26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T414,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 9ed205d59a0e… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 9ed205d59a0e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","keywords":["malware analysis","sandbox report","threat intelligence","9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e"],"about":{"@type":"SoftwareApplication","name":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","applicationCategory":["peexe","executable"],"identifier":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Taa1,"Software\SMART Technologies\SMART Board Drivers\Board Tools" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: sample.bin, "Software\SMART Technologies\SMART Meeting Pro" in Source: sample.bin, "launcherShow Ink ToolbarSMARTInkSoftware\\SMART Technologies\\SMART Ink\\Install Information\\Install Path-showToolbarSMART Ink.app/Contents/MacOS/SMART InklauncherHide Ink ToolbarSMARTInkSoftware\\SMART Technologies\\SMART Ink\\Install Information\\Install Path-hideToolbarSMART Ink.app/Contents/MacOS/SMART Ink" in Source: sample.bin, "Software\SMART Technologies\SMART Meeting Pro (Personal Edition)" in Source: sample.bin, "launcherSMART SettingsSMARTBrdSMART Settings.appbin/Control PanelSoftware\\SMART Technologies\\SMART Board Drivers\\Install Information\\Drivers DirectorycustomOrientOrientSMART Settings.app/Contents/bin/Orient.app/Contents/MacOS/Orientbin/OrientSoftware\\SMART Technologies\\SMART Board Drivers\\Install Information\\Drivers DirectorycustomCheck for Updates and ActivationSpuSpuSpuSoftware\\SMART Technologies\\SMART Pro" in Source: sample.bin, "Software\SMART Technologies\SMART Board Drivers\Machine" in Source: sample.bin, "Software\SMART Technologies\Notebook Software\Install Information" in Source: sample.bin, "Software\SMART Technologies\SMART Board Drivers\Install Information" in Source: sample.bin, "Software\SMART Technologies\Product Update" in Source: sample.bin, "Software\SMART Technologies Inc.\SMART Board Software\Machine" in Source: sample.bin, "CSidebarMenu::paintEvent() - Failed to Read: Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive" in Source: sample.bin28:Td19,Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExW"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcW"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterApplicationRestart"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleExW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")29:T7b1,Found XOR loop in file "sample.bin" at offset 219747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 227400; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 844773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 855883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 856559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 857413; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 188963; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 221746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 326477; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 844455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 846269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 267496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 313341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 360948; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 396358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 849910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 849998; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 855202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 855844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 856546; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 857400; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 858172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 860346; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 860922; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 861888; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 863976; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 865309; code bytes = 80302a:Ted7,"launcherSMART SettingsSMARTBrdSMART Settings.appbin/Control PanelSoftware\\SMART Technologies\\SMART Board Drivers\\Install Information\\Drivers DirectorycustomOrientOrientSMART Settings.app/Contents/bin/Orient.app/Contents/MacOS/Orientbin/OrientSoftware\\SMART Technologies\\SMART Board Drivers\\Install Information\\Drivers DirectorycustomCheck for Updates and ActivationSpuSpuSpuSoftware\\SMART Technologies\\SMART Product Update\\ExePathcustomHelpHelpHelpHelpcustomExitExitExitExitdriversdrivers" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "launcherShow Ink ToolbarSMARTInkSoftware\\SMART Technologies\\SMART Ink\\Install Information\\Install Path-showToolbarSMART Ink.app/Contents/MacOS/SMART InklauncherHide Ink ToolbarSMARTInkSoftware\\SMART Technologies\\SMART Ink\\Install Information\\Install Path-hideToolbarSMART Ink.app/Contents/MacOS/SMART Ink" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "CSidebarMenu::paintEvent() - Failed to Read: Software\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\SMART Board Drivers\Machine" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies Inc.\SMART Board Software\Machine" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\SMART Meeting Pro" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\SMART Meeting Pro (Personal Edition)" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\Notebook Software\Install Information" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\SMART Board Drivers\Install Information" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\SMART Board Drivers\Board Tools" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\SMART Technologies\Product Update" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00000472.00000000.133420.00F6B000.00000002.mdmp2b:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 0D:75:F7:2C:69:50:70:A6:7E:2E:E1:D3:D2:99:7D:27:81:D6:57:94; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)2c:T589,Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "QtSingleCoreApplication: listen on local socket failed, %s" (Indicator: " socket "; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "QtSingleCoreApplication: listen on local socket failed, %s" (Indicator: " listen "; File: "9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e") Found reference to API "QtSingleCoreApplication: listen on local socket failed, %s" (Indicator: " socket "; Source: "00000000-00000472.00000000.133420.00F6B000.00000002.mdmp") Found reference to API "QtSingleCoreApplication: listen on local socket failed, %s" (Indicator: " listen "; Source: "00000000-00000472.00000000.133420.00F6B000.00000002.mdmp")2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmZmZmZmZmZmZmZmZgAAAGZ3d3d3d3d3d3d3d3ZkAAZoiIiIiIiIiIiIiIiIdgAGiIiIiIiIiIiIiIiIiIZgBoiIiIiIiIiIiIiIiIiHYAaIiIiIiP////iIiIiIh2AGiIiIiP//////+IiIiIdgBoiIiI////////+IiIiHYAZ3d3j/////////+Hd3d2AGd3eP//////////+Hd3dgBnd3j////4iP////+Hd3YAZ3eP///4dndo////h3d2AGd3j///9nj4h4////d3dgBnd4///3f4iPh////3d3YAZ3f///949naIeP//93dmAGd3////eId3j3j///d3ZgBnd////3j3d4h4///3d3YAZ3eP//+Hj4/3j///93d2AGd3j///+HiId////4d3dgBoiH////+Hd4////+IiHYAaIiI////////////eIh2AHiIh///////////+IiIdgB4iIiP/////////4iIiHYAeIiIiP////////iIiIh2AHiIiIh4//////iIiIiIdgB4iIiIiIiP//iIiIiIiHYAeIiIiIiIiIiIiIiIiIh2AGiIiIiIiIiIiIiIiIiIdgBniIiIiIiIiIiIiIiIiGAABnd3d3d3d3d3d3d3d3YADAAAAHgAAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAADwAAABw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792960182963,"unified_at":"2026-10-25T20:29:42.963Z","metadata":{"hashes":{"sha256":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","sha1":"69d521c6f10e1aa1f3eacf1a5937b4500fbe48e3","md5":"4acc6a9d57690e176106b3c43dbf29f6","sha512":"d336e4176b9070d03d00ec4efac1007bdc088df16d5a4b3eb6d3ba78a5a9341dfeeeb879848ecd849cb16806af1f22d089926e4f1b56b09e235d140fb5981ab3","ssdeep":"6144:6nXpi1slhtQU5S9zPT/2WB5BoCjg1yjw1yjKKgZKa15BoFWg3b7lG7z29H4xHvV+:6nVSvp/2WVRjg18w18+1ZEHlEUzt","ssdeep_chunks":["6144:6nXpi1s","6144:nXpi1sl","6144:Xpi1slh","6144:pi1slht","6144:i1slhtQ","6144:1slhtQU","6144:slhtQU5","6144:lhtQU5S","6144:htQU5S9","6144:tQU5S9z","6144:QU5S9zP","6144:U5S9zPT","6144:5S9zPT/","6144:S9zPT/2","6144:9zPT/2W","6144:zPT/2WB","6144:PT/2WB5","6144:T/2WB5B","6144:/2WB5Bo","6144:2WB5BoC","6144:WB5BoCj","6144:B5BoCjg","6144:5BoCjg1","6144:BoCjg1y","6144:oCjg1yj","6144:Cjg1yjw","6144:jg1yjw1","6144:g1yjw1y","6144:1yjw1yj","6144:yjw1yjK","6144:jw1yjKK","6144:w1yjKKg","6144:1yjKKgZ","6144:yjKKgZK","6144:jKKgZKa","6144:KKgZKa1","6144:KgZKa15","6144:gZKa15B","6144:ZKa15Bo","6144:Ka15BoF","6144:a15BoFW","6144:15BoFWg","6144:5BoFWg3","6144:BoFWg3b","6144:oFWg3b7","6144:FWg3b7l","6144:Wg3b7lG","6144:g3b7lG7","6144:3b7lG7z","6144:b7lG7z2","6144:7lG7z29","6144:lG7z29H","6144:G7z29H4","6144:7z29H4x","6144:z29H4xH","6144:29H4xHv","6144:9H4xHvV","6144:H4xHvV+","12288:6nXpi1s","12288:nXpi1sl","12288:Xpi1slh","12288:pi1slht","12288:i1slhtQ","12288:1slhtQU","12288:slhtQU5","12288:lhtQU5S","12288:htQU5S9","12288:tQU5S9z","12288:QU5S9zP","12288:U5S9zPT","12288:5S9zPT/","12288:S9zPT/2","12288:9zPT/2W","12288:zPT/2WB","12288:PT/2WB5","12288:T/2WB5B","12288:/2WB5Bo","12288:2WB5BoC","12288:WB5BoCj","12288:B5BoCjg","12288:5BoCjg1","12288:BoCjg1y","12288:oCjg1yj","12288:Cjg1yjw","12288:jg1yjw1","12288:g1yjw1y","12288:1yjw1yj","12288:yjw1yjK","12288:jw1yjKK","12288:w1yjKKg","12288:1yjKKgZ","12288:yjKKgZK","12288:jKKgZKa","12288:KKgZKa1","12288:KgZKa15","12288:gZKa15B","12288:ZKa15Bo","12288:Ka15BoF","12288:a15BoFW","12288:15BoFWg","12288:5BoFWg3","12288:BoFWg3b","12288:oFWg3b7","12288:FWg3b7l","12288:Wg3b7lG","12288:g3b7lG7","12288:3b7lG7z","12288:b7lG7z2","12288:7lG7z29","12288:lG7z29H","12288:G7z29H4","12288:7z29H4x","12288:z29H4xH","12288:29H4xHv","12288:9H4xHvV","12288:H4xHvV+","6144:6nVSvp/","6144:nVSvp/2","6144:VSvp/2W","6144:Svp/2WV","6144:vp/2WVR","6144:p/2WVRj","6144:/2WVRjg","6144:2WVRjg1","6144:WVRjg18","6144:VRjg18w","6144:Rjg18w1","6144:jg18w18","6144:g18w18+","6144:18w18+1","6144:8w18+1Z","6144:w18+1ZE","6144:18+1ZEH","6144:8+1ZEHl","6144:+1ZEHlE","6144:1ZEHlEU","6144:ZEHlEUz","6144:EHlEUzt"],"imphash":"f948f8edb0ad18b4bcfa2878e090c658"},"file_info":{"file_name":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","file_type":["peexe","executable"],"file_type_id":"exe","file_size":868632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792960120000,"last_seen":1792960120000,"last_multi_scan":1792960120000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":52,"suspicious_count":6,"malicious_count":0,"total":58},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to execute program"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains registry location strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"__crtGetShowWindowMode\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\BuildAgent1\\work\\30929d89455a0384\\builds\\Win32\\Release\\SMARTSystemMenu.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://smarttech.com/kb/170845\", Pattern match: \"https://www.verisign.com/cps0*\", Pattern match: \"https://www.verisign.com/rpa0\", Pattern match: \"ink.app/contents/macos/smart\", Pattern match: \"http://crl.verisign.com/pca3-g5.crl04\", Pattern match: \"settings.app/contents/bin/orient.app/contents/macos/orient\", Pattern match: \"http://ts-ocsp.ws.symantec.com07\", Pattern match: \"http://logo.verisign.com/vslogo.gif04\", Pattern match: \"http://onlinehelp.smarttech.com/redirect/\", Pattern match: \"https://www.verisign.com/rpa\", Pattern match: \"http://crl.thawte.com/thawtetimestampingca.crl0\", Pattern match: \"http://csc3-2010-aia.verisign.com/csc3-2010.cer0\", Pattern match: \"http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\", Pattern match: \"http://ocsp.verisign.com0\", Pattern match: \"http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\", Pattern match: \"http://csc3-2010-crl.verisign.com/csc3-2010.crl0d\", Pattern match: \"http://ocsp.thawte.com0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"14.0.0.0\", \"12.0.0.0\", \"14.3.0.0\", \"127.0.0.1\", \"4.0.0.2\", \"4.0.0.1\", \"1.2.0.0\", \"11.4.0.0\", \"14.2.0.0\", \"225.1.2.34\", \"1.4.0.0\", \"14.1.0.0\", \"3.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"sendMessage(QString)\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"onExecutePostMessage()\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"sendMessage(QString,int)\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"1onExecutePostMessage()\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"onExecutePostMessage action_text\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-906","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"tasklist\" (Indicator: \"tasklist\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"QtLockedFile::lock(): CreateMutex failed\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\"), Found reference to API \"QtLockedFile::lock(): OpenMutex failed\" (Indicator: \"OpenMutex\"; Source: \"sample.bin\"), Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"__crtSetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QtLockedFile::lock(): WaitForMultipleObjects failed\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"QtLockedFile::lock(): WaitForSingleObject failed\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"__crtTerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 44173-2413-0041A7E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00000472.00000000.133420.00F6B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 44173-5583-00423137","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$2a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" was detected as \"Microsoft Visual C++\" and name: \"Compiler\"\n \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" was detected as \"Qt\" and name: \"Library\"\n \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" file has an entrypoint instructions - \"call\t0x412d71,jmp\t0x412864,push\t0x14,push\t0x46bc50,call\t0x412a80,xor\tesi, esi,mov\tdword ptr [ebp - 0x1c], esi,mov\tdword ptr [ebp - 0x20], esi,call\tdword ptr [0x42b1c4],movzx\tebx, ax,mov\tdword ptr [ebp - 4], esi,mov\teax, dword ptr fs:[0x18],mov\tedx, dword ptr [eax + 4],mov\tedi, esi,mov\tesi, 0x4768c8,mov\tecx, edx,xor\teax, eax,lock cmpxchg\tdword ptr [esi], ecx,test\teax, eax,je\t0x4128ab,cmp\teax, edx,jne\t0x412894,xor\tesi, esi,inc\tesi,mov\tedi, esi,jmp\t0x4128ae,xor\tesi, esi,inc\tesi,cmp\tdword ptr [0x4768cc], esi,jne\t0x4128c0,push\t0x1f,call\t0x412c26,pop\tecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 245516)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://onlinehelp.smarttech.com/redirect/?lang=&project=&version=windows&system=&context=strhelpurl\" - Source: \"00000000-00000472.00000000.133420.00F6B000.00000002.mdmp\")\n Found URL \"http://smarttech.com/kb/170845deque\" - Source: \"00000000-00000472.00000000.133420.00F6B000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" was detected as \"Microsoft Visual C++ 8\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 44173-2321-00412EAE\n IsDebuggerPresent@KERNEL32.dll at 44173-2732-00412545","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e\" has section name .rdata with entropy \"7.527917219162004\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"ShellExecuteExW@SHELL32.dll at 44173-2228-0040A8CD","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"?waitForDisconnected@QLocalSocket@@QAE_NH@Z@QtNetwork4.dll at 44173-2309-004122EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"__crtTerminateProcess@MSVCR120.dll at 44173-2321-00412EAE\n __crtTerminateProcess@MSVCR120.dll at 44173-2322-00412FF2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n GetCommandLineW\n GetVersionExW\n OutputDebugStringW\n Sleep\n IsDebuggerPresent\n GetTickCount\n GetModuleHandleExW\n ShellExecuteExW\n FindWindowW\n send\n sendto\n recv\n socket\n bind\n WSAStartup\n closesocket\n connect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":1,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6ade66779b43c62602050f68","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","analysis_start_time":"2026-10-25T20:28:40+00:00","indicators_count":{"informative":52,"suspicious":6,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ade66779b43c62602050f68"}],"processes":[{"pid":472,"ppid":0,"name":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e.exe","command_line":"","sha256":"9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e","normalized_path":"C:\\9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e.exe","uid":"00000000-00000472","icon":"$2d"}],"all_imported_dlls":["ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ade66779b43c62602050f68"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 9ed205d59a0e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9ed205d59a0e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e"}],["$","meta","4",{"property":"og:title","content":"Sample 9ed205d59a0e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9ed205d59a0e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9ed205d59a0e0c2a4a96407b932fb94065fb255ee012c743f130516b97aae56e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9ed205d59a0e… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9ed205d59a0e…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]