33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 37:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T3f2c,"SELECT ae._ApplicationExtensionID, ae._Revision, ae._WorkId, ae.Application, ae."Index", ae.Category, ae.Executable, ae.Entrypoint, ae.RuntimeType, ae.StartPage, ae.ResourceGroup, ae.Flags, ae.Subsystem, ae._LocalizedDictionary, ae._Dictionary FROM ApplicationExtension AS ae INNER JOIN Application AS a ON a._ApplicationID=ae.Application INNER JOIN Package AS p ON p._PackageID=a.Package INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID WHERE ae.Category=?2 AND pu.User=?1 AND a.ApplicationUserModelId=?3 AND ae._WorkId=0 AND a._WorkId=0 AND p._WorkId=0 AND pu._WorkId=0;" (Source: sample.bin, Indicator: "select ae._applicationextensionid, ae._revision, ae._workid, ae.application, ae."index", ae.category, ae.executable, ae.entrypoint, ae.runtimetype, ae.startpage, ae.resourcegroup, ae.flags, ae.subsystem, ae._localizeddictionary, ae._dictionary from applicationextension as ae inner join application as a on a._applicationid=ae.application inner join package as p on p._packageid=a.package inner join packageuser as pu on pu.package=p._packageid where ae.category=?2 and pu.user=?1 and a.applicationusermodelid=?3 and ae._workid=0 and a._workid=0 and p._workid=0 and pu._workid=0;"), "SELECT _PackagePolicyID, _Revision, _WorkId, User, Package, Name, "Index", ValueString, ValueNumber, _Dictionary FROM PackagePolicy WHERE Package=? AND Name=? AND "Index"=? AND _WorkId=0;" (Source: sample.bin, Indicator: "select _packagepolicyid, _revision, _workid, user, package, name, "index", valuestring, valuenumber, _dictionary from packagepolicy where package=? and name=? and "index"=? and _workid=0;"), "SELECT _PackageUserID, _Revision, _WorkId, _ShadowId, _IsMarkedForDeletion, _Created, _Modified, Package, User, PackageIdentity, InstallTime, OSVersionWhenInstalled, WhenRestored, IsExplicitlyInstalled, DeploymentState, PackageStatus, AppDataVolume, _Dictionary FROM PackageUser WHERE User=? AND _WorkId=0;" (Source: sample.bin, Indicator: "select _packageuserid, _revision, _workid, _shadowid, _ismarkedfordeletion, _created, _modified, package, user, packageidentity, installtime, osversionwheninstalled, whenrestored, isexplicitlyinstalled, deploymentstate, packagestatus, appdatavolume, _dictionary from packageuser where user=? and _workid=0;"), "SELECT EXISTS(SELECT 1 FROM Application AS a INNER JOIN PackageFamily AS pf ON pf._PackageFamilyID=p.PackageFamily INNER JOIN Package AS p ON p._PackageID=a.Package INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID WHERE pf.PackageFamilyName=?2 AND pu.User=?1 AND a._WorkId=0 AND p._WorkId=0 AND pu._WorkId=0 LIMIT 1);" (Source: sample.bin, Indicator: "select exists(select 1 from application as a inner join packagefamily as pf on pf._packagefamilyid=p.packagefamily inner join package as p on p._packageid=a.package inner join packageuser as pu on pu.package=p._packageid where pf.packagefamilyname=?2 and pu.user=?1 and a._workid=0 and p._workid=0 and pu._workid=0 limit 1);"), "SELECT a._ApplicationID, a._Revision, a._WorkId, a.Package, a."Index", a.ApplicationType, a.Flags, a.Subsystem, a.PackageRelativeApplicationId, a.ApplicationUserModelId, a.DisplayName, a.Description, a.Square150x150Logo, a.Square44x44Logo, a.Wide310x150Logo, a.Square310x310Logo, a.Square71x71Logo, a.ForegroundText, a.BackgroundColor, a.Executable, a.Entrypoint, a.StartPage, a.ResourceGroup, a.LockScreenNotification, a.LockScreenBadgeLogo, a.SplashScreenImage, a.SplashScreenBackgroundColor, a.InitialRotationPreference, a.ApplicationViewMinWidth, a.AppListEntry, a.EditionId, a.VisualGroup, a._Dictionary FROM Application AS a INNER JOIN Package AS p ON p._PackageID=a.Package INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID WHERE a.ApplicationUserModelId=?2 AND pu.User=?1 AND (a._WorkId=0 OR a._WorkId=?3) AND (p._WorkId=0 OR p._WorkId=?3) AND (pu._WorkId=0 OR pu._WorkId=?3);" (Source: sample.bin, Indicator: "select a._applicationid, a._revision, a._workid, a.package, a."index", a.applicationtype, a.flags, a.subsystem, a.packagerelativeapplicationid, a.applicationusermodelid, a.displayname, a.description, a.square150x150logo, a.square44x44logo, a.wide310x150logo, a.square310x310logo, a.square71x71logo, a.foregroundtext, a.backgroundcolor, a.executable, a.entrypoint, a.startpage, a.resourcegroup, a.lockscreennotification, a.lockscreenbadgelogo, a.splashscreenimage, a.splashscreenbackgroundcolor, a.initialrotationpreference, a.applicationviewminwidth, a.applistentry, a.editionid, a.visualgroup, a._dictionary from application as a inner join package as p on p._packageid=a.package inner join packageuser as pu on pu.package=p._packageid where a.applicationusermodelid=?2 and pu.user=?1 and (a._workid=0 or a._workid=?3) and (p._workid=0 or p._workid=?3) and (pu._workid=0 or pu._workid=?3);"), "SELECT _SRJournalID, _Revision, _WorkId, ObjectType, "Action", ObjectId, Flags, User, PackageFamily, PackageIdentity, ApplicationIdentity, WhenOccurred, SequenceId, _Dictionary FROM SRJournal WHERE ((ObjectType<>2) OR (ObjectType=2 AND User NOT IN (SELECT _UserID FROM User WHERE UserSid=X'010100000000000512000000'))) AND (_WorkId=0 OR _WorkId=?) ORDER BY SequenceId;" (Source: sample.bin, Indicator: "select _srjournalid, _revision, _workid, objecttype, "action", objectid, flags, user, packagefamily, packageidentity, applicationidentity, whenoccurred, sequenceid, _dictionary from srjournal where ((objecttype<>2) or (objecttype=2 and user not in (select _userid from user where usersid=x'010100000000000512000000'))) and (_workid=0 or _workid=?) order by sequenceid;"), "SELECT _PackageUserID, _Revision, _WorkId, _ShadowId, _IsMarkedForDeletion, _Created, _Modified, Package, User, PackageIdentity, InstallTime, OSVersionWhenInstalled, WhenRestored, IsExplicitlyInstalled, DeploymentState, PackageStatus, AppDataVolume, _Dictionary FROM PackageUser WHERE User=? AND (_WorkId=0 OR _WorkId=?);" (Source: sample.bin, Indicator: "select _packageuserid, _revision, _workid, _shadowid, _ismarkedfordeletion, _created, _modified, package, user, packageidentity, installtime, osversionwheninstalled, whenrestored, isexplicitlyinstalled, deploymentstate, packagestatus, appdatavolume, _dictionary from packageuser where user=? and (_workid=0 or _workid=?);"), "SELECT _CachePackageFamilyID, PackageFamilyName FROM CachePackageFamily;" (Source: sample.bin, Indicator: "select _cachepackagefamilyid, packagefamilyname from cachepackagefamily;"), "SELECT aea._AppExecutionAliasID, aea._Revision, aea._WorkId, aea.Alias, aea.Extension, aea._Dictionary FROM AppExecutionAlias AS aea INNER JOIN ApplicationExtension AS ae ON ae._ApplicationExtensionID=aea.Extension INNER JOIN Application AS a ON a._ApplicationID=ae.Application INNER JOIN Package AS p ON p._PackageID=a.Package INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID LEFT JOIN ApplicationIdentity AS ai ON ai.ApplicationUserModelId=a.ApplicationUserModelId LEFT JOIN AppExecutionAliasUser AS aeau ON aeau.ApplicationIdentity=ai._ApplicationIdentityID WHERE aea.Alias=?2 AND pu.User=?1 AND IFNULL(aeau.Status, 0)<>2 AND aea._WorkId=0 AND ae._WorkId=0 AND a._WorkId=0 AND p._WorkId=0 AND pu._WorkId=0 ORDER BY IFNULL(aeau.Status, 0), pu.InstallTime;" (Source: sample.bin, Indicator: "select aea._appexecutionaliasid, aea._revision, aea._workid, aea.alias, aea.extension, aea._dictionary from appexecutionalias as aea inner join applicationextension as ae on ae._applicationextensionid=aea.extension inner join application as a on a._applicationid=ae.application inner join package as p on p._packageid=a.package inner join packageuser as pu on pu.package=p._packageid left join applicationidentity as ai on ai.applicationusermodelid=a.applicationusermodelid left join appexecutionaliasuser as aeau on aeau.applicationidentity=ai._applicationidentityid where aea.alias=?2 and pu.user=?1 and ifnull(aeau.status, 0)<>2 and aea._workid=0 and ae._workid=0 and a._workid=0 and p._workid=0 and pu._workid=0 order by ifnull(aeau.status, 0), pu.installtime;"), "DELETE FROM %s WHERE _WorkId>0 AND _WorkId<>0;" (Source: sample.bin, Indicator: "delete from %s where _workid>0 and _workid<>0;"), "SELECT a._ApplicationID, a._Revision, a._WorkId, a.Package, a."Index", a.ApplicationType, a.Flags, a.Subsystem, a.PackageRelativeApplicationId, a.ApplicationUserModelId, a.DisplayName, a.Description, a.Square150x150Logo, a.Square44x44Logo, a.Wide310x150Logo, a.Square310x310Logo, a.Square71x71Logo, a.ForegroundText, a.BackgroundColor, a.Executable, a.Entrypoint, a.StartPage, a.ResourceGroup, a.LockScreenNotification, a.LockScreenBadgeLogo, a.SplashScreenImage, a.SplashScreenBackgroundColor, a.InitialRotationPreference, a.ApplicationViewMinWidth, a.AppListEntry, a.EditionId, a.VisualGroup, a._Dictionary FROM Application AS a INNER JOIN Package AS p ON p._PackageID=a.Package INNER JOIN PackageUser AS pu ON pu.Package=p._PackageID WHERE p.PackageFullName=?2 AND pu.User=?1 AND a._WorkId=0 AND p._WorkId=0 AND pu._WorkId=0;" (Source: sample.bin, Indicator: "select a._applicationid, a._revision, a._workid, a.package, a."index", a.applicationtype, a.flags, a.subsystem, a.packagerelativeapplicationid, a.applicationusermodelid, a.displayname, a.description, a.square150x150logo, a.square44x44logo, a.wide310x150logo, a.square310x310logo, a.square71x71logo, a.foregroundtext, a.backgroundcolor, a.executable, a.entrypoint, a.startpage, a.resourcegroup, a.lockscreennotification, a.lockscreenbadgelogo, a.splashscreenimage, a.splashscreenbackgroundcolor, a.initialrotationpreference, a.applicationviewminwidth, a.applistentry, a.editionid, a.visualgroup, a._dictionary from application as a inner join package as p on p._packageid=a.package inner join packageuser as pu on pu.package=p._packageid where p.packagefullname=?2 and pu.user=?1 and a._workid=0 and p._workid=0 and pu._workid=0;"), "SELECT tv._TileViewID, tv._Revision, tv._WorkId, tv.Application, tv.Package, tv.Flags, tv.TileType, tv.TileTemplate, tv.TileId, tv.Arguments, tv.EditionId, tv._Dictionary, tv._TileUserID, tv._TileUser_Revision, tv._Created, tv._Modified, tv.User, tv.State, tv.TileUniqueId FROM TileView AS tv INNER JOIN Application AS a ON a._ApplicationID=tv.Application WHERE tv.User=? AND (tv._Created>? OR tv._Modified>?)" (Source: sample.bin, Indicator: "select tv._tileviewid, tv._revision, tv._workid, tv.application, tv.package, tv.flags, tv.tiletype, tv.tiletemplate, tv.tileid, tv.arguments, tv.editionid, tv._dictionary, tv._tileuserid, tv._tileuser_revision, tv._created, tv._modified, tv.user, tv.state, tv.tileuniqueid from tileview as tv inner join application as a on a._applicationid=tv.application where tv.user=? and (tv._created>? or tv._modified>?)"), "DELETE FROM Enterprise WHERE (_EnterpriseID NOT IN (SELECT Enterprise FROM Package));" (Source: sample.bin, Indicator: "delete from enterprise where (_enterpriseid not in (select enterprise from package));"), "SELECT Package, "Index", Flags, PackageRelativeApplicationId, ApplicationUserModelId, Executable, Entrypoint, StartPage FROM CacheApplication WHERE _CacheApplicationID=?;" (Source: sample.bin, Indicator: "select package, "index", flags, packagerelativeapplicationid, applicationusermodelid, executable, entrypoint, startpage from cacheapplication where _cacheapplicationid=?;"), "SELECT _CachePackageID, PackageFullName, PackageFamily, PackageType, Flags, PackageOrigin, Volume, InstalledLocation FROM CachePackage;" (Source: sample.bin, Indicator: "select _cachepackageid, packagefullname, packagefamily, packagetype, flags, packageorigin, volume, installedlocation from cachepackage;"), "DELETE FROM DeploymentHistory WHERE WhenOccurred<=? AND (_WorkId=0 OR _WorkId=?);" (Source: sample.bin, Indicator: "delete from deploymenthistory where whenoccurred<=? and (_workid=0 or _workid=?);"), "UPDATE PackagePolicy SET _WorkId=? WHERE _PackagePolicyID=?;" (Source: sample.bin, Indicator: "update packagepolicy set _workid=? where _packagepolicyid=?;"), "SELECT _PackageUserID, _Revision, _WorkId, _ShadowId, _IsMarkedForDeletion, _Created, _Modified, Package, User, PackageIdentity, InstallTime, OSVersionWhenInstalled, WhenRestored, IsExplicitlyInstalled, DeploymentState, PackageStatus, AppDataVolume, _Dictionary FROM PackageUser WHERE Package=? AND _WorkId=0;" (Source: sample.bin, Indicator: "select _packageuserid, _revision, _workid, _shadowid, _ismarkedfordeletion, _created, _modified, package, user, packageidentity, installtime, osversionwheninstalled, whenrestored, isexplicitlyinstalled, deploymentstate, packagestatus, appdatavolume, _dictionary from packageuser where package=? and _workid=0;"), "UPDATE PackageFamilyPolicy SET _WorkId=? WHERE _PackageFamilyPolicyID=?;" (Source: sample.bin, Indicator: "update packagefamilypolicy set _workid=? where _packagefamilypolicyid=?;"), "SELECT _PackagePolicyID, _Revision, _WorkId, User, Package, Name, "Index", ValueString, ValueNumber, _Dictionary FROM PackagePolicy WHERE Package=? AND Name=? AND "Index"=? AND (_WorkId=0 OR _WorkId=?) ORDER BY _WorkId DESC;" (Source: sample.bin, Indicator: "select _packagepolicyid, _revision, _workid, user, package, name, "index", valuestring, valuenumber, _dictionary from packagepolicy where package=? and name=? and "index"=? and (_workid=0 or _workid=?) order by _workid desc;"), "SELECT _Revision, _WorkId, _Created, _Modified, PackageFamily, ResourceId, Architecture, Version, PackageFullName, IsInbox, PackageType, Flags, DisplayName, PublisherDisplayName, Description, Logo, OSMinVersion, OSMaxVersionTested, TargetDeviceFamily, Capabilities, SupportedUsers, SignatureOrigin, PackageOrigin, Enterprise, SourceBundle, EditionId, OSVersionWhenIndexed, InPlaceUpdateBaseline, _Dictionary FROM Package WHERE _PackageID=? AND (_WorkId=0 OR _WorkId=?) ORDER BY _WorkId DESC;" (Source: sample.bin, Indicator: "select _revision, _workid, _created, _modified, packagefamily, resourceid, architecture, version, packagefullname, isinbox, packagetype, flags, displayname, publisherdisplayname, description, logo, osminversion, osmaxversiontested, targetdevicefamily, capabilities, supportedusers, signatureorigin, packageorigin, enterprise, sourcebundle, editionid, osversionwhenindexed, inplaceupdatebaseline, _dictionary from package where _packageid=? and (_workid=0 or _workid=?) order by _workid desc;"), "DELETE FROM ApplicationIdentity WHERE (ApplicationUserModelId NOT IN (SELECT ApplicationUserModelId FROM Application)) AND (_ApplicationIdentityID NOT IN (SELECT ApplicationIdentity FROM AppExecutionAliasUser)) AND (_ApplicationIdentityID NOT IN (SELECT ApplicationIdentity FROM SRJournal)) AND (_ApplicationIdentityID NOT IN (SELECT ApplicationIdentity FROM SRJournalArchive));" (Source: sample.bin, Indicator: "delete from applicationidentity where (applicationusermodelid not in (select applicationusermodelid from application)) and (_applicationidentityid not in (select applicationidentity from appexecutionaliasuser)) and (_applicationidentityid not in (select applicationidentity from srjournal)) and (_applicationidentityid not in (select applicationidentity from srjournalarchive));"), "SELECT EXISTS(SELECT 1 FROM SecondaryTileUser WHERE User<>?2 AND (_WorkId=0 OR _WorkId=?3) AND (TileUniqueId=?1 OR SecondaryTile IN (SELECT SecondaryTile FROM SecondaryTileUser WHERE TileUniqueId=?1 AND (_WorkId=0 OR _WorkId=?3))) LIMIT 1);" (Source: sample.bin, Indicator: "select exists(select 1 from secondarytileuser where user<>?2 and (_workid=0 or _workid=?3) and (tileuniqueid=?1 or secondarytile in (select secondarytile from secondarytileuser where tileuniqueid=?1 and (_workid=0 or _workid=?3))) limit 1);"), "SELECT PackageFullName, PackageFamily, PackageType, Flags, PackageOrigin, Volume, InstalledLocation FROM CachePackage WHERE _CachePackageID=?;" (Source: sample.bin, Indicator: "select packagefullname, packagefamily, packagetype, flags, packageorigin, volume, installedlocation from cachepackage where _cachepackageid=?;"), "SELECT EXISTS(SELECT 1 FROM Package WHERE PackageFamily=? AND PackageType & ? !=0 AND _WorkId=0 LIMIT 1);" (Source: sample.bin, Indicator: "select exists(select 1 from package where packagefamily=? and packagetype & ? !=0 and _workid=0 limit 1);")36:T443,"Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" in Source: sample.bin, "_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\AppModel\StateRepositoryStatus" in Source: sample.bin, "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" in Source: sample.bin, "System\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" in Source: sample.bin, "_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Appx" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: sample.bin, "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository" in Source: sample.bin30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 63ca34ed43d1… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 63ca34ed43d1…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"windows.staterepository.dll\",\"applicationCategory\":[\"pedll\",\"64bits\",\"executable\"],\"identifier\":\"63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794354409348,"unified_at":"2026-11-10T23:46:49.348Z","metadata":{"hashes":{"sha256":"63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab","sha1":"c3e0b95b5b3d350385b745f5075a178d19966759","md5":"aaa619efa946e557ac3c11402fbce87e"},"file_info":{"file_name":"windows.staterepository.dll","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":5082312,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794354402000,"last_seen":1794354402000,"last_multi_scan":1794354402000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":10,"suspicious_count":1,"malicious_count":0,"total":11},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"References user shell folders registry key string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains SQL queries","description":"$35","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$36","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"RtlDllShutdownInProgress\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RaiseFailFastException\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RtlNtStatusToDosErrorNoTeb\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"References user shell folders registry key string","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\" (Indicator: \"currentversion\\explorer\\user shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-410","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"file/memory contains long string with (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosErrorNoTeb\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"\" (Indicator: \"QueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"\" (Indicator: \"NtQueryInformationProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab":{"type":"File","value":"63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1569860901033083744","root":"File:63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 63ca34ed43d1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 63ca34ed43d1…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab"}],["$","meta","4",{"property":"og:title","content":"Sample 63ca34ed43d1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 63ca34ed43d1…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/63ca34ed43d10cc5fec111863d09578f7bd105247c878cd2a514d4c4e543ceab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 63ca34ed43d1… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 63ca34ed43d1…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]] 32:null