File scan report
Verdict Safe
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 safe? Yes, no threats found.
No antivirus engine flagged this widely distributed, ByteDance-signed CapCut installer, and its completed sandbox run showed installation activity without a malicious verdict.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Bytedance Pte. Ltd.
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged the file, and its verified ByteDance signature aligns with the observed CapCut installation paths, registry entries, program markers, and service domains. It is an older, widely submitted sample, while the completed sandbox run and fully covered host-reputation check produced no malicious finding.
The strongest evidence identifies this executable as a CapCut installer signed by Bytedance Pte. Ltd. None of the 71 antivirus engines that checked it flagged it, including no detections among the major antivirus engines, and the sample has been submitted 69,747 times by 3,695 sources. Its completed sandbox run contacted CapCut and ByteDance infrastructure, created CapCut installation records, and received a clean runtime assessment. All 35 distinct observed hosts were covered by the reputation cross-check, with none listed as malicious or suspicious; Microsoft background contacts were excluded from sample activity. Six offensive-capability techniques and updater-process injection remain cautionary observations, but they lack corroboration from engines, malicious hosts, persistence indicators, malware-specific YARA rules, or malicious child verdicts.
What We Detected
None of the 71 antivirus engines that checked it flagged the executable. It carries a verified signature from Bytedance Pte. Ltd., and runtime artifacts consistently identify CapCut: the installer launched packages under the local CapCut directory, created ByteDance and CapCut program markers, and wrote CapCut uninstall and publisher records.
Threat Behavior
One completed sandbox run received a clean assessment. The executable contacted CapCut, ByteDance, and related content-delivery services; the host-reputation check covered all 35 distinct observed domains and IPs and found no malicious or suspicious entries. Three Microsoft contacts were analysis-environment background traffic and were not attributed to the sample. The run mapped T1134, T1486, T1543.003, T1547.001, T1548, and T1560 and reported interaction with updater processes, but it recorded no persistence indicators, malicious child verdict, or malware-specific YARA match.
What To Do Now
The binary evidence is consistent with a widely distributed CapCut installer, although its unusual displayed filename is not informative. If CapCut was intended, verify that the signature still shows Bytedance Pte. Ltd. before running it. If the file arrived unexpectedly or from an untrusted sender, obtain a fresh installer through the publisher's normal distribution channel and keep security software enabled.
Where this verdict could be wrong4 caveats
- The sandbox mapped six offensive-capability techniques and reported injection into updater processes, which warrants caution despite the clean runtime verdict.
- The displayed filename does not identify CapCut, although the verified ByteDance signature and installation activity consistently do.
- Ten dropped files lack saved verdicts, so their individual safety was not established.
- Historical files sharing only this import-table fingerprint received four suspicious assessments, but none shared the signer and installer-framework import-table fingerprint collisions are weak identity evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the executable.
- The digital signature verifies to Bytedance Pte. Ltd.
- The file has 69,747 submissions from 3,695 sources and has circulated for roughly 989 days.
- The completed sandbox run received a clean assessment and produced CapCut-specific installation artifacts.
- All 35 observed hosts were covered by the reputation check, with no malicious or suspicious entries.
- The displayed filename is unrelated to CapCut and could confuse recipients about the executable's purpose.
- The sandbox mapped six techniques associated with offensive capabilities.
- Runtime reporting indicated interaction with multiple updater processes.
- Ten extracted files do not have individual saved assessments.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 30sandbox rule tags
- 11spawned processes
- 29network contacts
- 37filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
30MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1018
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1036
- T1047
- T1057· Lists programs
- T1059· Runs commands
- T1070· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1134
- T1222
- T1486· File encryption
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1529
- T1543.003· Service install
- T1547.001· Auto-start
- T1547.009· Auto-start
- T1548
- T1560
- T1574.001· Execution hijack
- T1574.002· Execution hijack
Observed activity
Processes started
11Programs the file ran, with their command lines.
executable.exe"C:\Users\<USER>\Desktop\executable.exe"app_package_6504ad5a3e.exe"C:\Users\<USER>\AppData\Local\app_shell_cache_562354\app_package_6504ad5a3e.exe" /s /create_desktop=1 /install_path="C:\Users\<USER>\AppData\Local\CapCut\Apps"CapCut_7267140873131950085_installer.exe%SAMPLEPATH%\CapCut_7267140873131950085_installer.exeapp_package_2dcb273cc6.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_2dcb273cc6.exe4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6.exe%SAMPLEPATH%\4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6.exeapp_package_4f439478eb.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_4f439478eb.exe
Show all 11 entries for processes started
file.exe%SAMPLEPATH%\file.exeapp_package_613538d2f9.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_613538d2f9.exeapp_package_cc03ed5adb.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_cc03ed5adb.exeapp_package_61624597dc.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_61624597dc.exeapp_package_608d36ec9b.exe%USERPROFILE%\AppData\Local\app_shell_cache_562354\app_package_608d36ec9b.exe
Network contacts
2929 hosts, listed as 12 domains, 17 addresses, 20 links. Links show the host and path only.
- Domain
maliva-mcs.byteoversea.com - Domain
sgali-mcs.byteoversea.com - Domain
lf16-capcut.faceulv.com - Domain
sf16-va.tiktokcdn.com - Domain
editor-api-sg.capcut.com - Domain
lf16-beecdn.ibytedtos.com
Show all 49 entries for network contacts
- Domain
sf16-web-tos-buz.capcutcdn-us.com - Domain
pc-mon-boot.capcutapi.com - Domain
tnc16-alisg.isnssdk.com - Domain
editor-api-va.capcutapi.com - Domain
feed-api-va.capcutapi.com - Domain
lf16-capcut.faceueditorv.com - IP address
23.215.55.196 - IP address
23.215.55.18 - IP address
23.215.55.205 - IP address
23.215.55.211 - IP address
209.85.200.94 - IP address
23.215.55.224 - IP address
23.215.55.220 - IP address
23.219.157.40 - IP address
23.220.163.196 - IP address
23.219.157.72 - IP address
23.219.157.35 - IP address
104.96.163.211 - IP address
23.32.75.10 - IP address
23.32.75.42 - IP address
23.32.75.37 - IP address
23.32.75.32 - IP address
23.32.75.30 - URL
http://sgali-mcs.byteoversea.com/v1/json - URL
http://maliva-mcs.byteoversea.com/v1/json - URL
http://editor-api-sg.capcut.com/service/settings/v3/ - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/speech_synthesis/speech_synthesis_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/water_world/water_world_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/chroma_keying/chroma_keying_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/visual_effects/visual_effects_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/intelligent_subtitles/intelligent_subtitles_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/text_style/text_style_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/keyframe/keyframe_en.png - URL
http://sf16-va.tiktokcdn.com/obj/eden-va2/JW-abJwhJ/ljhwZthlaukjlkulzlp/installer/pic/v1/automatic_scaling/automatic_scaling_en.png - URL
http://lf16-capcut.faceulv.com/obj/capcutpc-packages-sg/packages/CapCut_3_7_0_1358_capcutpc_0_creatortool.exe - URL
https://maliva-mcs.byteoversea.com/v1/json - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_1e2b7f59d83cf4b4bfce2bab19ca0a28.png - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_e7b1e578c5cd4f8b3d4484daeace153d.png - URL
https://sgali-mcs.byteoversea.com/v1/json - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_705e0680a841d65bef653e357d077bb8.png - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_17b5fa72fada169e070e737eeda6eeaf.png - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_0b282b2c1047710589717a14e0e9f360.png - URL
https://lf16-beecdn.ibytedtos.com/obj/ies-fe-bee-sg/bee_prod/biz_172/tos_60e9561a1f5345e7affbe498aed092ea.png
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\System.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\res.zip - Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\deviceregister_shared.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\shell_downloader.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\downloader_nsis_plugin.dll - Written
C:\Users\<USER>\AppData\Local\Temp\nsf2E4A.tmp\BgWorker.dll
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\text_style_en.png - Written
C:\Users\<USER>\AppData\Local\Temp\speech_synthesis_en.png - Written
C:\Users\<USER>\AppData\Local\Temp\E9DDA433-AA83-40F3-BEA5-93BAD32DD698\7zip.dll - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\test_access - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\Resources\ByteviewjianyingAudioDevice.driver\Contents\MacOS\ByteviewjianyingAudioDevice - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\Resources\ByteviewjianyingAudioDevice.driver\Contents\_CodeSignature\CodeResources - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\Resources\aigc_text_template\depends - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\Qt\labs\lottieqt\qmldir - Written
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\QtQuick\Scene2D\qmldir - Deleted
C:\Users\<USER>\AppData\Local\app_shell_cache_562354 - Deleted
C:\Users\<USER>\AppData\Local\app_shell_cache_562354\app_package_6504ad5a3e.exe - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\test_access - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\ - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\7z.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\AGFX.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-console-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-console-l1-2-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-datetime-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-debug-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-errorhandling-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-fibers-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-file-l1-1-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-file-l1-2-0.dll - Deleted
C:\Users\<USER>\AppData\Local\CapCut\Apps\202487191302440_1\JYPacket\4.1.0.1647\api-ms-win-core-file-l2-1-0.dll
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Bytedance\CapCut\WebInfoId - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\DisplayName - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\UninstallString - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\DisplayIcon - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\URLInfoAbout - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\Publisher
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CapCut\DisplayVersion - Set
HKEY_CURRENT_USER\SOFTWARE\Bytedance\CapCut\installDir - Set
HKEY_CURRENT_USER\SOFTWARE\Bytedance\CapCut\ver - Set
HKEY_CURRENT_USER\SOFTWARE\Bytedance\CapCut\cid - Set
HKEY_CURRENT_USER\SOFTWARE\Bytedance\CapCut\installTime - Set
HKEY_CURRENT_USER\Software\Classes\capcut\(Default) - Set
HKEY_CURRENT_USER\Software\Classes\capcut\shell\open\command\(Default) - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconLayouts - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconNameVersion
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
ByteDance_Mutex_Installer_Downloader_CapCutCapCut_Mutex_InstallCapCut_Mutex_UnInstallcversions.3.m\Sessions\1\BaseNamedObjects\ByteDance_Mutex_Installer_Downloader_CapCut\Sessions\1\BaseNamedObjects\CapCut_Mutex_Install
Show all 7 entries for mutexes
\Sessions\1\BaseNamedObjects\CapCut_Mutex_UnInstall
Sandbox background — not the file
25The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google3736_1967861007\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google2872_1664991675\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google3736_1967861007\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google2872_1664991675\bin\updater.exe
Show all 25 entries for sandbox background — not the file
- VM injection target
C:\Program Files (x86)\Google4028_351659338\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google3684_1192200933\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google420_1873988887\bin\updater.exe - VM injection target
C:\Program Files\Google4056_993027137\bin\updater.exe - VM injection target
C:\Program Files\Google3760_1646341\bin\updater.exe - VM injection target
C:\Program Files\Google1396_1746753498\bin\updater.exe - VM injection target
C:\Program Files\Google1100_957479963\bin\updater.exe - VM injection target
C:\Program Files\Google3604_2038938882\bin\updater.exe - VM injection target
C:\Program Files\Google3120_952280800\bin\updater.exe - VM injection target
C:\Program Files\Google2092_1106230153\bin\updater.exe - VM injection target
C:\Program Files\Google2236_1239106311\bin\updater.exe - VM injection target
C:\Program Files\Google4028_738231443\bin\updater.exe - VM injection target
C:\Program Files\Google3308_1465277908\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
time.windows.com - VM host
204.79.197.203 - VM host
20.99.186.246 - VM host
192.229.211.108
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 7c2a74c4be8d524a121e…a1d42aNot checkedno saved verdict
- 3eb38ae99653a7dbc724…f2eacaNot checkedno saved verdict
- 56a9920b94732c54604a…8d8965Not checkedno saved verdict
- e28ff7b8fc4b1eb2d1f3…e79ddaNot checkedno saved verdict
- 16e7b84b4c6575b9be51…16855eNot checkedno saved verdict
- ca3bb08e5c6de3ee7a57…205c95Not checkedno saved verdict
- 098972cf9ddc9d574130…eb1172Not checkedno saved verdict
- 3a5e1ef48bd852386d5b…1d90baNot checkedno saved verdict
- 7494085e07775517c046…8810bcNot checkedno saved verdict
- 620cffeecf59c90db73b…44dc55Not checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Bytedance Pte. Ltd..
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 3:15 AM UTC
- SHA-256
4a9d815f284adda187982e2b24da2beaad860739bc4b4cb1cf26408e7c221dd6- SHA-1
021f3f26d86f98af28dc987baad8714f64867207- MD5
c91e097550ea6ccedf592d8b83414e0d
About this file
🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 is a Win32 EXE file of 2.3 MB.
- Type and size
- Win32 EXE · 2.3 MB
- Signer
- Bytedance Pte. Ltd.Valid code signature.
- First seen
- Jan 26, 2024On VirusTotal.
- Submitted by
- 3,695 distinct sources
- Packer
- None detected
- Entropy
- 3.03 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- PE_Digital_Certificategeneric
- PE_Potentially_Signed_Digital_Certificategeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 safe?
What is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
How many antivirus engines detected 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Is 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔 digitally signed?
What is the SHA-256 hash of 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Is it safe to run 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
How up to date is this analysis of 🤔 ОТШВАБРИРОВАННОГО ПУКИНА В ГААГУ 🤔?
Community
Member reviews and reports for this exact file hash.