26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T408,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 5d1660a53aaf… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 5d1660a53aaf…. Threat score 0/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07","keywords":["Clean","malware analysis","sandbox report","threat intelligence","5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07"],"about":{"@type":"SoftwareApplication","name":"cd.exe","applicationCategory":["peexe","executable"],"identifier":"5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T597,Pattern match: "www.microsoft.com/exporting" Pattern match: "www.microsoft.com" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.sysinternals.com" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.sysinternals.com"28:T2114,"\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMS These license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals * updates, *supplements, *Internet - based services, *and support services for this software, unless other terms accompany those items.If so, those terms apply. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE. If you comply with these license terms, you have the rights below. INSTALLATION AND USER RIGHTS You may install and use any number of copies of the software on your devices. SCOPE OF LICENSE The software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limit" (Indicator: "sysinternals") "information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software. DOCUMENTATION Any person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes. EXPORT RESTRICTIONS The software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting . SUPPORT SERVICES Because this software is "as is " we may not provide support services" (Indicator: "sysinternals") "permit it to do so. DISCLAIMER OF WARRANTY The software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES You can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages. This limitation applies to * anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and * claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicab" (Indicator: "sysinternals") "le law. It also applies even if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages. Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French. Remarque : Ce logiciel" (Indicator: "sysinternals") "ril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b" (Indicator: "sysinternals") "POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement" (Indicator: "sysinternals") "me si Sysinternals connaissait ou devrait conna" (Indicator: "sysinternals") "http://www.sysinternals.com 0" (Indicator: "sysinternals") "Sysinternals License" (Indicator: "sysinternals") "Software\Sysinternals\%s" (Indicator: "sysinternals")29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1791083140299,"unified_at":"2026-10-04T03:05:40.299Z","metadata":{"hashes":{"sha256":"5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07","sha1":"50dbb71d04ba947b757e790031d9df70f35fed5a","md5":"be046bab4a23f8db568535aaea565f87","sha512":"d5483f905399376959cf3b714fb75ac678ffd9f7531296de6930e463328da6ae7a5f8bb52044a2e9509e9fa1d25767d1a8ccb4fe55690557a262998af669e084","ssdeep":"6144:zfmy/pB2sBTfWF89fMrnYlZruw0wktJ1EzEWQwlMQUAWiiuTOBo46XSuwPMDOw0Z:zdJW8BMrY0Ezn5MoW/8SM/z5ab1","ssdeep_chunks":["6144:zfmy/pB","6144:fmy/pB2","6144:my/pB2s","6144:y/pB2sB","6144:/pB2sBT","6144:pB2sBTf","6144:B2sBTfW","6144:2sBTfWF","6144:sBTfWF8","6144:BTfWF89","6144:TfWF89f","6144:fWF89fM","6144:WF89fMr","6144:F89fMrn","6144:89fMrnY","6144:9fMrnYl","6144:fMrnYlZ","6144:MrnYlZr","6144:rnYlZru","6144:nYlZruw","6144:YlZruw0","6144:lZruw0w","6144:Zruw0wk","6144:ruw0wkt","6144:uw0wktJ","6144:w0wktJ1","6144:0wktJ1E","6144:wktJ1Ez","6144:ktJ1EzE","6144:tJ1EzEW","6144:J1EzEWQ","6144:1EzEWQw","6144:EzEWQwl","6144:zEWQwlM","6144:EWQwlMQ","6144:WQwlMQU","6144:QwlMQUA","6144:wlMQUAW","6144:lMQUAWi","6144:MQUAWii","6144:QUAWiiu","6144:UAWiiuT","6144:AWiiuTO","6144:WiiuTOB","6144:iiuTOBo","6144:iuTOBo4","6144:uTOBo46","6144:TOBo46X","6144:OBo46XS","6144:Bo46XSu","6144:o46XSuw","6144:46XSuwP","6144:6XSuwPM","6144:XSuwPMD","6144:SuwPMDO","6144:uwPMDOw","6144:wPMDOw0","6144:PMDOw0Z","12288:zfmy/pB","12288:fmy/pB2","12288:my/pB2s","12288:y/pB2sB","12288:/pB2sBT","12288:pB2sBTf","12288:B2sBTfW","12288:2sBTfWF","12288:sBTfWF8","12288:BTfWF89","12288:TfWF89f","12288:fWF89fM","12288:WF89fMr","12288:F89fMrn","12288:89fMrnY","12288:9fMrnYl","12288:fMrnYlZ","12288:MrnYlZr","12288:rnYlZru","12288:nYlZruw","12288:YlZruw0","12288:lZruw0w","12288:Zruw0wk","12288:ruw0wkt","12288:uw0wktJ","12288:w0wktJ1","12288:0wktJ1E","12288:wktJ1Ez","12288:ktJ1EzE","12288:tJ1EzEW","12288:J1EzEWQ","12288:1EzEWQw","12288:EzEWQwl","12288:zEWQwlM","12288:EWQwlMQ","12288:WQwlMQU","12288:QwlMQUA","12288:wlMQUAW","12288:lMQUAWi","12288:MQUAWii","12288:QUAWiiu","12288:UAWiiuT","12288:AWiiuTO","12288:WiiuTOB","12288:iiuTOBo","12288:iuTOBo4","12288:uTOBo46","12288:TOBo46X","12288:OBo46XS","12288:Bo46XSu","12288:o46XSuw","12288:46XSuwP","12288:6XSuwPM","12288:XSuwPMD","12288:SuwPMDO","12288:uwPMDOw","12288:wPMDOw0","12288:PMDOw0Z","6144:zdJW8BM","6144:dJW8BMr","6144:JW8BMrY","6144:W8BMrY0","6144:8BMrY0E","6144:BMrY0Ez","6144:MrY0Ezn","6144:rY0Ezn5","6144:Y0Ezn5M","6144:0Ezn5Mo","6144:Ezn5MoW","6144:zn5MoW/","6144:n5MoW/8","6144:5MoW/8S","6144:MoW/8SM","6144:oW/8SM/","6144:W/8SM/z","6144:/8SM/z5","6144:8SM/z5a","6144:SM/z5ab","6144:M/z5ab1"],"imphash":"a2af6bc8cd96295808424b2cae585dd7"},"file_info":{"file_name":"cd.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":591520,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1570151353000,"last_seen":1699566055000,"last_multi_scan":1699566055000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["chir","expiro","floxif","hacktool","metasploit","meterpreter","neshta","netwire","netwiredrc","rat","swrort","tiggre","weecnaw"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":15,"suspicious_count":10,"malicious_count":4,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Dynamic Data Exchange","attack_id":"T1173","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1173","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Loads rich edit control libraries"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 28899-3025-004192A4\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00027204-00004856-35661-38-00CE92D5\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00027204-00004856-35661-560-00CE92A4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetActiveWindow@USER32.DLL at 00027204-00004856-35661-75-00CF0CCC\n Found reference to API IsWow64Process@KERNEL32.DLL at 00027204-00004856-35661-233-00CD2850\n Found reference to API IsWow64Process@KERNEL32.DLL at 00027204-00004856-35661-231-00CD2950\n Found reference to API RtlCreateProcessReflection@NTDLL.DLL at 00027204-00004856-35661-350-00CDE950\n Found reference to API NtResumeProcess@NTDLL.DLL at 00027204-00004856-35661-371-00CD9280\n Found reference to API IsWow64Process@KERNEL32.DLL at 00027204-00004856-35661-387-00CD7C10\n Found reference to API RtlGetLastNtStatus@NTDLL.DLL at 00027204-00004856-35661-404-00CD6670\n Found reference to API NtQuerySystemInformation@NTDLL.DLL at 00027204-00004856-35661-479-00CD4910","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00027204-00004856-35661-115-00CDDD80\n GetSystemTime@KERNEL32.DLL at 00027204-00004856-35661-134-00CDF1F0\n GetSystemTime@KERNEL32.DLL at 00027204-00004856-35661-235-00CDA5B0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027204-00004856-35661-305-00CEDD43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00027204-00004856-35661-234-00CD1F40","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-00001920h], 06h\" and \"jc 00CD23DBh\" at 00027204-00004856-35661-234-00CD1F40","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00027204-00004856-35661-172-00CF353E\n GetProcessHeap@KERNEL32.DLL at 00027204-00004856-35661-304-00CE7725\n GetProcessHeap@KERNEL32.DLL at 00027204-00004856-35661-1-00CE3148","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/65 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Builds\\13810\\Tools\\ProcDump_master\\bin\\Win32\\Release\\procdump.pdb\"\n \"C:\\Builds\\13810\\Tools\\ProcDump_master\\bin\\x64\\Release\\procdump64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\SysWOW64\\riched32.dll\" at 74480000\n \"\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 74400000","origin":"Loaded Module","mitre_attack_id":"T1179","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 93:CE:97:42:50:B9:9C:FA:69:EB:D1:7A:64:85:48:04:1C:E7:64:C6; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 3B:DA:32:3E:55:2D:B1:FD:E5:F4:FB:EE:75:D6:D5:B2:B1:87:EE:DC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 3C:AF:9B:A2:DB:55:70:CA:F7:69:42:FF:99:10:1B:99:38:88:E2:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"cd.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$28","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"EnumServicesStatusExW@ADVAPI32.dll at 28899-2812-0040A090\n EnumServicesStatusExW@ADVAPI32.DLL at 00027204-00004856-35661-364-00CDA090","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1120","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00027204-00004856-35661-559-00CE8DAC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 28899-2830-00407CC0\n LoadResource@KERNEL32.dll at 28899-2831-00407C50\n FindResourceW@KERNEL32.DLL at 00027204-00004856-35661-382-00CD7CC0\n LoadResource@KERNEL32.DLL at 00027204-00004856-35661-383-00CD7C50","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%WINDIR%\\win.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 28899-2811-0040A490\n CreateToolhelp32Snapshot@KERNEL32.dll at 28899-2812-0040A090\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027204-00004856-35661-363-00CDA490\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027204-00004856-35661-364-00CDA090","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegCreateKeyW\n RegOpenKeyW\n RegDeleteKeyW\n GetFileAttributesW\n GetThreadContext\n WriteFile\n DeviceIoControl\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n UnhandledExceptionFilter\n LoadLibraryExW\n CreateThread\n TerminateProcess\n GetModuleHandleExW\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n OpenProcess\n GetStartupInfoW\n ReadProcessMemory\n DeleteFileW\n GetProcAddress\n GetFileSizeEx\n CreateFileW\n Process32NextW\n LockResource\n GetCommandLineW\n Process32FirstW\n GetModuleHandleW\n FindResourceW\n CreateProcessW\n Sleep\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"711146027a3b4502ab8b02007f950200fc8c0200729602006cc805001ecd42027d264202\" to virtual address \"0x757607E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"cd.exe.bin\" (Offset: 355347)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/20 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00027204-00004856-35661-134-00CDF1F0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtResumeProcess@NTDLL.DLL at 00027204-00004856-35661-371-00CD9280\n NtResumeProcess@NTDLL.DLL at 00027204-00004856-35661-404-00CD6670\n NtQuerySystemInformation@NTDLL.DLL at 00027204-00004856-35661-479-00CD4910","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]}],"incidents":[{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["chir","expiro","floxif","hacktool","metasploit","meterpreter","neshta","netwire","netwiredrc","rat","swrort","tiggre","weecnaw"],"sample_flags":["TOR analysis"],"sandbox_reports":[{"id":"5d969bb8028838925c97ffde","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"clean","malware_family":"Trojan.DOMG","submit_name":"cd.exe","analysis_start_time":"2019-10-04T01:09:21+00:00","indicators_count":{"informative":15,"suspicious":12,"malicious":4},"tags":["TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}],"processes":[{"pid":4856,"ppid":0,"name":"cd.exe","command_line":"","sha256":"5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07","normalized_path":"C:\\cd.exe","uid":"00027204-00004856","icon":"$29"}],"all_imported_dlls":["sechost.dll","shlwapi.dll","comctl32.dll","riched32.dll","oleaut32.dll","uxtheme.dll","gdi32.dll","cryptbase.dll","msctf.dll","ntdll.dll","wow64cpu.dll","user32.dll","comdlg32.dll","wow64.dll","kernel32.dll","sspicli.dll","shell32.dll","ole32.dll","imm32.dll","dwmapi.dll","KernelBase.dll","rpcrt4.dll","pdh.dll","clbcatq.dll","msvcrt.dll","riched20.dll","advapi32.dll","wow64win.dll","psapi.dll","usp10.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\PROCDUMP\\","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]},{"key":"HKCU\\SOFTWARE\\SYSINTERNALS\\","sources":[{"report_type":"sandbox","report_id":"5d969bb8028838925c97ffde"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5d969bb8028838925c97ffde"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Clean Sample 5d1660a53aaf… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 5d1660a53aaf…. Threat score 0/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 5d1660a53aaf… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 5d1660a53aaf…. Threat score 0/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5d1660a53aaf824739d82f703ed580004980d377bdc2834f1041d512e4305d07"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 5d1660a53aaf… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 5d1660a53aaf…. Threat score 0/100. 0/28 AV engines flagged this file. 4 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]