00003192) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00022801-00003412) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00023921-00001736) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00025043-00002768) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00026176-00002372) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00027297-00002984) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00028414-00001632) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00029534-00003316) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00030654-00003276) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00031774-00003332) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00032893-00003416) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00034014-00002980) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00035144-00002496) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00036263-00002540) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns2.wowservers.ru" (UID: 00037391-00002212) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns1.wowservers.ru" (UID: 00038512-00003592) Spawned process "nslookup.exe" with commandline "nslookup carder.bit ns1.wowservers.ru" (UID: 00039633-00003296) Spawned process "nslookup.exe" with commandline "nslookup ransomware.bit ns2.wowservers.ru" (UID: 00040755-00003876)2a:T11a1,"" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 980) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 980) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 980) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1000) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1000) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1000) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1032) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1032) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1032) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1048) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1048) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1048) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1064) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1064) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1064) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1072) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1072) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1072) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1088) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1088) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1088) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1104) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1104) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1104) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1120) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1120) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1120) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1144) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1144) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1144) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1160) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1160) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1160) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1176) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1176) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1176) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1192) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1192) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1192) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1212) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1212) "" wrote 4 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1212) "" wrote 32 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1228) "" wrote 52 bytes to a remote process "C:\Windows\System32\nslookup.exe" (Handle: 1228)2b:T23c8,Found malicious artifacts related to "66.171.248.178": ... URL: http://ipv4bot.whatismyipaddress.com/ (AV positives: 2/67 scanned on 05/11/2018 12:57:58) URL: http://bot.whatismyipaddress.com/ (AV positives: 1/67 scanned on 05/11/2018 12:20:06) URL: http://bot.whatismyipaddress.com/work/newexe/10.exe (AV positives: 1/67 scanned on 04/30/2018 14:28:35) URL: http://66.171.248.178/ (AV positives: 2/67 scanned on 04/23/2018 10:12:46) File SHA256: 9de04e4f53ad1c8faca322bdff2408672114d87cfc3c12576977de90bc53ed01 (AV positives: 49/66 scanned on 05/11/2018 13:01:28) File SHA256: 1ca3a26896d4f7f896dc0a8971da32eb62406175048db440ddbe01e776785b68 (AV positives: 50/66 scanned on 05/11/2018 13:01:09) File SHA256: 4757097edc1224d86afa614b8a3a50794f1a43ca55a47fca15fac9426e1ac173 (AV positives: 55/65 scanned on 05/11/2018 13:00:38) File SHA256: 8d8c8c0e013829bfb662249a0b35acadd6dd8f3fef4a6c0dd334d735ff864cf9 (AV positives: 48/66 scanned on 05/11/2018 13:00:02) File SHA256: 8bf0091bac08f269cf5af1db6a5a526adbbca8c92ee77b26cee3c6186ea2fb58 (AV positives: 50/65 scanned on 05/11/2018 12:59:25) File SHA256: 5c5c6c612a86729719561d0fd1603738788452096cb29f0526203511d17e427d (Date: 05/11/2018 05:49:18) File SHA256: 7e2d1657675a1ba4e633b5c4b9e4f7621fddf98848044800b51b53fdf01b84cd (Date: 05/10/2018 16:08:30) File SHA256: 02bee3c1c367fd0a6fb135e331cf8a63a08777885f6cc9a1c64ba4d56b5cd5b5 (Date: 05/10/2018 01:13:26) File SHA256: 07fe6ef1618a51e3e8225d295f30c1133f0395c9d3346a58cd86d3ec0d81c42a (Date: 05/10/2018 01:09:18) File SHA256: 8c6a5628d5b497499327293087c107edbcafbcb7e9c54be9eff1aae7e9152d1c (Date: 05/09/2018 23:40:35) Found malicious artifacts related to "89.203.10.56": ... URL: http://ns1.wowservers.ru/ (AV positives: 5/67 scanned on 05/11/2018 01:58:47) URL: http://89.203.10.56/ (AV positives: 1/67 scanned on 05/10/2018 02:18:03) URL: http://ns2.wowservers.ru/ (AV positives: 5/67 scanned on 05/10/2018 02:09:05) URL: https://ns1.wowservers.ru/ (AV positives: 4/67 scanned on 05/04/2018 14:33:31) URL: https://ns2.wowservers.ru/ (AV positives: 2/67 scanned on 05/01/2018 00:27:41) File SHA256: 7e2d1657675a1ba4e633b5c4b9e4f7621fddf98848044800b51b53fdf01b84cd (Date: 05/10/2018 16:08:30) File SHA256: ba278a5863f15e76d7268e847023904ca64a8eb18b95ed2c56e35da75616d866 (AV positives: 53/67 scanned on 05/08/2018 12:14:07) File SHA256: 12fe7367c8da2dd1bf35c07cbc43abae367d52c541f05f95b280efc7e4886639 (AV positives: 49/67 scanned on 05/08/2018 11:25:38) File SHA256: a345b934930e234b01de27ef0c77b9a52eb3cb54593ad325d421d12db3ff7d28 (AV positives: 50/67 scanned on 05/08/2018 11:24:47) File SHA256: 58984f494c7cb72b0b73d78866ce91802cb9102ad1b261e5066587bfc3cef5aa (AV positives: 52/67 scanned on 05/08/2018 11:24:20) File SHA256: 6db5d76495949c7cd420c2360af51384fab3eef238538ea7223477663883e281 (AV positives: 48/66 scanned on 05/08/2018 11:23:12) File SHA256: 9e862435c0b0b6dd32e0434f7dfcc835262ce0c4a3ea07c9ba6f42f0cb565733 (Date: 05/05/2018 23:18:42) File SHA256: 533905a77997a09aec51f9987231a40094900d24ce7ba43b4ba57820f4eeca2a (Date: 05/05/2018 17:31:30) File SHA256: 2572859ff4db26198363b7d6df174e3718dcba78cb4f71cb319420d503a4f543 (Date: 05/03/2018 12:19:28) File SHA256: 9359048ea96c72fbecd38bf7df705de92946a33f4aab16cd5412f4999588aad8 (Date: 03/14/2018 18:29:12) Found malicious artifacts related to "189.75.183.21": ... URL: http://ns1.wowservers.ru/ (AV positives: 5/67 scanned on 05/10/2018 02:08:49) URL: https://ns1.wowservers.ru/ (AV positives: 4/67 scanned on 05/04/2018 16:31:35) URL: https://ns2.wowservers.ru/ (AV positives: 2/67 scanned on 04/30/2018 20:53:55) URL: http://ns2.wowservers.ru/ (AV positives: 1/67 scanned on 04/17/2018 13:03:45) URL: http://ns2.cloud-name.ru/ (AV positives: 2/67 scanned on 04/03/2018 06:59:23) File SHA256: fbd094b4c837f2d9438c5fd60200acb85463dbc20eaba4ae7a5ddc8dc1f4ec27 (AV positives: 47/67 scanned on 05/08/2018 12:20:03) File SHA256: 66e3737c8e357203eb85152dc549afc59d7cc2a0b0fc5ed8c50406e5c5329838 (AV positives: 47/67 scanned on 05/08/2018 12:15:18) File SHA256: e21e5861cd46e8ecf8b3ec4714fd3547b45786116d258ab311831d4bfa4f7284 (AV positives: 48/67 scanned on 05/08/2018 12:04:56) File SHA256: 9d50a936d8d61793979d8612e51d8135cd6ddfe22a93675bbfceb8c53b30f70b (AV positives: 51/67 scanned on 05/08/2018 11:21:32) File SHA256: 59ed8d952b3256870c498a9ef1e7c5182a7906ddd4ab7081e1091d597568b5c9 (AV positives: 47/66 scanned on 05/08/2018 11:19:04) File SHA256: 237ba6435ed46313760f443df31598d7331026ab63b974c1b6fa3234335ba87d (Date: 05/08/2018 16:29:04) File SHA256: c7ab0505e9378b525de77bf518ac6d0c8a38aaa2ea07465f4ed6f7d220d86c06 (Date: 05/07/2018 19:26:56) File SHA256: fa5b2298f57da2d5322f5afbc9e811fb1aba7426fde3d4c034447459c5ae1c50 (Date: 05/06/2018 20:39:49) File SHA256: 35b5a53268cc6f6dff357cae44bec45dd216be9c52c1d7778c08995838d1a981 (Date: 05/06/2018 13:45:48) File SHA256: 8da0b40ff7597e7c00df4d156e27523e81f400237e842d70d872812f3fd38dd3 (Date: 05/06/2018 03:20:05) Found malicious artifacts related to "93.184.221.240": ...File SHA256: f5ac9ef707c67e521bce9fe50923c9ad5432265653ae030e5d6af254ba313b59 (AV positives: 20/44 scanned on 05/11/2018 13:02:40) File SHA256: 950a2a7e1865a07ea07930affef4530ecbf6f31576e3d633deda81c20dd5c31f (AV positives: 35/66 scanned on 05/11/2018 13:02:20) File SHA256: 75417357b3cc77d2118a405cecb63fbbf526d43172caf0925a05edacfccb1806 (AV positives: 61/66 scanned on 05/11/2018 13:01:52) File SHA256: 1eb2f0378d87dd5aee1bd41767a1c632f3e66c4c74896ff65c46547823685d80 (AV positives: 56/66 scanned on 05/11/2018 12:59:46) File SHA256: 23fce2f33b13a4e01c15dc7d2bd6a424c3c0959af0e29bc150d3ed7ddb9247fc (AV positives: 56/66 scanned on 05/11/2018 12:59:44) File SHA256: cc3d7aad377a9b7556cc9b44188dd039b259a070d37e75ae142ec7185aba28ac (Date: 05/11/2018 13:45:04) File SHA256: 51c8bb29dac3df7adfc1d78eda74672eae8260ab6b70358b6b9887cabca4f888 (Date: 05/11/2018 13:25:57) File SHA256: 4d72fb948626aa5da1200353573405a66aa317d5cfbc4a557b62ebb94bfc7d9d (Date: 05/11/2018 13:25:38) File SHA256: 522365d0811ee12ad46810aef1c432ded61ee60f4b95a0b835e96e7f61429ada (Date: 05/11/2018 11:39:00) File SHA256: c330220dce1f3288c37744c6e61496e6cdc5002035502679df97595d721da94a (Date: 05/11/2018 11:37:10) Found malicious artifacts related to "216.58.215.46": ...File SHA256: e9fab80940f77019770e6346b9b352daec9e9dff32a5b3c89f588efd5c2e99a8 (AV positives: 50/65 scanned on 05/10/2018 22:10:23) File SHA256: bab6acb5010c07e8958eef87d38053700f7e6ea8753ab4b10dfbe9bbdf75395c (AV positives: 50/66 scanned on 05/10/2018 22:10:02) File SHA256: c61fc5a4a8a802b4df1f47795889c82893bb26f68fbf1717229224255104f3cb (AV positives: 52/67 scanned on 05/10/2018 22:07:29) File SHA256: a81fbba508f40b4af4c672e44db7fc212c1638860e721e201e650d892c3aa639 (AV positives: 44/64 scanned on 05/10/2018 22:07:16) File SHA256: c6a47e647577e8d3e6ba30a568ee7d0841eed3cd2a6eafbd7ca3b61059292325 (AV positives: 51/66 scanned on 05/10/2018 22:05:38) File SHA256: 9e0db105b65ac5ef17bb7bd3d1b6b8bc22d7e69db35feecff766e048959f7166 (Date: 05/10/2018 14:48:18) File SHA256: 6d26d606661ad73839bbcfcbc42ec6ade0f95edcbc445ba322cac3e917095d21 (Date: 05/09/2018 23:03:38) File SHA256: c902d4018e5c17ad83ec7230d43e0d1128a3bff2b8f56d2a6cbbc604be2ebc64 (Date: 05/09/2018 17:31:21) File SHA256: 14b6249213839e69c4ac9dc66d8e57944a8abbf57800215e0de22e67ccb92d71 (Date: 05/09/2018 16:06:19) File SHA256: cafd628e1590a7b176a4ae43f2741ad756bf5a3255541a921cd9fc365aa85908 (Date: 05/07/2018 14:49:20) Found malicious artifacts related to "94.249.60.127": ... URL: http://ns2.wowservers.ru/ (AV positives: 5/67 scanned on 05/10/2018 03:47:49) URL: http://ns1.wowservers.ru/ (AV positives: 5/67 scanned on 05/04/2018 15:17:44) URL: http://ns1.corp-servers.ru/ (AV positives: 2/67 scanned on 04/24/2018 04:12:03) URL: http://ns1.cloud-name.ru/ (AV positives: 2/67 scanned on 04/03/2018 13:01:33) URL: http://dns3.cloud-name.ru/ (AV positives: 1/67 scanned on 04/01/2018 11:49:11) File SHA256: 5c5c6c612a86729719561d0fd1603738788452096cb29f0526203511d17e427d (Date: 05/11/2018 05:49:18) File SHA256: 7e2d1657675a1ba4e633b5c4b9e4f7621fddf98848044800b51b53fdf01b84cd (Date: 05/10/2018 16:08:30) File SHA256: b502dd224fefe1331dbab04cb19973fa9721843876e67c08c39f288cd78d7fad (AV positives: 47/66 scanned on 05/08/2018 12:05:50) File SHA256: 221d24896f247427886de9bfca65f62479efb759464a3432aeda08378f363024 (AV positives: 50/67 scanned on 05/08/2018 11:26:34) File SHA256: f958d7ac55b6d1a66242dfef6ec43b3565e189a36873bbc35886dd56e77e4e32 (AV positives: 45/65 scanned on 05/08/2018 11:18:48) File SHA256: af6f4535ea947553017559ec63eaa1ac70ab89d7bbec474559a4d68c046c83d4 (AV positives: 51/67 scanned on 05/08/2018 11:18:04) File SHA256: e75a4926602d4f19e6db4dbadb23ee1b121cae4ab4d6d5ad9894ad03828d8c86 (AV positives: 50/65 scanned on 05/08/2018 10:44:57) File SHA256: fa5b2298f57da2d5322f5afbc9e811fb1aba7426fde3d4c034447459c5ae1c50 (Date: 05/06/2018 20:39:49) File SHA256: 533905a77997a09aec51f9987231a40094900d24ce7ba43b4ba57820f4eeca2a (Date: 05/05/2018 17:31:30) File SHA256: 2572859ff4db26198363b7d6df174e3718dcba78cb4f71cb319420d503a4f543 (Date: 05/03/2018 12:19:28)2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3ZmZ3iIiIiHd3dzMiInd3d2Zmd4iIiIh3d3czIiJ3d3d3ZneIiHd3d3d3MyIid3d3d2Z3iIh3d3d3dzMiInd3d1URd3d3d3d3d3d3IiJ3d3dVEXd3d3d3d3d3dyIidzNVERERd3eIiHd3d3ciInczVREREXd3iIh3d3d3IiJ3MzMREVV3iIiId4iIIiIidzMzERFVd4iIiHeIiCIiInczM0RVd3d3iHd3iIgiIiJ3MzNEVXd3d4h3d4iIIiIid2ZmZnd3iHd3d3eIiCIiIndmZmZ3d4h3d3d3iIgiIiJ3ZmZ3iIiIdxERd4iIIiIid2Zmd4iIiHcREXeIiCIiInd3ZneIiIgRERERd3ciIiJ3d2Z3iIiIEREREXd3IiIiiHdmd3eIiHcREXeIdyIiIoh3Znd3iIh3ERF3iHciIiKIiHd3d4iId3d3iIh3IiIiiIh3d3eIiHd3d4iIdyIiIoiIiIiId3d3d3d3d3cRESKIiIiIiHd3d3d3d3d3EREiiIiIiIiId3d3d3d3ERERIoiIiIiIiHd3d3d3dxERESKIiIiIiGaId3d3d3dVEREiiIiIiIhmiHd3d3d3VRERIoiIiIhmiIiIiIh3d3ciIiKIiIiIZoiIiIiId3d3IiIiiIh3ZoiIiIiIiIh3dyIiIoiId2aIiIiIiIiId3ciIiIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790981912144,"unified_at":"2026-10-02T22:58:32.144Z","metadata":{"hashes":{"sha256":"21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93","sha1":"14194314363f4cdcbf62af97d8bc8b23baff2822","md5":"3d23b2ecf7b6b0cb988c0210b8ebd557","sha512":"79884b5de317e297739d06ebe38ebfc7a5dd15b298f92b0f4c5f4dc800cf47e733c0d06ab08b9fb2a66f3ba6ecbd7698d8ce3678ccc372e51af14af82f78d5be","ssdeep":"6144:22RyeKZrWkWIZwqutxCA4R7bV8taAj2DiLa+4RdlqMI:fWZrWkPZXutDo18tzj22ARdcMI","ssdeep_chunks":["6144:22RyeKZ","6144:2RyeKZr","6144:RyeKZrW","6144:yeKZrWk","6144:eKZrWkW","6144:KZrWkWI","6144:ZrWkWIZ","6144:rWkWIZw","6144:WkWIZwq","6144:kWIZwqu","6144:WIZwqut","6144:IZwqutx","6144:ZwqutxC","6144:wqutxCA","6144:qutxCA4","6144:utxCA4R","6144:txCA4R7","6144:xCA4R7b","6144:CA4R7bV","6144:A4R7bV8","6144:4R7bV8t","6144:R7bV8ta","6144:7bV8taA","6144:bV8taAj","6144:V8taAj2","6144:8taAj2D","6144:taAj2Di","6144:aAj2DiL","6144:Aj2DiLa","6144:j2DiLa+","6144:2DiLa+4","6144:DiLa+4R","6144:iLa+4Rd","6144:La+4Rdl","6144:a+4Rdlq","6144:+4RdlqM","6144:4RdlqMI","12288:22RyeKZ","12288:2RyeKZr","12288:RyeKZrW","12288:yeKZrWk","12288:eKZrWkW","12288:KZrWkWI","12288:ZrWkWIZ","12288:rWkWIZw","12288:WkWIZwq","12288:kWIZwqu","12288:WIZwqut","12288:IZwqutx","12288:ZwqutxC","12288:wqutxCA","12288:qutxCA4","12288:utxCA4R","12288:txCA4R7","12288:xCA4R7b","12288:CA4R7bV","12288:A4R7bV8","12288:4R7bV8t","12288:R7bV8ta","12288:7bV8taA","12288:bV8taAj","12288:V8taAj2","12288:8taAj2D","12288:taAj2Di","12288:aAj2DiL","12288:Aj2DiLa","12288:j2DiLa+","12288:2DiLa+4","12288:DiLa+4R","12288:iLa+4Rd","12288:La+4Rdl","12288:a+4Rdlq","12288:+4RdlqM","12288:4RdlqMI","6144:fWZrWkP","6144:WZrWkPZ","6144:ZrWkPZX","6144:rWkPZXu","6144:WkPZXut","6144:kPZXutD","6144:PZXutDo","6144:ZXutDo1","6144:XutDo18","6144:utDo18t","6144:tDo18tz","6144:Do18tzj","6144:o18tzj2","6144:18tzj22","6144:8tzj22A","6144:tzj22AR","6144:zj22ARd","6144:j22ARdc","6144:22ARdcM","6144:2ARdcMI"],"imphash":"24e9edc23da490ca9ae7bd336fffd16d"},"file_info":{"file_name":"Sadegh_khodabandehCrab.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":322569,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1526043388000,"last_seen":1630976477000,"last_multi_scan":1630976477000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":23,"malicious_count":8,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Gandcrab.Exp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.GandCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1106533","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GandCrab.Gen.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Upatre.RQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-e898dea3!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.GandCrab.Gen.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.HGVQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.GandCrab","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Adware ( 004e096c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXFJ-HD!3D23B2ECF7B6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.fbqyee","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Mauvaise.SL1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/GandCrab-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.GandCrab.322569","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.E1FCBBEE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.E1FCBBEE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.GandCrab.AFI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.GandCrypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 42182-945-004085E6\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016119-00003600-49195-16-004033B8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00016119-00003600-49195-444-00403387","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00016119-00003600-49195-142-00402881","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00016119-00003600-49195-61-0040BA30\n GetVersionExW@KERNEL32.DLL at 00016119-00003600-49195-66-0040CA30","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00016119-00003600-49195-141-00402041","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00016119-00003600-0000010C-705684\n \"\" queries volume information of \"C:\\\" at 00016119-00003600-0000010C-718593","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00016119-00003600-0000010C-705684\n \"\" queries volume information of \"C:\\\" at 00016119-00003600-0000010C-718593","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"carder.bit\"\n \"ns2.wowservers.ru\"\n \"ns1.wowservers.ru\"\n \"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"66.171.248.178:80\"\n \"89.203.10.56:53\"\n \"189.75.183.21:53\"\n \"93.184.221.240:80\"\n \"216.58.215.46:80\"\n \"216.58.215.46:443\"\n \"94.249.60.127:53\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Host: carder.bitUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"idiviz.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"ipv4bot_whatismyipaddress_com[1].htm\" has type \"ASCII text with no line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ns2.wowservers.ru\"\n Heuristic match: \"ns1.wowservers.ru\"\n Heuristic match: \"ipv4bot.whatismyipaddress.com\"\n Heuristic match: \"v4bot.whatismyipaddress.com\"\n Heuristic match: \"nslookup carder.bit ns1.wowservers.ru\"\n Heuristic match: \"nslookup ransomware.bit ns2.wowservers.ru\"\n Heuristic match: \"nslookup carder.bit ns2.wowservers.ru\"\n Heuristic match: \"nslookup ransomware.bit ns1.wowservers.ru\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")\n \"nslookup.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Sadegh_khodabandehCrab.exe.bin\" was detected as \"Microsoft visual C++ 8\"\n \"idiviz.exe\" was detected as \"Microsoft visual C++ 8\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.61804103826\n 7.61804103826","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00016119-00003600-49195-443-00402D1C\n cpuid at 00016119-00003600-49195-528-0041D700\n cpuid at 59517-949-0040A43A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"nslookup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET CURRENT_EVENTS DNS Query Domain .bit\" (SID: 2017645, Rev: 3, Severity: 2) categorized as \"Potentially Bad Traffic\" (Phishing, Exploit Kits)","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/67 reputation engines marked \"http://ipv4bot.whatismyipaddress.com\" as malicious (2% detection rate)\n 5/67 reputation engines marked \"http://ns1.wowservers.ru\" as malicious (7% detection rate)\n 5/67 reputation engines marked \"http://ns2.wowservers.ru\" as malicious (7% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 89.203.10.56\"\n \"UDP connection to 189.75.183.21\"\n \"UDP connection to 94.249.60.127\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"idiviz.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"OLGDVPYTYRB\"; Value: \"\"%APPDATA%\\Microsoft\\idiviz.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"HTTP/1.1 200 OKCache-Control: privateContent-Type: text/htmlServer: Date: Fri, 11 May 2018 12:58:17 GMTConnection: closeContent-Length: 13193.70.47.200\"\n \"193.70.47.200\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\Sadegh_khodabandehCrab.exe\" marked \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\ipv4bot_whatismyipaddress_com[1].htm\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Sadegh_khodabandehCrab.exe.bin\" claimed CRC 326590 while the actual is CRC 344292\n \"idiviz.exe\" claimed CRC 326590 while the actual is CRC 348482","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n WriteFile\n GetModuleHandleW\n IsDebuggerPresent\n TerminateProcess\n GetModuleHandleExW\n OutputDebugStringW\n CreateFileW\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$29","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"5/67 reputation engines marked \"http://ns1.wowservers.ru\" as malicious (7% detection rate)\n 5/67 reputation engines marked \"http://ns2.wowservers.ru\" as malicious (7% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/66 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/66 Antivirus vendors marked sample as malicious (37% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\USER\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2a","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ipv4bot.whatismyipaddress.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}]},"activity":{"stats":{"process_count":23,"spawned_processes_count":23,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":8,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":8,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":7,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5af592fb7ca3e1709d178221","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Gandcrab","contacted_countries":["BRA","EU","JOR","KWT","USA"],"submit_name":"Sadegh_khodabandehCrab.exe","analysis_start_time":"2018-05-11T13:54:47+00:00","indicators_count":{"informative":17,"suspicious":26,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"66.171.248.178","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"89.203.10.56","port":53,"protocol":"UDP","country":"Kuwait","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"189.75.183.21","port":53,"protocol":"UDP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"93.184.221.240","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"216.58.215.46","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"216.58.215.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"address":"94.249.60.127","port":53,"protocol":"UDP","country":"Jordan","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"dns_resolutions":[{"domain":"ns2.wowservers.ru","ttl":149,"country":"-","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"domain":"ns1.wowservers.ru","ttl":149,"country":"-","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"domain":"ipv4bot.whatismyipaddress.com","address":"66.171.248.178","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"domain":"carder.bit","address":"66.171.248.178","country":"United States","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"http_requests":[{"host":"carder.bit","host_ip":"66.171.248.178:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nHost: carder.bit\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}],"processes":[{"pid":3600,"ppid":0,"name":"Sadegh_khodabandehCrab.exe","command_line":"","sha256":"21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93","normalized_path":"C:\\Sadegh_khodabandehCrab.exe","uid":"00016119-00003600","icon":"$2c"},{"pid":2740,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00017165-00002740"},{"pid":3720,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00018302-00003720"},{"pid":3664,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00019436-00003664"},{"pid":2780,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00020556-00002780"},{"pid":3192,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00021677-00003192"},{"pid":3412,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00022801-00003412"},{"pid":1736,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00023921-00001736"},{"pid":2768,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00025043-00002768"},{"pid":2372,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00026176-00002372"},{"pid":2984,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00027297-00002984"},{"pid":1632,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00028414-00001632"},{"pid":3316,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00029534-00003316"},{"pid":3276,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00030654-00003276"},{"pid":3332,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00031774-00003332"},{"pid":3416,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00032893-00003416"},{"pid":2980,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00034014-00002980"},{"pid":2496,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00035144-00002496"},{"pid":2540,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00036263-00002540"},{"pid":2212,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00037391-00002212"},{"pid":3592,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00038512-00003592"},{"pid":3296,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup carder.bit ns1.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00039633-00003296"},{"pid":3876,"ppid":3600,"name":"nslookup.exe","command_line":"nslookup ransomware.bit ns2.wowservers.ru","sha256":"4a35c36f3f41f977fe1f0174d43c8cb9bd25a823b5f2a1970e501d839e1f8276","normalized_path":"%WINDIR%\\System32\\nslookup.exe","parent_uid":"00016119-00003600","uid":"00040755-00003876"}],"all_imported_dlls":["rpcrt4.dll","profapi.dll","nlaapi.dll","winrnr.dll","wship6.dll","gdi32.dll","imm32.dll","ole32.dll","normaliz.dll","rasapi32.dll","lpk.dll","clbcatq.dll","rasman.dll","rtutils.dll","shlwapi.dll","rpcss.dll","cryptbase.dll","nsi.dll","dnsapi.dll","IPHLPAPI.DLL","msasn1.dll","ntdll.dll","kernel32.dll","user32.dll","cryptsp.dll","dhcpcsvc.dll","netprofm.dll","crypt32.dll","iertutil.dll","msvcrt.dll","msctf.dll","dwmapi.dll","WSHTCPIP.DLL","KernelBase.dll","advapi32.dll","rsaenh.dll","ws2_32.dll","winnsi.dll","apphelp.dll","wsock32.dll","msvcr100.dll","shell32.dll","npmproxy.dll","sspicli.dll","ntmarta.dll","oleaut32.dll","uxtheme.dll","Wldap32.dll","FWPUCLNT.DLL","comctl32.dll","NapiNSP.dll","RpcRtRemote.dll","sechost.dll","rasadhlp.dll","mswsock.dll","dhcpcsvc6.dll","wininet.dll","urlmon.dll","psapi.dll","pnrpnsp.dll","SensApi.dll","usp10.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"idiviz.exe","sha256":"c7dc28d80b930b62c7ccfe20f284997aefab4dd325309d222b162c902d31a806","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"ipv4bot_whatismyipaddress_com[1].htm","sha256":"2ab57ff92555d494db20c903e7808c743000040c0ef74f18a10f1f544d2379f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"C:\\Sadegh_khodabandehCrab.exe","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%APPDATA%\\Microsoft\\idiviz.exe","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\System32\\en-US\\crypt32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\S-1-5-18\\e772882c853749aee1b6b86ef3e2e7c6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Crypto\\RSA\\MachineKeys\\e772882c853749aee1b6b86ef3e2e7c6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\system32\\config\\systemprofile","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\System32\\nslookup.exe","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\System32\\en-US\\nslookup.exe.mui","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{09477111-DE61-43CD-A5AA-D9F7B489301F}\\0A-00-27-00-00-00\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SADEGH_KHODABANDEHCRAB_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SADEGH_KHODABANDEHCRAB_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\pc_group=WORKGROUP&ransom_id=6407c8d4c1e50b54","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8v2hevp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8v2hevp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!8v2hevp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Global\\pc_group=WORKGROUP&ransom_id=6407c8d4c1e50b54","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\c:!users!8v2hevp!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\c:!users!8v2hevp!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"Local\\c:!users!8v2hevp!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5af592fb7ca3e1709d178221"}]}]}},"report_ids":{"sandbox_job_ids":["5af592fb7ca3e1709d178221"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 21098846464e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 21098846464e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 22/26 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 21098846464e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 21098846464e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 22/26 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/21098846464ea2a21c05db3ecac089e9a98165fb9261ab05fb48efff48887d93"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 21098846464e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 21098846464e…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 22/26 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]