25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T1ac8,Pattern match: "https://kb.acronis.com/content/63839", Pattern match: "https://kb.acronis.com/content/8128", Pattern match: "https://kb.acronis.com/content/62562", Pattern match: "https://go.acronis.com/acphbmobile/android/download", Pattern match: "https://go.acronis.com/atih2026/faq", Pattern match: "https://www.acronis.com/redirector/products{0}/whats_new", Pattern match: "https://www.acronis.com/redirector/products{0}/account", Pattern match: "https://account.acronis.com", Pattern match: "http://www.acronis.com/", Pattern match: "https://go.acronis.com/atih2026/aur", Pattern match: "https://www.acronis.com/redirector/products{0}/inapp/uninstall", Pattern match: "https://www.acronis.com/redirector/products{0}/mobile_ios", Pattern match: "https://www.acronis.com/redirector/products{0}/remind", Pattern match: "https://kb.acronis.com/content/7696", Pattern match: "https://www.acronis.com/redirector/products{0}/store", Pattern match: "https://go.acronis.com/atih2026/tnd", Pattern match: "https://go.acronis.com/atih2026/moveactivation", Pattern match: "https://www.acronis.com/redirector/products/acpp/success/", Pattern match: "https://go.acronis.com/acphbmobile/ios/download", Pattern match: "https://www.acronis.com/redirector/products{0}/mobile_windows", Pattern match: "https://go.acronis.com/cloud-backup-download", Pattern match: "https://kb.acronis.com/content/67484", Pattern match: "https://www.acronis.com/redirector/products{0}/mobile_android", Pattern match: "https://www.acronis.com/redirector/products{0}/onboarding", Pattern match: "https://www.acronis.com/redirector/products{0}/help", Pattern match: "https://www.acronis.com/activation", Pattern match: "https://www.acronis.com/support/", Pattern match: "https://security-advisory.acronis.com/updates", Pattern match: "https://go.acronis.com/mediabuilder/aik/ver=30", Pattern match: "https://www.acronis.com/redirector/products{0}/cloud_features", Pattern match: "https://www.acronis.com/redirector/products{0}/store/buy", Pattern match: "https://kb.acronis.com/content/59986", Pattern match: "https://kb.acronis.com/content/69302", Pattern match: "https://www.acronis.com/redirector/products{0}/antimalware_learn_more", Pattern match: "https://go.acronis.com/atih2026/activation", Pattern match: "https://www.acronis.com", Pattern match: "https://www.acronis.com/personal/", Pattern match: "https://go.acronis.com/ati/business/overview", Pattern match: "https://care.acronis.com/s/support-portal/for-individuals/acronis-true-image", Pattern match: "http://fakelink", Pattern match: "https://www.acronis.com/redirector/products{0}/mobile", Pattern match: "https://www.acronis.com/redirector/products{0}/register_serial", Pattern match: "https://go.acronis.com/fd/page=c2c_create", Pattern match: "https://kb.acronis.com/content/59700", Pattern match: "https://www.acronis.com/redirector/products{0}/welcome", Pattern match: "https://go.acronis.com/fd/page=account-from-local", Pattern match: "https://go.acronis.com/fd/page=email_notifications", Pattern match: "https://www.acronis.com/redirector/products{0}/cep_policy", Pattern match: "https://go.acronis.com/fd/page=c2c", Pattern match: "https://kb.acronis.com/content/67768", Pattern match: "https://www.acronis.com/redirector/products{0", Pattern match: "https://kb.acronis.com/errorcode/", Pattern match: "https://account.acronis.com/#/products/", Pattern match: "https://kb.acronis.com/content/72322", Pattern match: "https://go.acronis.com/mediabuilder/adk", Pattern match: "https://www.acronis.com/redirector/products{0}/store/upgrade", Pattern match: "https://www.acronis.com/redirector/products{0}/diskdirector", Pattern match: "https://www.acronis.com/company/privacy.html", Pattern match: "https://go.acronis.com/fd/page=account", Pattern match: "https://go.acronis.com/atimac2026/moveactivationmac", Pattern match: "https://go.acronis.com/eol_syncandshare", Pattern match: "https://go.acronis.com/2fa_kb", Pattern match: "https://go.acronis.com/atih2026/movesubscription", Pattern match: "https://www.acronis.com/redirector/products{0}/failed_activation", Pattern match: "https://www.acronis.com/redirector/products{0}/rn", Pattern match: "https://kb.acronis.com/content/67076", Pattern match: "https://www.acronis.com/redirector/products{0}/kb", Pattern match: "https://kb.acronis.com/content/60425", Pattern match: "https://www.acronis.com/redirector/products/atih2026/users_guide_pdf", Pattern match: "https://kb.acronis.com/content/61738", Pattern match: "https://www.acronis.com/redirector/products{0}/inapp/mediabuilder/recovery", Pattern match: "https://kb.acronis.com/content/73032", Pattern match: "https://www.acronis.com/redirector/products{0}/community-tools", Pattern match: "https://www.acronis.com/redirector/products{0}/aur", Pattern match: "https://kb.acronis.com/content/61721", Pattern match: "https://kb.acronis.com/content/64013", Pattern match: "https://www.acronis.com/redirector/products{0}/webrestore", Pattern match: "https://go.acronis.com/atimac2026/faq", Pattern match: "https://go.acronis.com/mediabuilder/dt/ver=2004", Pattern match: "https://kb.acronis.com/content/16336", Pattern match: "https://www.acronis.com/redirector/products{0}/manage_licenses", Pattern match: "https://go.acronis.com/mediabuilder/dt/ver=win11", Pattern match: "https://www.acronis.com/legal.html", Pattern match: "https://www.acronis.com/redirector/products{0}/inapp/oem/all_features", Pattern match: "https://go.acronis.com/fd", Pattern match: "https://kb.acronis.com/content/61832", Pattern match: "https://trueimage.acronis.com", Pattern match: "https://kb.acronis.com/content/57895", Pattern match: "https://kb.acronis.com/content/57875", Pattern match: "https://www.acronis.com/redirector/products{0}/inapp/activation?ct=1", Pattern match: "https://go.acronis.com/mediabuilder", Pattern match: "https://www.acronis.com/redirector/products{0}/cve", Pattern match: "https://go.acronis.com", Pattern match: "https://kb.acronis.com/content/4834", Pattern match: "https://www.acronis.com/redirector/products{0}/notary", Pattern match: "https://kb.acronis.com/content/60619", Pattern match: "https://go.acronis.com/mediabuilder/addon/ver=2004", Pattern match: "https://www.acronis.com/redirector/products{0}/inapp/store", Pattern match: "https://go.acronis.com/mediabuilder/addon/ver=win11", Pattern match: "https://kb.acronis.com", Pattern match: "https://kb.acronis.com/content/67265", Pattern match: "https://kb.acronis.com/content/57946", Pattern match: "https://www.acronis.com/redirector/products{0}/forum", Pattern match: "https://kb.acronis.com/content/27259", Pattern match: "https://www.acronis.com/redirector/products", Pattern match: "https://kb.acronis.com/content/65552", Pattern match: "https://www.acronis.com/support", Pattern match: "https://go.acronis.com/fd/page=identity-protection"27:T4a0,Found reference to API "The full path of a socket file is too long." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Paused due to system shutdown today at %1" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "Stopped due to system shutdown on %1, %2" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "Stopped due to system shutdown today at %1" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "By default, you will connect to the network folder as "{0}". To connect as another user, enter their user name and password above." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Paused due to system shutdown yesterday at %1" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "Stopped due to system shutdown yesterday at %1" (Indicator: " shutdown "; Source: "sample.bin"), Found reference to API "Paused due to system shutdown on %1, %2" (Indicator: " shutdown "; Source: "sample.bin")28:Taa8,Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "NtOpenFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumePathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "NtClose"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileW"; Source: "sample.bin"), Found reference to API (Indicator: "LockFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileShortNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryVolumeInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "UnlockFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "NtQueryDirectoryFile"; Source: "sample.bin"), Found reference to API (Indicator: "EncryptFileW"; Source: "sample.bin"), Found reference to API (Indicator: "NtSetInformationFile"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileSecurityW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; Source: "sample.bin")29:Tb14,Found string "Please specify a new password or select not to use a password for Acronis Secure Zone:" (Indicator: "password"; Source: "sample.bin"), Found string "To get access to Acronis Secure Zone enter the password that was specified on Acronis Secure Zone creation." (Indicator: "password"; Source: "sample.bin"), Found string "Enter the password to enable encryption options." (Indicator: "password"; Source: "sample.bin"), Found string "Failed to reset Acronis Secure Zone password." (Indicator: "password"; Source: "sample.bin"), Found string "The answer to the secret question is incorrect. Please type the correct answer." (Indicator: "secret"; Source: "sample.bin"), Found string "Old password:" (Indicator: "password"; Source: "sample.bin"), Found string "The sync is password protected" (Indicator: "password"; Source: "sample.bin"), Found string "The password is incorrect." (Indicator: "password"; Source: "sample.bin"), Found string "Answer the secret question:{0}" (Indicator: "secret"; Source: "sample.bin"), Found string "The password and confirmation do not match." (Indicator: "password"; Source: "sample.bin"), Found string "Acronis Secure Zone is password-protected" (Indicator: "password"; Source: "sample.bin"), Found string "Password is required. Please, enter a password to activate the boot menu." (Indicator: "password"; Source: "sample.bin"), Found string "The answer to the secret question is empty. Please type the answer." (Indicator: "secret"; Source: "sample.bin"), Found string "No password specified." (Indicator: "password"; Source: "sample.bin"), Found string "User name and password are " (Indicator: "password"; Source: "sample.bin"), Found string "Please specify the password." (Indicator: "password"; Source: "sample.bin"), Found string "Backup reserve copy is password-protected." (Indicator: "password"; Source: "sample.bin"), Found string "firm password:" (Indicator: "password"; Source: "sample.bin"), Found string "Check the entered password. Perhaps the CapsLock key is on." (Indicator: "password"; Source: "sample.bin"), Found string "Did you forget your password?" (Indicator: "password"; Source: "sample.bin"), Found string "Connection failed. Please verify user name and password." (Indicator: "password"; Source: "sample.bin"), Found string "The archive is password-protected. Please enter the password." (Indicator: "password"; Source: "sample.bin"), Found string "Checking password..." (Indicator: "password"; Source: "sample.bin"), Found string "The backup is password-protected" (Indicator: "password"; Source: "sample.bin"), Found string "Acronis Secure Zone is password-protected. To access Acronis Secure Zone you must enter the password." (Indicator: "password"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 0f26b5272284… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 0f26b5272284…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"qt_supp_ex.dll\",\"applicationCategory\":[\"pedll\",\"64bits\",\"executable\"],\"identifier\":\"0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793171402199,"unified_at":"2026-10-28T07:10:02.199Z","metadata":{"hashes":{"sha256":"0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e","sha1":"6a60823d4c844b918939ef8f12a48874ed6687b9","md5":"3e566bd40a26ccd7a9d72751b5c20f70"},"file_info":{"file_name":"qt_supp_ex.dll","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":1992248,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793171395000,"last_seen":1793171395000,"last_multi_scan":1793171395000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":23},"sandbox_signatures":{"informative_count":34,"suspicious_count":1,"malicious_count":0,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Found anti-virus related strings names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://kb.acronis.com\", Found HTTPS url \"https://www.acronis.com\", Found HTTPS url \"https://go.acronis.com\", Found HTTPS url \"https://account.acronis.com\", Found HTTPS url \"https://security\", Found HTTPS url \"https://care.acronis.com\", Found HTTPS url \"https://trueimage.acronis.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"192.168.0.2\" found in string \"Computer name must be specified.\nPlease provide the computer's name or its full IP address, such as 192.168.0.2\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileNoCacheW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Acronis\\TrueImage\" in Source: sample.bin, \"Software\\Acronis\\TrueImageHome\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" in Source: sample.bin, \"Software\\Acronis\\GlobalComponents\" in Source: sample.bin, \"Software\\Acronis\\TrueImageHome\\Settings\" in Source: sample.bin, \"SYSTEM\\CurrentControlSet\\Control\" in Source: sample.bin, \"Software\\Acronis\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\https\\UserChoice\" in Source: sample.bin, \"Software\\Acronis\\CommonComponents\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl(FSCTL_QUERY_USN_JOURNAL)\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"DeviceIoControl(FSCTL_READ_USN_JOURNAL)\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\"), Found reference to API \"DeviceIoControl(FSCTL_ENUM_USN_DATA)\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Delete from PC\" (Source: sample.bin, Indicator: \"delete from pc\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetSecurityDescriptorOwner\" (Indicator: \"GetSecurityDescriptorOwner\"; Source: \"sample.bin\"), Found reference to API \"GetFileSecurityW\" (Indicator: \"GetFileSecurityW\"; Source: \"sample.bin\"), Found reference to API \"SetFileSecurityW\" (Indicator: \"SetFileSecurityW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"sample.bin\"), Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\\\?\\GLOBALROOT\\DEVICE\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\"), Found string \"\\\\?\\GLOBALROOT\\Device\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Found anti-virus related strings names","description":"Found string \"Antivirus scan failed.\" (Indicator: \"antivir\"; Source: \"sample.bin\"), Found string \"Antivirus scan failed\" (Indicator: \"antivir\"; Source: \"sample.bin\"), Found string \"Antivirus scan was canceled by the user.\" (Indicator: \"antivir\"; Source: \"sample.bin\"), Found string \"Antivirus scan was cancelled by user\" (Indicator: \"antivir\"; Source: \"sample.bin\"), Found string \"Rescue Media Builder\" (Indicator: \"rescue\"; Source: \"sample.bin\"), Found string \"Antivirus scan completed successfully\" (Indicator: \"antivir\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-134","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$29","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"NtQueryInformationFile\" (Indicator: \"QueryInformationFile\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleW\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where did you first meet your spouse?\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"AES 192\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AES 256\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"AES 128\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1006","id":"string-194","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set a custom location for the backup.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set permission\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Bookmark\t\tBookmark current folder.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set new password.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set pass\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; Source: \"sample.bin\"), Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\"), Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"DecryptFileW\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\"), Found reference to API \"EncryptFileW\" (Indicator: \"EncryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"DecryptFileW\" (Indicator: \"DecryptFileW\"; Source: \"sample.bin\"), Found api reference \"EncryptFileW\" (Indicator: \"EncryptFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileW\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \" !\"#$%&'()*+,-./0123@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"sample.bin\"), Found string \" !\"#$%&'()*+,-./0123@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e":{"type":"File","value":"0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1564899009205707922","root":"File:0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 0f26b5272284… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 0f26b5272284…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e"}],["$","meta","4",{"property":"og:title","content":"Sample 0f26b5272284… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 0f26b5272284…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0f26b52722842563bce69b6025760bab0ee721af9bdecd632afb61a662a3ba4e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 0f26b5272284… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 0f26b5272284…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]