34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3b:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T41d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 2c7628a0871f… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 2c7628a0871f…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","keywords":["malware analysis","sandbox report","threat intelligence","2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d"],"about":{"@type":"SoftwareApplication","name":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","applicationCategory":["peexe","64bits","executable"],"identifier":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Td49,Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQuerySessionInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "WTSRegisterSessionNotification"; Source: "sample.bin"), Found reference to API (Indicator: "LsaQueryInformationPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API (Indicator: "LsaFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "LsaClose"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaOpenPolicy"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "AnimateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "WTSFreeMemory"; Source: "sample.bin"), Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API (Indicator: "WakeConditionVariable"; Source: "sample.bin"), Found reference to API (Indicator: "LsaStorePrivateData"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "LsaRetrievePrivateData"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPreferredUILanguages"; Source: "sample.bin"), Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; Source: "sample.bin")37:T610,"Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\NoticeSet\StnDevSet" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet" in Source: sample.bin, "\SYSTEM\CurrentControlSet\Control\Keyboard Layouts\" in Source: sample.bin, "Software\Borland\Locales" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\FdlRevision" in Source: sample.bin, "Software\Embarcadero\Locales" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\SessionSet\" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\PowerSet" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\LanScopeAnClient" in Source: sample.bin, "Software\Borland\Delphi\Locales" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\AdvSet" in Source: sample.bin, "System\CurrentControlSet\Control\Keyboard Layouts\%.8x" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\SessionSet" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\NoticeSet" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: sample.bin, "Software\MOTEX\LanScope Client\CurrentVersion\OperationSet\StnAlzLogSet" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes" in Source: sample.bin, "Software\CodeGear\Locales" in Source: sample.bin38:T7c3,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "(BCryptGenRandom)" (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found api reference "(BCryptGenRandom)" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found api reference "[TAESGCM.Initialize] Failed to BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "Failed to BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "sample.bin"), Found api reference "Failed to BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "sample.bin"), Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found api reference "[TAESGCM.Initialize] Failed to BCryptSetProperty ChainingModeGCM" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found api reference "[TAESGCM.Initialize] Failed to BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin")39:T427,Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API "[TAESGCM.Initialize] Failed to BCryptSetProperty ChainingModeGCM" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API "[TAESGCM.Initialize] Failed to BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "sample.bin")3a:T468,Found reference to API "[TWTSSession.Create],Error,GetProcAddress('WTSFreeMemory')" (Indicator: "WTSFreeMemory"; Source: "sample.bin"), Found reference to API "[TWTSSession.Create],Error,GetProcAddress('WTSUnRegisterSessionNotification')" (Indicator: "WTSUnRegisterSessionNotification"; Source: "sample.bin"), Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "sample.bin"), Found reference to API "[TWTSSession.Create],Error,GetProcAddress('WTSRegisterSessionNotification')" (Indicator: "WTSRegisterSessionNotification"; Source: "sample.bin"), Found reference to API "[TWTSSession.Start],Error,WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "sample.bin"), Found reference to API "[TWTSSession.Stop],Error,WTSUnRegisterSessionNotification" (Indicator: "WTSUnRegisterSessionNotification"; Source: "sample.bin"), Found reference to API "WTSFreeMemory" (Indicator: "WTSFreeMemory"; Source: "sample.bin"), Found reference to API "WTSUnRegisterSessionNotification" (Indicator: "WTSUnRegisterSessionNotification"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793920421856,"unified_at":"2026-11-05T23:13:41.856Z","metadata":{"hashes":{"sha256":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","sha1":"073fc4bad8fc1fe744b2d9d1957d431ffda992b2","md5":"87f0b494b1c31ea36a333a9b25313e1a","imphash":"c1ff22a128f043f3faa623c2b2d67fe1","pehash":"2100853d282ec081ccc7502f8b5b1ba556cc4e65"},"file_info":{"file_name":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":4001840,"entropy":5.92,"compile_timestamp":"2026-10-29T05:29:25","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793920388000,"last_seen":1793920388000,"last_multi_scan":1793920388000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":11,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":3271912,"raw_size":3272192},{"name":".data","virtual_address":"0x320000","virtual_size":300488,"raw_size":300544},{"name":".bss","virtual_address":"0x36a000","virtual_size":47772},{"name":".idata","virtual_address":"0x376000","virtual_size":20440,"raw_size":20480},{"name":".didata","virtual_address":"0x37b000","virtual_size":3584,"raw_size":3584},{"name":".edata","virtual_address":"0x37c000","virtual_size":156,"raw_size":512},{"name":".tls","virtual_address":"0x37d000","virtual_size":628},{"name":".rdata","virtual_address":"0x37e000","virtual_size":109,"raw_size":512},{"name":".reloc","virtual_address":"0x37f000","virtual_size":166164,"raw_size":166400},{"name":".pdata","virtual_address":"0x3a8000","virtual_size":191364,"raw_size":191488},{"name":".rsrc","virtual_address":"0x3d7000","virtual_size":33280,"raw_size":33280}],"section_names":[".text",".data",".bss",".idata",".didata",".edata",".tls",".rdata",".reloc",".pdata",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":20},"sandbox_signatures":{"informative_count":31,"suspicious_count":1,"malicious_count":0,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$37","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$38","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"[TAESGCM.Initialize] Failed to BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"[TAESGCM.Initialize] Failed to BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$39","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\"), Found reference to API \"[TAESGCM.Initialize] Failed to BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptSetProperty\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\"), Found reference to API \"[TAESGCM.Initialize] Failed to BCryptSetProperty ChainingModeGCM\" (Indicator: \"BCryptSetProperty\"; Source: \"sample.bin\"), Found reference to API \"[TAESGCM.Initialize] Failed to BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"[TAESGCM.Decrypt] \" (Indicator: \".decrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.OnWTSSessionChange],Error,WTSQuerySessionInformation\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSQuerySessionInformation')\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSFreeMemory')\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSUnRegisterSessionNotification')\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSRegisterSessionNotification')\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSQuerySessionInformation')\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"[TAESGCM.Initialize] The length of Secrets is not CRYPTO_SYM_KEY_BYTES\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Initialize] Failed to BCryptOpenAlgorithmProvider\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.GenRandom] \" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Encrypt] \" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Encrypt] \" (Indicator: \".encrypt\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Decrypt] \" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Decrypt] \" (Indicator: \".decrypt\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Initialize] Failed to BCryptSetProperty ChainingModeGCM\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"[TAESGCM.Initialize] Failed to BCryptGenerateSymmetricKey\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\LanScopeAnClient\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.OnWTSSessionChange],Error,WTSQuerySessionInformation\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSQuerySessionInformation')\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-546","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"$3a","origin":"sample.bin","mitre_attack_id":"T1021.001","id":"string-436","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSFreeMemory')\" (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\"), Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"WTSRegisterSessionNotification\" in \"sample.bin\", Found system information discovery API: \"[TWTSSession.Create],Error,GetProcAddress('WTSRegisterSessionNotification')\" in \"sample.bin\", Found system information discovery API: \"[TWTSSession.Start],Error,WTSRegisterSessionNotification\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\LanScopeAnClient\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"[TWTSSession.Create],Error,GetProcAddress('WTSFreeMemory')\" (Indicator: \"FreeMemory\"; Source: \"sample.bin\"), Found reference to API \"LsaFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"sample.bin\"), Found reference to API \"WTSFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"[TWTSSession.Create],Error,LoadLibrary('wtsapi32.dll')\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"[TWTSSession.Destroy],Error,FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"7.2.1.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"[TSecuritySharedMemorySet.SetLowILForVista],GetSecurityDescriptorSacl,Error,\" (Indicator: \"GetSecurityDescriptorSacl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"[TWTSSession.Create],Error,LoadLibrary('wtsapi32.dll')\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"wwahost.exe\" (Indicator: \"wwahost.exe\")","origin":"sample.bin","id":"string-65","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d":{"type":"File","value":"2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 11 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628":{"type":"File","value":"3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"}},"chains":[{"id":"1568040515483542096","root":"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}},{"id":"1568040575965644788","root":"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","to_key":"File:3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","edges":[{"edge_kind":"extracted","from_key":"File:2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d","to_key":"File:3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628","sha256":"3475f08d02d06269fa98bd907fc1ed0fbe1a0bf22111de981cbd7c9ae8ca9628","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 2c7628a0871f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 2c7628a0871f…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d"}],["$","meta","4",{"property":"og:title","content":"Sample 2c7628a0871f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 2c7628a0871f…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2c7628a0871f08f7df09f0a5c333bcc3b905c3ecbe41963cd7fe06dd314e4e8d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 2c7628a0871f… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 2c7628a0871f…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3b","11",{}]] 32:null