33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 37:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T595,Found reference to API "SeChangeNotifyPrivilege" (Indicator: "SeChangeNotifyPrivilege"; Source: "sample.bin"), Found reference to API "SeTrustedCredManAccessPrivilege" (Indicator: "SeTrustedCredManAccessPrivilege"; Source: "sample.bin"), Found reference to API "SeEnableDelegationPrivilege" (Indicator: "SeEnableDelegationPrivilege"; Source: "sample.bin"), Found reference to API "SeUndockPrivilege" (Indicator: "SeUndockPrivilege"; Source: "sample.bin"), Found reference to API "SeProfileSingleProcessPrivilege" (Indicator: "SeProfileSingleProcessPrivilege"; Source: "sample.bin"), Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "sample.bin"), Found reference to API "SeAuditPrivilege" (Indicator: "SeAuditPrivilege"; Source: "sample.bin"), Found reference to API "SeCreateTokenPrivilege" (Indicator: "SeCreateTokenPrivilege"; Source: "sample.bin"), Found reference to API "SeLockMemoryPrivilege" (Indicator: "SeLockMemoryPrivilege"; Source: "sample.bin"), Found reference to API "SeTcbPrivilege" (Indicator: "SeTcbPrivilege"; Source: "sample.bin"), Found reference to API "SeSystemProfilePrivilege" (Indicator: "SeSystemProfilePrivilege"; Source: "sample.bin"), Found reference to API "SeCreatePagefilePrivilege" (Indicator: "SeCreatePagefilePrivilege"; Source: "sample.bin"), Found reference to API "SeTakeOwnershipPrivilege" (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin")36:Tc60,Found reference to API "SeTrustedCredManAccessPrivilege" (Indicator: "access"; Source: "sample.bin"), Found reference to API "2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0" (Indicator: "time"; Source: "sample.bin"), Found reference to API "2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA0" (Indicator: "times"; Source: "sample.bin"), Found reference to API "TokenAccessRights" (Indicator: "access"; Source: "sample.bin"), Found reference to API "AllAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API "AccessControlSections" (Indicator: "access"; Source: "sample.bin"), Found reference to API "StandardRightsRead" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ObjectSecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "OpenSubKey" (Indicator: "open"; Source: "sample.bin"), Found reference to API "RegistrySecurity" (Indicator: "security"; Source: "sample.bin"), Found reference to API "OpenProcessToken" (Indicator: "open"; Source: "sample.bin"), Found reference to API "ThreadExceptionEventHandler" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SystemTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "previousState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" (Indicator: "time"; Source: "sample.bin"), Found reference to API "2DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA" (Indicator: "times"; Source: "sample.bin"), Found reference to API "SeShutdownPrivilege" (Indicator: "shutdown"; Source: "sample.bin"), Found reference to API "CheckAlreadyRunningAndTakeLock" (Indicator: "read"; Source: "sample.bin"), Found reference to API "y> " (Indicator: "access"; Source: "sample.bin"), Found reference to API "y> " (Indicator: "read"; Source: "sample.bin"), Found reference to API "y> " (Indicator: "security"; Source: "sample.bin"), Found reference to API "accessTokenHandle" (Indicator: "access"; Source: "sample.bin"), Found reference to API "Exit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "RemoveAccessRule" (Indicator: "access"; Source: "sample.bin"), Found reference to API "AddAccessRule" (Indicator: "access"; Source: "sample.bin"), Found reference to API "desiredAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API "GetAccessControl" (Indicator: "access"; Source: "sample.bin"), Found reference to API "Synchronize" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "TrustedCredentialManagerAccess" (Indicator: "access"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample c704dd418fa4… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample c704dd418fa4…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"HD-ComRegistrar.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":1},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794240277156,"unified_at":"2026-11-09T16:04:37.156Z","metadata":{"hashes":{"sha256":"c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce","sha1":"d996bec78c1d5fa6e509a61262d6365ad9f23a9c","md5":"9bab1de7abb2f74771341d59fa497e7c"},"file_info":{"file_name":"HD-ComRegistrar.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":29552,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794240260000,"last_seen":1794240260000,"last_multi_scan":1794240260000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":14,"suspicious_count":1,"malicious_count":0,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify COM objects"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$35","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValue\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"SeBackupPrivilege\" (Indicator: \"SeBackupPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonatePrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeImpersonatePrivilege\" (Indicator: \"SeImpersonate\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"System Security","name":"Found registry location strings which can modify COM objects","description":"Observed string: \"software\\classes\\clsid\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-344","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"IsWow64Process\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LookupPrivilegeName\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CloseHandle\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Classes\\CLSID\\{00020425-0000-0000-C000-000000000046}\\InProcServer32\" in Source: sample.bin, \"Software\\Classes\\CLSID\\{00020423-0000-0000-C000-000000000046}\\InProcServer32\" in Source: sample.bin, \"SOFTWARE\\Classes\\CLSID\\{00020423-0000-0000-C000-000000000046}\\InprocServer32\" in Source: sample.bin, \"SOFTWARE\\Classes\\CLSID\\{00020421-0000-0000-C000-000000000046}\\InprocServer32\" in Source: sample.bin, \"Software\\Classes\\CLSID\\{00020421-0000-0000-C000-000000000046}\\InProcServer32\" in Source: sample.bin, \"SOFTWARE\\Classes\\CLSID\\{00020425-0000-0000-C000-000000000046}\\InprocServer32\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"c:\\code\\app-player\\hd\\Source\\ComRegistrar\\obj\\Release\\HD-ComRegistrar.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"LookupPrivilegeName\" (Indicator: \"LookupPrivilegeName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ocsp.digicert.com0a\", Pattern match: \"http://ocsp.digicert.com0c\", Pattern match: \"crl3.digicert.com/digicerttrustedrootg4.crl0\", Pattern match: \"cacerts.digicert.com/digicerttrustedrootg4.crt0c\", Pattern match: \"http://www.digicert.com/cps0\", Pattern match: \"http://ocsp.digicert.com0x\", Pattern match: \"www.digicert.com1$0\", Pattern match: \"http://ocsp.digicert.com0\\\", Pattern match: \"cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0\", Pattern match: \"crl3.digicert.com/digicertassuredidrootca.crl0\", Pattern match: \"cacerts.digicert.com/digicertassuredidrootca.crt0e\", Pattern match: \"cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0\", Pattern match: \"www.digicert.com1!0\", Pattern match: \"crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s\", Pattern match: \"crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0=\", Pattern match: \"crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0\t\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S\" (Indicator: \"SHA384\"; Source: \"sample.bin\"), Found reference to \"Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=\" (Indicator: \"SHA384\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectory\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample c704dd418fa4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample c704dd418fa4…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce"}],["$","meta","4",{"property":"og:title","content":"Sample c704dd418fa4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample c704dd418fa4…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c704dd418fa4dd832d619dd093bbecd2fe4e07222ca8b14d046ebc142335c3ce"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample c704dd418fa4… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample c704dd418fa4…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]] 32:null