26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 11f8431bb022… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 11f8431bb022…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839"],"about":{"@type":"SoftwareApplication","name":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","applicationCategory":["peexe","executable"],"identifier":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2f18,Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessage"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextStreamW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSListHead"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumValueW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFindAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyMenu"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalSize"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemFree"; Source: "sample.bin"), Found reference to API (Indicator: "InsertMenuItemW"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperW"; Source: "sample.bin"), Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingW"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstStreamW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessage"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "RtlGetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")28:T3ddb,"\Microsoft\Magnify\* [*] HKCU\Software\Microsoft\Osk\* [*] HKCU\Software\Microsoft\Narrator [FollowInsertion] Accessibility\Accessibility_Settings visua4 c|00001002|||0 c|000010de|||0 c|00008086|igxprd32.dll|G965 EXPRESS|0 c|00008086|igxprd32.dll| 965 EXPRESS|0 c|00008086|igxprd32.dll|Q965/Q963 EXPRESS|0 c|00008086|igxprd32.dll|P965 EXPRESS|0 c|00008086|igxprd64.dll|G965 EXPRESS|0 c|00008086|igxprd64.dll| 965 EXPRESS|0 c|00008086|igxprd64.dll|Q965/Q963 EXPRESS|0 c|00008086|igxprd64.dll|P965 EXPRESS|0 c|00008086|igdumd32.dll|G965 EXPRESS" in Source: sample.bin, "atch0[1]FeatureIDFILESINUSETEXTThe following applications should be closed before continuing the install:FXAssemblyVersion4.0.0.0FXAssemblyVersion353.5.0.0INSTALLLEVEL2LIMITUINullGUID{00000000-0000-0000-0000-000000000000}PIDRegEntryNameProductIDPIDUserNameRegKeySOFTWARE\Microsoft\VisualStudio\7.0\RegistrationPIDUserNameRegRootHKEY_LOCAL_MACHINEPrimaryDirVS7.3643236F_FC70_11D3_A536_0090278A1BB8REBOOTSuppressREPAIR_REINSTALLMODEpecmsuReserveAdditionalCostVS7UI8388608RunCount49UpdateProp1UpdateProp2UpdateProp3UpdateProp4UpdateProp5UserNameRegEntryNameUserNameARPSYSTEMCOMPONENTBuildTyperetURTVersionv4.0.30319LocProductNameMicrosoft Visual C++ 2017 x64 RuntimeProductCPUamd64ProductEditionRuntimeProductFamilyVCProductImagenetRTM_ProductVersion14.11.25325ProductVersionHigh720896ProductVersionLow1999110144MsiLoggingvoicewarmupManufacturerMicrosoft CorporationProductCode{B13B3E11-1555-353F-A63A-8933EE104FBD}ProductLanguageProductNameMicrosoft Visual C++ 2017 x64 Additional Runtime - 14.11.25325ProductVersion{9B0BAA88-" in Source: sample.bin, "Software\7-Zip" in Source: sample.bin, "E15F-3A1F-ACC0-B206E9DDF71C}DirectoryTable100_amd64DirectoryTableSecureCustomPropertiesIE501FOUND.3643236F_FC70_11D3_A536_0090278A1BB8;IGNOREDEPENDENCIES;INSTALLBLOCKFOUND.3643236F_FC70_11D3_A536_0090278A1BB8;JSHFOUNDVER;NEWERVCRUNTIMEVERSIONDETECTED;OCMFOUNDVER;OCMFOUNDVERLANG;REDISTFOUNDVER;REDISTFOUNDVERLANG;UNINSTALLBLOCKFOUND.3643236F_FC70_11D3_A536_0090278A1BB8;UPGRADEVCRUNTIMEWixPdbPathf:\ddSetup\SD\3\wix\outs\amd64ret\enu\cooked\vc_RuntimeAdditional_net.wixpdbreg53F6322BB82E39C10B8B09671402BCB9SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64Installed#1v14.11.25325.00reg0BD885172FDD3F2360BA97AD7C5EDA9CMajor#14reg9079944B509AC52ED7E4C365DCAC40E4Minor#11reg6CD8F4CAC824321F9376E5A42FF78528Bld#25325reg4C8C800EACC461242862DB302BECA5BDRbld#00regBF9D38C5DF54DE1066E00116CF6CB59DregF133E78A668EF156AFB700727896344Ereg780C60B396F24715F58510A458363ED5reg1FB46D02903309793538F7118D97D250reg5A2BD5D24B63D27F878F32707194C39DSOFTWARE\Microsoft\DevDiv\vc\Servicing\14.0SP#0reg89BF06DC838C21E6E04E72357ABEE837SPIndexSOF" in Source: sample.bin, "URTVersion]SOFTWARE\Microsoft\NET Framework Setup\NDP\[URTVersion]OCMSOFTWARE\Microsoft\NET Framework Setup\NDP\[URTVersion]\[ProductLanguage]UI_0UI_1UI_8UI_14UI_15UI_1607UI_1902UI_1903UI_5000UI_5001UI_5002UI_5003UI_5004UI_500514.0.0UPGRADEVCRUNTIMEdep52BBE0B31979271B1FA3BCF594BCFF58Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14" in Source: sample.bin, "TWARE\Microsoft\DevDiv\vc\Servicing\14.0\RuntimeAdditionalInstallreg5B2C908B3AC9457FFEE4E1ECD39B274AInstallerTypeMSIreg278A47E59BF6D5C44A63B53D4A941D13regEFA11F6345AF9CA4D57FF6704AC52593regCB1F4C018DA4C70E5FD71245390B875DSPNameRTMreg6E7415E2620C088B14BF095BC5155956[ProductVersion]regEF0A7649F87D4F93FE150A9564764C01UpdateVersionServicing_Key_ProductEdition_RegKey_7SOFTWARE\Microsoft\Updates\[ProductName]-regA1C4A64F0F95CB4566109088C94B3504reg52151294D41054739A1EF4AE7FCEF495regDBB7F4A70284BA9FCCDF7F47828B3593regA1674A2EB7E08608A2825A16530D89D4reg6DF4E7C52C018AF0C0558CE78329E8DCreg0A7ECFABDC41BEDF38AA31C24D54D43Creg4686D944B0F077245952D93896D439EEServicing_Key_ProductEdition_RegKey_17regCF8AAB7A42751D40CFD0BCC9E49F65E0Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14[ProductCode]reg2865E86F4BF45AD80935D279C884D826SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full\[ProductLanguage]SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\FullSOFTWARE\Microsoft\Visual JSharp Setup\Redist\[" in Source: sample.bin, "he registry declarations that follow, '*' is used as a wild card, and registry values (as opposed to keys) are * * enclosed in brackets. * * * ********************************************************************************************************************************** --> HKLM\SYSTEM\CurrentControlSet\Control\ScsiPort\* [*] HKLM\SYSTEM\CurrentControlSet\Control\StorPort\* [*] HKLM\SYSTEM\CurrentControlSet\Control\LiveDump\* [*] MigXmlHelper.DoesOSMatch("NT","5.2.*") MigXmlHelper.DoesStringContentEqual("Registry", "HKLM\SOFTWARE\Microsoft\MSMQ\Setup[msmq_RoutingSupport]", "0x00000001") visuaThis is example 64-bit setup file: mso_example\x64\ship\x-none\msoexamplea.txtvisuaMZx" in Source: sample.bin, "anel\Accessibility\Keyboard Response\* [*] HKCU\Control Panel\Accessibility\HighContrast\* [*] HKCU\Control Panel\Accessibility\SoundSentry\* [*] HKCU\Control Panel\Accessibility\ShowSounds\* [*] HKCU\Control Panel\Accessibility\Blind Access\* [*] HKCU\Control Panel\Accessibility\TimeOut\* [*] HKCU\Control Panel\Desktop [DragHeight] HKCU\Control Panel\Desktop [DragWidth] HKCU\Control Panel\Desktop [CaretWidth] HKCU\Control Panel\Desktop [CursorBlinkRate] HKCU\Co" in Source: sample.bin, "10EAC02] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [391F3325-0BA3-4083-A861-CF4F6F97A527] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [46B122C0-3767-4069-916E-3A43702F05CE] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [7BB02370-B8AE-4d29-88DE-76951D3245BA] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [58515BF3-2F59-4f37-B74F-85AEEC652AD6] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [84CA6FD6-B152-4e6a-8869-FDE5E37B6157] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [D7931411-0376-4869-A491-8D679BFC004A] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [36B58EA2-C461-4bb0-AC8E-952F59D251ED] HKLM\SYSTEM\CurrentControlSet\Services\CPK1 [*] HKLM\SYSTEM\CurrentControlSet\Control\MPDev\* [*] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\iSCSI\* [*] HKLM\SYSTEM\CurrentControlSet\Services\MSiSCSI [Start] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [7A2C6C2B-E5A5-49ad-AD68-133089ACD74D] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [C75258E9-BE79-4a48-A23D-EEB6F8FB940C] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [53EF8D5F-36F3-4124-8B76-C6AD521A1021] HKLM\SYSTEM\CurrentControlSet\Control" in Source: sample.bin, "ntrol Panel\Cursors\* [*] HKCU\Control Panel\Mouse [DoubleClickHeight] HKCU\Control Panel\Mouse [DoubleClickWidth] HKCU\Control Panel\Mouse [MouseSensitivity] HKCU\Control Panel\Mouse [MouseSpeed] HKCU\Control Panel\Mouse [SnapToDefaultButton] HKCU\Control Panel\Mouse [SwapMouseButtons] HKCU\Control Panel\Mouse [MouseThreshold1] HKCU\Control Panel\Mouse [MouseThreshold2] HKCU\Software\Microsoft\Narrator\* [*] HKCU\Software" in Source: sample.bin, "ser"> MigXmlHelper.IsOSEarlierThan("NT","6.0.0.0") HKCU\Control Panel\Accessibility [Sound on Activation] HKCU\Control Panel\Accessibility [Warning Sounds] HKCU\Control Panel\Accessibility\StickyKeys\* [*] HKCU\Control Panel\Accessibility\ToggleKeys\* [*] HKCU\Control Panel\Accessibility\MouseKeys\* [*] HKCU\Control Panel\Accessibility\Keyboard Preference\* [*] HKCU\Control P" in Source: sample.bin, "\WMI\Security [45755098-4291-43df-9720-B58642DD63DF] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [225B9D64-47A9-41c8-81CD-69BC02652D87] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [8EAEF9D8-C053-49d3-9205-65C703C2ECC1] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [556BC0B0-0FB5-40f2-9255-B7D9A669DAEC] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [B35694DE-D323-49d2-ABB2-8139209AD150] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [EA4D82BF-29DA-4e12-800A-E5437964462C] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [420512D9-0537-4c67-A779-84BA7B29CE9F] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [41646815-7524-4bc0-904A-CD7D5" in Source: sample.bin, "\Control\WMI\Security [E67E1BDB-D130-4143-9EB2-8BEE1899FD52] HKLM\SYSTEM\CurrentControlSet\Control\Tape\* [*] HKLM\SYSTEM\CurrentControlSet\Control\MChgr\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Ataport\* [*] HKLM\SYSTEM\CurrentControlSet\Control\Storage\* [*] visuaMZ" in Source: sample.bin, "ype="Registry">HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [B4D1C606-8682-4b7a-AC6B-D883D91555FB] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [4AE27CD9-8DFA-4c37-A42C-B88A93E3E521] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [C827993C-6D1F-4194-9B5C-D7C0A5F1CFB7] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [F022F413-3BF5-47ec-A942-33B81CF8E7FF] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [FA30C290-68DB-430a-AF76-91A2E1C49154] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [5C59FD61-E919-4687-84E2-7200ABE2209B] HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security [1221948A-6332-4ac2-AA04-268AABCECE4F] HKLM\SYSTEM\CurrentControlSet" in Source: sample.bin29:Tb22,"CREATE TABLE Configurations (Hash INTEGER PRIMARY KEY NOT NULL,Type INTEGER,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table configurations (hash integer primary key not null,type integer,refcount integer,binaryrepresentation blob)"), "CREATE TABLE Transitions (Hash INTEGER PRIMARY KEY NOT NULL,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table transitions (hash integer primary key not null,refcount integer,binaryrepresentation blob)"), "CREATE TABLE TelemetryEvents (Hash INTEGER PRIMARY KEY NOT NULL,Type INTEGER,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table telemetryevents (hash integer primary key not null,type integer,refcount integer,binaryrepresentation blob)"), "CREATE TABLE Triggers (Hash INTEGER PRIMARY KEY NOT NULL,Type INTEGER,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table triggers (hash integer primary key not null,type integer,refcount integer,binaryrepresentation blob)"), "CREATE TABLE ScenarioStateModels (Hash INTEGER PRIMARY KEY NOT NULL,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table scenariostatemodels (hash integer primary key not null,refcount integer,binaryrepresentation blob)"), "CREATE TABLE Actions (Hash INTEGER PRIMARY KEY NOT NULL,Type INTEGER,RefCount INTEGER,BinaryRepresentation BLOB)" (Source: sample.bin, Indicator: "create table actions (hash integer primary key not null,type integer,refcount integer,binaryrepresentation blob)")2a:Tb83,Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0", Pattern match: "http://ocsp.digicert.com0c", Pattern match: "www.digicert.com1$0", Pattern match: "http://ocsp.digicert.com0n", Heuristic match: "0vc_runtimeadditional.ms", Pattern match: "github.com/dotnet/runtime", Pattern match: "cacerts.digicert.com/digicertsha2assuredidcodesigningca.crt0", Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0", Pattern match: "http://www.w3.org/2001/xmlschema", Pattern match: "https://www.mozilla.com0", Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0", Heuristic match: " .net", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z", Pattern match: "http://ts-ocsp.ws.symantec.com07", Pattern match: "www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z", Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@", Pattern match: "http://microsoft.com0", Pattern match: "crl4.digicert.com/digicertassuredidrootca.crl0", Heuristic match: "om, or a problem with this package.there was an error creating a temporary file that is needed to complete this installation.{{ folder: [3]. system error code: [2]}}could not create key: [2]. {{ system error [3].}} verify that you have sufficient access ", Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t", Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0a", Pattern match: "https://www.digicert.com/cps0", Pattern match: "http://crl3.digicert.com/sha2-assured-cs-g1.crl05", Pattern match: "http://www.microsoft.com0", Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0", Pattern match: "http://crl.thawte.com/thawtetimestampingca.crl0", Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0", Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@", Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x", Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0", Pattern match: "www.digicert.com110/", Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0", Pattern match: "go.microsoft.com/fwlink/?linkid=133405arpnomodifyarpurlupdateinfohttp://go.microsoft.com/fwlink/?linkid=133408arpcommentscaution", Pattern match: "http://www.microsoft.com/windows0", Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0z", Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0", Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^", Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0o", Pattern match: "http://crl4.digicert.com/sha2-assured-cs-g1.crl0l", Pattern match: "http://ocsp.thawte.com0"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792879483710,"unified_at":"2026-10-24T22:04:43.710Z","metadata":{"hashes":{"sha256":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","sha1":"f62ded4f63c9a82683ab426268fa3590a8d374f0","md5":"7b9c622c70b9fb67b6b109150c4ec71e"},"file_info":{"file_name":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2409838,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792879465000,"last_seen":1792879466000,"last_multi_scan":1792879466000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":57,"suspicious_count":1,"malicious_count":2,"total":60},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.FileInfector","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Zusy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Lamer.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Zusy.314507","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Fwwy-6790745-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.NFD virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"VHO:Trojan.Convagent.gen.pjdq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Visua.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Virus ( 005da40b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Agent.tsR9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_reference_anti_VM_strings_targeting_VMWare","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/Zatoxp-Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Lamer.C.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Win32.VisuaT.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Capa_reference_anti_VM_strings_targeting_VMWare","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to stop windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve system time"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-62","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"z:\\build\\build\\src\\obj-firefox\\gfx\\angle\\targets\\libEGL\\libEGL.pdb\", \"Microsoft.Win32.Primitives.ni.pdb\", \"D:\\a\\_work\\1\\s\\artifacts\\obj\\Microsoft.Win32.Primitives\\net5.0-Windows_NT-Release\\Microsoft.Win32.Primitives.pdb\", \"E:\\delivery\\Dev\\wix37\\build\\ship\\x86\\WixDepCA.pdb\", \"api-ms-win-crt-math-l1-1-0.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"git://github.com/dotnet/runtime\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$29","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"file/memory contains long string with (Indicator: \"net start \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-521","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"file/memory contains long string with (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.mozilla.com0\", Found HTTPS url \"https://www.digicert.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumValueW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"?GetProcAddress@egl@@YAP6AXXZPEBD@Z\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"eglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-82","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"git://github.com/dotnet/runtime\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system time","description":"file/memory contains long string with (Indicator: \"w32tm \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-519","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDefaultLangID\" (Indicator: \"GetSystemDefaultLangID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"file/memory contains long string with (Indicator: \"net stop\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-522","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1686","id":"string-676","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:1045c00f2ce4814294d9621d44702a9f9ec675a80331dd73e262c6605d93944a":{"type":"File","value":"1045c00f2ce4814294d9621d44702a9f9ec675a80331dd73e262c6605d93944a","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]},"filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1094c8a0462af9eb0b236693bbe9dbbe0d89c894bec6b18d4e7eb6fecd1c49b5":{"type":"File","value":"1094c8a0462af9eb0b236693bbe9dbbe0d89c894bec6b18d4e7eb6fecd1c49b5","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839":{"type":"File","value":"11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","filetype":"PE32 executable for MS Windows 4.00 (GUI), Intel i386, 6 sections","filetype_short":"PE32"},"File:18962afd7820740ffd409b914a5986651acabfb26ccb56270484fc92070d961b":{"type":"File","value":"18962afd7820740ffd409b914a5986651acabfb26ccb56270484fc92070d961b","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:28854abb944571672a586aa24075a2cb5ff1ad62458a75d7062468c4bceb4c16":{"type":"File","value":"28854abb944571672a586aa24075a2cb5ff1ad62458a75d7062468c4bceb4c16","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:28e2c7d4c50586e3f2f30b87f48d68f1a22d9451e47772493adf12c7c0bbacf8":{"type":"File","value":"28e2c7d4c50586e3f2f30b87f48d68f1a22d9451e47772493adf12c7c0bbacf8","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:2e2afc1921504b5ea756d3f67f96716567c040985b20a65e4509f212f4325366":{"type":"File","value":"2e2afc1921504b5ea756d3f67f96716567c040985b20a65e4509f212f4325366","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:33f8e668cfa3d1f180491b7e64dd001866621a4df5ebe00e7c8db752d4d71683":{"type":"File","value":"33f8e668cfa3d1f180491b7e64dd001866621a4df5ebe00e7c8db752d4d71683","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:48e86652d72eda8f9abd6ff9b5934f18be37280b5928e58878ca65d89d12ecce":{"type":"File","value":"48e86652d72eda8f9abd6ff9b5934f18be37280b5928e58878ca65d89d12ecce","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:4e0b364bd16447abb136a54219bb8f25c140fbd2bd1596282951e311cd3bf5ef":{"type":"File","value":"4e0b364bd16447abb136a54219bb8f25c140fbd2bd1596282951e311cd3bf5ef","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:5b905c98d8444b71ea6ecba79c71e78d3edde4281185b273b5c7edd17435d516":{"type":"File","value":"5b905c98d8444b71ea6ecba79c71e78d3edde4281185b273b5c7edd17435d516","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:6833963f22ad99e77141a1be5638ca55df45b18c5d4758506dd36a686df2f061":{"type":"File","value":"6833963f22ad99e77141a1be5638ca55df45b18c5d4758506dd36a686df2f061","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:68e875becdc321d1db99c039b806ac004479f5d113fa567af4d150cd80b37e1b":{"type":"File","value":"68e875becdc321d1db99c039b806ac004479f5d113fa567af4d150cd80b37e1b","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:6f5959774a01e54d83a93aadaaa939c1bb274af6c11ede39ba471ba0020b2b62":{"type":"File","value":"6f5959774a01e54d83a93aadaaa939c1bb274af6c11ede39ba471ba0020b2b62","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:7790eb65a6614f131daaea2873905751ed0eb3508e93b309586a1144398216bc":{"type":"File","value":"7790eb65a6614f131daaea2873905751ed0eb3508e93b309586a1144398216bc","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:79a10413661ddb2bc3b8b319a34e5d05cfe378dff00c429bdfbc675ae848de9c":{"type":"File","value":"79a10413661ddb2bc3b8b319a34e5d05cfe378dff00c429bdfbc675ae848de9c","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:7af6cd511cc1b88e6e7fafc0f00abd1012e5265719665ea94db156240e236292":{"type":"File","value":"7af6cd511cc1b88e6e7fafc0f00abd1012e5265719665ea94db156240e236292","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:9b7e04dc0856529d35028802cdcb47580485eb655ad7f84f282840898d40e03e":{"type":"File","value":"9b7e04dc0856529d35028802cdcb47580485eb655ad7f84f282840898d40e03e","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:c22fc03490a5a20ce016aaf18bb91a78c709600a9b353c10d9cd1ce1104c35a8":{"type":"File","value":"c22fc03490a5a20ce016aaf18bb91a78c709600a9b353c10d9cd1ce1104c35a8","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:ce3b6ee720f0ed26edf9ed881a99ba84007f8731d2a96cd55ffc9931e651d582":{"type":"File","value":"ce3b6ee720f0ed26edf9ed881a99ba84007f8731d2a96cd55ffc9931e651d582","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:d0049ccc11f01f1d231c583d49c1ef9caa464f7ecd4ed38a1c0a1ba394129472":{"type":"File","value":"d0049ccc11f01f1d231c583d49c1ef9caa464f7ecd4ed38a1c0a1ba394129472","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:d4e96a3bbbb4648b34db8e42f37c23f0153cb340edf47aa7aa1afcfa98d0c002":{"type":"File","value":"d4e96a3bbbb4648b34db8e42f37c23f0153cb340edf47aa7aa1afcfa98d0c002","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"},"File:decb546fbfca3e505fc4c96ebe9c43e7050d70037bdccbbb582e33eb17914401":{"type":"File","value":"decb546fbfca3e505fc4c96ebe9c43e7050d70037bdccbbb582e33eb17914401","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:e27f347971404cad00d4e6ea14feaa92eaa734769a3b8f72b1c166682de0bd03":{"type":"File","value":"e27f347971404cad00d4e6ea14feaa92eaa734769a3b8f72b1c166682de0bd03","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-coff"},"File:e6ec4086ba20503e296c42133d8a0bea685cd59fd34090fdaa11164578023829":{"type":"File","value":"e6ec4086ba20503e296c42133d8a0bea685cd59fd34090fdaa11164578023829","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:e89a6fd9fb790562edc84e26e99bc0998e1df751955dc21e74a7e630b35e25cc":{"type":"File","value":"e89a6fd9fb790562edc84e26e99bc0998e1df751955dc21e74a7e630b35e25cc","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/plain"},"File:eb4f8c06da8e9f2aefe7ee0159e1cfaf68f70c0a0c9efea74b7b3998e3140a2d":{"type":"File","value":"eb4f8c06da8e9f2aefe7ee0159e1cfaf68f70c0a0c9efea74b7b3998e3140a2d","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/x-java-applet"},"File:f8c43fcc68d0802f71bd16ec10d61092278f116694262a57d3f1b9a9b61c7fa2":{"type":"File","value":"f8c43fcc68d0802f71bd16ec10d61092278f116694262a57d3f1b9a9b61c7fa2","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/vnd.tcpdump.pcap"},"File:fb1c06c08804b13f84a2a10ca400af17845709d3ca2c26d7afa870624cb212ab":{"type":"File","value":"fb1c06c08804b13f84a2a10ca400af17845709d3ca2c26d7afa870624cb212ab","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"text/x-ms-regedit"},"File:fb7e73e44ede8e6859400ef89defc4c33f02045981cca22445bb026b6a25d508":{"type":"File","value":"fb7e73e44ede8e6859400ef89defc4c33f02045981cca22445bb026b6a25d508","filetype":"MIPSEB Ucode","mime_type":"application/octet-stream"},"File:fe863eb4d281c2931990531558af3029ed021a77e2193f9d227429ab8964ffd3":{"type":"File","value":"fe863eb4d281c2931990531558af3029ed021a77e2193f9d227429ab8964ffd3","filetype":"ASCII text, with very long lines (32074), with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/csv"},"File:ff1c1d21a4451d83dbee8a946fcc92ecb7b13fe41db33a9ada21b808b29870c8":{"type":"File","value":"ff1c1d21a4451d83dbee8a946fcc92ecb7b13fe41db33a9ada21b808b29870c8","filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"application/octet-stream"}},"chains":[{"id":"1563674620436914172","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:1045c00f2ce4814294d9621d44702a9f9ec675a80331dd73e262c6605d93944a"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File has very high prevalence"]}},{"id":"1563674611958040914","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:1094c8a0462af9eb0b236693bbe9dbbe0d89c894bec6b18d4e7eb6fecd1c49b5"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235235","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:18962afd7820740ffd409b914a5986651acabfb26ccb56270484fc92070d961b"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040910","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:28854abb944571672a586aa24075a2cb5ff1ad62458a75d7062468c4bceb4c16"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040907","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:28e2c7d4c50586e3f2f30b87f48d68f1a22d9451e47772493adf12c7c0bbacf8"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235223","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:2e2afc1921504b5ea756d3f67f96716567c040985b20a65e4509f212f4325366"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235221","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:33f8e668cfa3d1f180491b7e64dd001866621a4df5ebe00e7c8db752d4d71683"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040903","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:48e86652d72eda8f9abd6ff9b5934f18be37280b5928e58878ca65d89d12ecce"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235225","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:4e0b364bd16447abb136a54219bb8f25c140fbd2bd1596282951e311cd3bf5ef"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040905","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:5b905c98d8444b71ea6ecba79c71e78d3edde4281185b273b5c7edd17435d516"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235222","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:6833963f22ad99e77141a1be5638ca55df45b18c5d4758506dd36a686df2f061"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235234","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:68e875becdc321d1db99c039b806ac004479f5d113fa567af4d150cd80b37e1b"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235228","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:6f5959774a01e54d83a93aadaaa939c1bb274af6c11ede39ba471ba0020b2b62"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040906","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:7790eb65a6614f131daaea2873905751ed0eb3508e93b309586a1144398216bc"}],"verdict":{"verdict":"unknown"}},{"id":"1563674615379761345","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:79a10413661ddb2bc3b8b319a34e5d05cfe378dff00c429bdfbc675ae848de9c"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","File found in known legitimate files database"]}},{"id":"1563674611962235226","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:7af6cd511cc1b88e6e7fafc0f00abd1012e5265719665ea94db156240e236292"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235227","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:9b7e04dc0856529d35028802cdcb47580485eb655ad7f84f282840898d40e03e"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235230","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:c22fc03490a5a20ce016aaf18bb91a78c709600a9b353c10d9cd1ce1104c35a8"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040912","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:ce3b6ee720f0ed26edf9ed881a99ba84007f8731d2a96cd55ffc9931e651d582"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040915","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:d0049ccc11f01f1d231c583d49c1ef9caa464f7ecd4ed38a1c0a1ba394129472"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040909","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:d4e96a3bbbb4648b34db8e42f37c23f0153cb340edf47aa7aa1afcfa98d0c002"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235224","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:decb546fbfca3e505fc4c96ebe9c43e7050d70037bdccbbb582e33eb17914401"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040902","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e27f347971404cad00d4e6ea14feaa92eaa734769a3b8f72b1c166682de0bd03"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235231","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e6ec4086ba20503e296c42133d8a0bea685cd59fd34090fdaa11164578023829"}],"verdict":{"verdict":"unknown"}},{"id":"1563674612088064357","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e89a6fd9fb790562edc84e26e99bc0998e1df751955dc21e74a7e630b35e25cc"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["Very short text file without any suspicious content"]}},{"id":"1563674611958040904","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:eb4f8c06da8e9f2aefe7ee0159e1cfaf68f70c0a0c9efea74b7b3998e3140a2d"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040911","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:f8c43fcc68d0802f71bd16ec10d61092278f116694262a57d3f1b9a9b61c7fa2"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611958040916","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fb1c06c08804b13f84a2a10ca400af17845709d3ca2c26d7afa870624cb212ab"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235233","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fb7e73e44ede8e6859400ef89defc4c33f02045981cca22445bb026b6a25d508"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235229","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fe863eb4d281c2931990531558af3029ed021a77e2193f9d227429ab8964ffd3"}],"verdict":{"verdict":"unknown"}},{"id":"1563674611962235232","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:ff1c1d21a4451d83dbee8a946fcc92ecb7b13fe41db33a9ada21b808b29870c8"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","edges":[{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:2e2afc1921504b5ea756d3f67f96716567c040985b20a65e4509f212f4325366"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:68e875becdc321d1db99c039b806ac004479f5d113fa567af4d150cd80b37e1b"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:79a10413661ddb2bc3b8b319a34e5d05cfe378dff00c429bdfbc675ae848de9c"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:1094c8a0462af9eb0b236693bbe9dbbe0d89c894bec6b18d4e7eb6fecd1c49b5"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:d0049ccc11f01f1d231c583d49c1ef9caa464f7ecd4ed38a1c0a1ba394129472"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:7790eb65a6614f131daaea2873905751ed0eb3508e93b309586a1144398216bc"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:1045c00f2ce4814294d9621d44702a9f9ec675a80331dd73e262c6605d93944a"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:c22fc03490a5a20ce016aaf18bb91a78c709600a9b353c10d9cd1ce1104c35a8"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:6833963f22ad99e77141a1be5638ca55df45b18c5d4758506dd36a686df2f061"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e89a6fd9fb790562edc84e26e99bc0998e1df751955dc21e74a7e630b35e25cc"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:ff1c1d21a4451d83dbee8a946fcc92ecb7b13fe41db33a9ada21b808b29870c8"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:7af6cd511cc1b88e6e7fafc0f00abd1012e5265719665ea94db156240e236292"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:6f5959774a01e54d83a93aadaaa939c1bb274af6c11ede39ba471ba0020b2b62"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fb7e73e44ede8e6859400ef89defc4c33f02045981cca22445bb026b6a25d508"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:4e0b364bd16447abb136a54219bb8f25c140fbd2bd1596282951e311cd3bf5ef"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fe863eb4d281c2931990531558af3029ed021a77e2193f9d227429ab8964ffd3"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e27f347971404cad00d4e6ea14feaa92eaa734769a3b8f72b1c166682de0bd03"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:28e2c7d4c50586e3f2f30b87f48d68f1a22d9451e47772493adf12c7c0bbacf8"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:ce3b6ee720f0ed26edf9ed881a99ba84007f8731d2a96cd55ffc9931e651d582"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:33f8e668cfa3d1f180491b7e64dd001866621a4df5ebe00e7c8db752d4d71683"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:d4e96a3bbbb4648b34db8e42f37c23f0153cb340edf47aa7aa1afcfa98d0c002"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:e6ec4086ba20503e296c42133d8a0bea685cd59fd34090fdaa11164578023829"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:decb546fbfca3e505fc4c96ebe9c43e7050d70037bdccbbb582e33eb17914401"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:fb1c06c08804b13f84a2a10ca400af17845709d3ca2c26d7afa870624cb212ab"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:9b7e04dc0856529d35028802cdcb47580485eb655ad7f84f282840898d40e03e"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:28854abb944571672a586aa24075a2cb5ff1ad62458a75d7062468c4bceb4c16"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:f8c43fcc68d0802f71bd16ec10d61092278f116694262a57d3f1b9a9b61c7fa2"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:5b905c98d8444b71ea6ecba79c71e78d3edde4281185b273b5c7edd17435d516"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:eb4f8c06da8e9f2aefe7ee0159e1cfaf68f70c0a0c9efea74b7b3998e3140a2d"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:18962afd7820740ffd409b914a5986651acabfb26ccb56270484fc92070d961b"},{"edge_kind":"extracted","from_key":"File:11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839","to_key":"File:48e86652d72eda8f9abd6ff9b5934f18be37280b5928e58878ca65d89d12ecce"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":31,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"!AdminUISequence","sha256":"2e2afc1921504b5ea756d3f67f96716567c040985b20a65e4509f212f4325366","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Component","sha256":"68e875becdc321d1db99c039b806ac004479f5d113fa567af4d150cd80b37e1b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Error","sha256":"79a10413661ddb2bc3b8b319a34e5d05cfe378dff00c429bdfbc675ae848de9c","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!WixDependencyProvider","sha256":"1094c8a0462af9eb0b236693bbe9dbbe0d89c894bec6b18d4e7eb6fecd1c49b5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!FeatureComponents","sha256":"d0049ccc11f01f1d231c583d49c1ef9caa464f7ecd4ed38a1c0a1ba394129472","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!AppSearch","sha256":"7790eb65a6614f131daaea2873905751ed0eb3508e93b309586a1144398216bc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Binary.WixDepCA","sha256":"1045c00f2ce4814294d9621d44702a9f9ec675a80331dd73e262c6605d93944a","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!InstallUISequence","sha256":"c22fc03490a5a20ce016aaf18bb91a78c709600a9b353c10d9cd1ce1104c35a8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Directory","sha256":"6833963f22ad99e77141a1be5638ca55df45b18c5d4758506dd36a686df2f061","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!LaunchCondition","sha256":"e89a6fd9fb790562edc84e26e99bc0998e1df751955dc21e74a7e630b35e25cc","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!AdminExecuteSequence","sha256":"ff1c1d21a4451d83dbee8a946fcc92ecb7b13fe41db33a9ada21b808b29870c8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[5]SummaryInformation","sha256":"7af6cd511cc1b88e6e7fafc0f00abd1012e5265719665ea94db156240e236292","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!_Tables","sha256":"6f5959774a01e54d83a93aadaaa939c1bb274af6c11ede39ba471ba0020b2b62","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Media","sha256":"fb7e73e44ede8e6859400ef89defc4c33f02045981cca22445bb026b6a25d508","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!InstallExecuteSequence","sha256":"4e0b364bd16447abb136a54219bb8f25c140fbd2bd1596282951e311cd3bf5ef","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!_StringData","sha256":"fe863eb4d281c2931990531558af3029ed021a77e2193f9d227429ab8964ffd3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Upgrade","sha256":"e27f347971404cad00d4e6ea14feaa92eaa734769a3b8f72b1c166682de0bd03","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!_Columns","sha256":"28e2c7d4c50586e3f2f30b87f48d68f1a22d9451e47772493adf12c7c0bbacf8","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Binary","sha256":"ce3b6ee720f0ed26edf9ed881a99ba84007f8731d2a96cd55ffc9931e651d582","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Property","sha256":"33f8e668cfa3d1f180491b7e64dd001866621a4df5ebe00e7c8db752d4d71683","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!UIText","sha256":"d4e96a3bbbb4648b34db8e42f37c23f0153cb340edf47aa7aa1afcfa98d0c002","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[5]DigitalSignature","sha256":"e6ec4086ba20503e296c42133d8a0bea685cd59fd34090fdaa11164578023829","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!RegLocator","sha256":"decb546fbfca3e505fc4c96ebe9c43e7050d70037bdccbbb582e33eb17914401","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!_StringPool","sha256":"fb1c06c08804b13f84a2a10ca400af17845709d3ca2c26d7afa870624cb212ab","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"[5]MsiDigitalSignatureEx","sha256":"9b7e04dc0856529d35028802cdcb47580485eb655ad7f84f282840898d40e03e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Registry","sha256":"28854abb944571672a586aa24075a2cb5ff1ad62458a75d7062468c4bceb4c16","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!Feature","sha256":"f8c43fcc68d0802f71bd16ec10d61092278f116694262a57d3f1b9a9b61c7fa2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!CustomAction","sha256":"5b905c98d8444b71ea6ecba79c71e78d3edde4281185b273b5c7edd17435d516","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!File","sha256":"eb4f8c06da8e9f2aefe7ee0159e1cfaf68f70c0a0c9efea74b7b3998e3140a2d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!AdvtExecuteSequence","sha256":"18962afd7820740ffd409b914a5986651acabfb26ccb56270484fc92070d961b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"!_Validation","sha256":"48e86652d72eda8f9abd6ff9b5934f18be37280b5928e58878ca65d89d12ecce","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 11f8431bb022… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 11f8431bb022…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 11f8431bb022… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 11f8431bb022…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/11f8431bb022d3b7a655d8c80105e8e9423eaedac918d3e62588262d1aeca839"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 11f8431bb022… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 11f8431bb022…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]