34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T41f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 143f262b1a6b… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 143f262b1a6b…. Threat score 35/100. 0/26 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8"],"about":{"@type":"SoftwareApplication","name":"Factuur_261011367.html","applicationCategory":["html"],"identifier":"143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tb58,Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Data_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Networking_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Data Provider for Oracle_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NET Memory Cache 4.0_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\.NETFramework_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_2.0.50727_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_4.0.30319_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\aspnet_state_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\BITS_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\ESENT_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\LSM_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\Outlook_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfDisk_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfNet_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfOS_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\PerfProc_Perf_Library_Lock_PID_df8" Process chrome.exe created mutex with name "\Sessions\1\BaseNamedObjects\rdyboost_Perf_Library_Lock_PID_df8"37:T675,The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 00:3F:19:EA:8D:CB:0C:5E:EA:08:51:4D:F3:17:24:EF:4D:E1:BB:64; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 68:84:0F:DC:E9:7D:17:CB:CB:DE:D2:B9:0D:D8:CF:73:43:64:C7:8E; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: EA:BC:AB:CD:E0:C7:EA:5E:B3:51:4E:91:8E:95:E3:50:7D:C2:04:D4; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: 76:7A:3B:FA:D0:F8:92:94:22:AC:46:9B:F5:92:44:E3:9B:62:43:32; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: C7:7C:32:35:22:A5:51:FE:E3:D4:B5:33:DB:EA:23:AF:63:CC:E3:81; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 80:22:A5:CF:B9:FB:26:06:11:E9:54:3F:74:8D:40:E0:4C:9E:F6:87; see report for more information)38:Td86,"GET /async/folae?async=_fmt:pb HTTP/2 Host: www.google.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Cookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-protobuffer Date: Thu 12 Nov 2026 16:28:39 GMT Server: gws Content-Encoding: br X-Frame-Options: SAMEORIGIN Permissions-Policy: unload=() Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Version: 1017980103 Strict-Transport-Security: max-age=31536000 Accept-Ch: Sec-CH-UA-WoW64 X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="f.txt" X-Xss-Protection: 0 Report-To: {"group":"gws" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 with response body ==>BINARY_CONTENT....... "GET /?u=6eiczcdsc7eg22i2sj2d56a HTTP/2 Host: nvprofessional.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Priority: u=1 Accept-Encoding: gzip, deflate, br, zstd Accept: */* Sec-Fetch-Dest: script" Response ==> HTTP/2 301 Moved Permanently Content-Type: text/html; charset=UTF-8 Date: Thu 12 Nov 2026 16:28:39 GMT Server: Apache Set-Cookie: pll_language=en; expires=Fri 12 Nov 2027 16:28:40 GMT; Max-Age=31536000; path=/; secure; SameSite=Lax X-Redirect-By: WordPress X-Powered-By: PHP/8.2.35 Location: https://www.nvprofessional.com/?u=6eiczcdsc7eg22i2sj2d56a X-Ws-Ratelimit-Remaining: 999 X-Ws-Ratelimit-Limit: 1000 X-Ws-Origin: available with no response body "GET /?u=6eiczcdsc7eg22i2sj2d56a HTTP/2 Host: www.nvprofessional.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Ch-Ua: "Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Sec-Ch-Ua-Platform: "Windows" Priority: u=1 Accept-Encoding: gzip, deflate, br, zstd Accept: */* Sec-Fetch-Dest: script" Response ==> HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 Date: Thu 12 Nov 2026 16:28:40 GMT Server: Apache Set-Cookie: pll_language=en; expires=Fri 12 Nov 2027 16:28:41 GMT; Max-Age=31536000; path=/; secure; SameSite=Lax Content-Encoding: gzip X-Powered-By: PHP/8.2.35 Link: ; rel="https://api.w.org/" ; rel="alternate"; title="JSON"; type="application/json" ; rel=shortlink X-Ws-Ratelimit-Remaining: 999 X-Ws-Ratelimit-Limit: 1000 X-Ws-Origin: available with response body ==>BINARY_CONTENT.......39:Tb34,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAILklEQVR4XqXWe1BTVx4H8PhCJOSlxqn7305nbF0RFBDwUWvFFUUCEh4VLAUKtUut01ZYQURFY6wgTxe0omwfU3W3rrqrgtYK3ISEBALhlYRABHxBffS5nXV37c5893fvBWWTMKXumflNmMzN/X7O75x7LgLBBMdizTdYzHyFRZoh+Gluwk/bD1+tA346O/z0Fiw2dGCRoR2BzUYEthiwtK0Ozvd4phHY8D0CGr6Dv+ZrLnyR5g4HWKi9QdUH38Ye+Oos8GvqJEQbBwhp1WBF+5dY2XkFaywXnw0S3PAIQcw/EMj8gACavb/mAYXfpfBb8NUMYqGGBfTAR2vDQl0XfPWd1IFW+BtNNHsCdFzDqq5LWGM9j/V9p6AcODlxSBDzTwQ1jIQz38KfeYDFmnsEGOZnT+E+XDgP8GnsIkQ7AUwIaDYgqFWLpeY6DhDWcwbr7acQ1X8ciXcP/jwiuOFf3MyXMD9ygECGbT8LGOY6wM2eWr+ADebKSn+zgE7qQhsWG1sQZGI78MUI4DSiblRh4wAPSLyrGh8RwvwbwVRBzGj7af2ZrwlwnwP4avm199HaudmzwQu03fiNthMLGlmAmfaCifaBlvbAVazuPo8w22cEOI74W8XYPKRG8vBupN7PdkUENzwGO/tghu3AI+rA36l+oGB27Yfpc4hmzwJ6KdTyJNi5FuraCNFMG5E2YcclhFrOIqLvOGIGS5B4R0XhuUh/mOkGwM3+Mbj15wA/wr/+O8y/eBvzLw1Q9ePFy30EcHDtdw4eLR+dmfaCEcvarhLgbwjtZgFViBkoRMJtNVK/ysSbD7Zh67dpTxHBDT9x4aOzn3fmJuT7rkGSeQHSnBrIcq9iZm4t1WXMyr6A5z6oxfN/aXMJ5wHso8ggqKUey8019BieQri9CvGDKiTcykPK0PtIv/c2tj5MGgt4jBAC+Pz1G0hzr0GUfQ3iPAaSvXpIVQbI1M2YqTZilroJs1VazN5Xj9l7ruA5VS3m1XQ4LYEJi5p0CDFdxkrz5wjt/BgbesoR2VuITTd3IvnuNqQNb8Hv7idh28MYCII1/6HwnzDv1BC8Mr+A965GiPJbID7QAcmhbkgLrZAVWTGTalaxFfLiLsgPmyE/ZIBcVQ953iU8f47vhk+jmQ4lPQH0WGKoxfK281jdUY2InlIoHfl4dSAbiYPv4Y2hLXjrXhIyHsRDsOz6I8w/+xAzsurhlWeEcF87RGorxAV2SAp7IS3ug6zEgZllDsyiml1OVWbHnFIr5hxuxRy1FvLdNXih1kinog6LdPXw119BSPNZvNT6KVa3H0OEVY1o+y7EO97H6zfTkXonBelDCXhrWAlBwKXvIdrTAs88E7z2dUGo7oH3B70QFTggPuyApOgGpCU3ICvtJ0Q/ZpX3E6IXc4/YMKe8B/KSdsjVeswtuA4fhgVcJ0ANlho/w0umarzSVgmFVQWlPZcA27F5YAtSbqUg7XYcD3jxTw8wfVcbPPd2YYbKBi91L4QHqQ71/S+imEdI85rw6/cuuDxG8gMazLtQhwDdOQTpzyCk6ROsNFUhtLUQEV05iLTkINb+Dl7rT0Hyzc0c4M270RDIS/vgkdeJ6fk2eKrsmHHAziG8RhDeBQQp5BGSHQyE6wtcwkfHCx9fRYD2NAFOY5nhBFYai7DaVIjwjmxEdmdBaduKBHsikm7EIXVQifRbkRDIihyYtscKj702TN9nh+d+HjHDGZGjhzC8AN5RR8YFBPyZBXyK4MZKLNcX4+XmQqxtyUaYKQuKjgxEd6chzpqE1xyxeN2hQPpgGART8yyYSoBpe3vgkd9DiB4O4TkWccAGYWQJhZdDpDw+PoA5iUBtNQEqCHAYLzftR6ghiwBboTCnQNmdjFdt8dQFJZJ61yHFEQrBlF0E2G0jhM0VwS4Ji9haC6GCAMpjEMVUjQ+oL8MSTSWWNR6iOohX9JlYY8xEWEsGNrQkI6o9CcqOOCTYFEiwrkeSfQ0Ek3dZMSXP6hYxfQThFXMU3hsrIIo9Ae+4areAgIYKBNSX0mlaSOeKCisa92CVbjtC9W8jzJDMA1qVUJojEdsRjkTrWv4+k3daMR7Cg+1Ebhu8FMU0+w8honBRfDWkStd/LgLqCglQjKD6/VjG7MEKZjtWNb6DUF0a1jYlI7x5EyJN0VC2KxBDgCc/nJRjweTcp4gpzp3YQYdTZBm8qfWi+D9SfcRBxmQ/GUHX8xFcl4+l9TsIkEmADAK8gd/qEhFuiMYGYzSiWhROv83pxiS2C86I3SyCHs2MGghp57Pt58I5AEFi3SPYsfz6NqxoeBcrmTSs1mzGGu0mrGuMG/d6waSdFg4xaSwij0d4ZBkg3PgHVwC7HDEnxr/pLxpcF1iExQUxbYeJOlAObzcAMX0nVtLSRH84YYgsogjS8MNurs+2QOCE4CF0BkRX0B44PmYPjAHQ3hDT2SAmhDj6GMRRlS43F0eUQrqhhKoYMrbCi1yu4QHUCXeI6ekX4R19lEJP8gh3AHpKJASQbDxKVQlJVAWkkUeoyiFVlEHKIiJKCFAE2Tp3AHawgBzXTkzJNkMYc4yWoYpf+/8LUDxO+OjgOuGEoPLIuEZdqOQ3YyyLeAYALYNznPvBdYLvxliEZ+o5finYMyH2JAGqJggohWRD6QTDRwfbiZFuuHSCAkQUKI5hg/lwMb0n3AIU5ZBFlP3C8LFjbCdGDqwpO8yYkXoeIno/iKkjYgplP/lgKvb7yApIKNz5ds8+2LOCheQ8PTWn5nbB4/fN9Lb8EsJ3GyDLZDA3qw6/Svt8wsH/BVMnXngLBqnCAAAAAElFTkSuQmCC30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1794502983559,"unified_at":"2026-11-12T17:03:03.559Z","metadata":{"hashes":{"sha256":"143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","sha1":"fefaa185a70ff0015dc0aba0e4117ec3fe6e4bcd","md5":"d026063e202d04ab2392cab2816e2857","sha512":"3a56cc2dc32ec0edb22fd13ffb4fb56b24346d9fb3ce9fe06cafade72ac0ac34a274a6b6bdc4d04215ccfeca71442aa9613a399d2af97d02e93a76f44dd644c6","ssdeep":"48:ImMqPpV4qGLxlUVljkBFeYABxbgg+BEpuwkHbpx0lmnnBz:S24pxlUVxkBO/gLBbH4q","ssdeep_chunks":["48:ImMqPpV","48:mMqPpV4","48:MqPpV4q","48:qPpV4qG","48:PpV4qGL","48:pV4qGLx","48:V4qGLxl","48:4qGLxlU","48:qGLxlUV","48:GLxlUVl","48:LxlUVlj","48:xlUVljk","48:lUVljkB","48:UVljkBF","48:VljkBFe","48:ljkBFeY","48:jkBFeYA","48:kBFeYAB","48:BFeYABx","48:FeYABxb","48:eYABxbg","48:YABxbgg","48:ABxbgg+","48:Bxbgg+B","48:xbgg+BE","48:bgg+BEp","48:gg+BEpu","48:g+BEpuw","48:+BEpuwk","48:BEpuwkH","48:EpuwkHb","48:puwkHbp","48:uwkHbpx","48:wkHbpx0","48:kHbpx0l","48:Hbpx0lm","48:bpx0lmn","48:px0lmnn","48:x0lmnnB","48:0lmnnBz","96:ImMqPpV","96:mMqPpV4","96:MqPpV4q","96:qPpV4qG","96:PpV4qGL","96:pV4qGLx","96:V4qGLxl","96:4qGLxlU","96:qGLxlUV","96:GLxlUVl","96:LxlUVlj","96:xlUVljk","96:lUVljkB","96:UVljkBF","96:VljkBFe","96:ljkBFeY","96:jkBFeYA","96:kBFeYAB","96:BFeYABx","96:FeYABxb","96:eYABxbg","96:YABxbgg","96:ABxbgg+","96:Bxbgg+B","96:xbgg+BE","96:bgg+BEp","96:gg+BEpu","96:g+BEpuw","96:+BEpuwk","96:BEpuwkH","96:EpuwkHb","96:puwkHbp","96:uwkHbpx","96:wkHbpx0","96:kHbpx0l","96:Hbpx0lm","96:bpx0lmn","96:px0lmnn","96:x0lmnnB","96:0lmnnBz","48:S24pxlU","48:24pxlUV","48:4pxlUVx","48:pxlUVxk","48:xlUVxkB","48:lUVxkBO","48:UVxkBO/","48:VxkBO/g","48:xkBO/gL","48:kBO/gLB","48:BO/gLBb","48:O/gLBbH","48:/gLBbH4","48:gLBbH4q"],"imphash":"Unknown"},"file_info":{"file_name":"Factuur_261011367.html","file_type":["html"],"file_type_id":"html","file_size":3366,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794500887000,"last_seen":1794500887000,"last_multi_scan":1794500887000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["malicious"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":24,"suspicious_count":1,"malicious_count":1,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a web server"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Identifies external resources in HTML content"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"tactic":"Stealth","technique":"HTML Smuggling","attack_id":"T1027.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/006","identifiers":[{"type":"informative","value":"High entropy HTML file"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@druckdiscount24.de\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"http://www.youtube.com/user/wwwdruckdiscount24
Xing:\" (Indicator: \"youtube\"; Source: \"sample.bin\"), Found string \"https://www.facebook.com/Druckdiscount24
YouTube:\" (Indicator: \"facebook.com\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"http://www.youtube.com/user/wwwdruckdiscount24
Xing:\" (Indicator: \"youtube.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.youtube.com/user/wwwdruckdiscount24\", Pattern match: \"www.druckdiscount24.de/newsletter\", Pattern match: \"https://www.druckdiscount24.de/agb\", Pattern match: \"http://www.haeuserdruck.de\", Pattern match: \"https://www.facebook.com/druckdiscount24\", Pattern match: \"https://www.trustedshops.com/bewertung/bewerten_x278761d4e50612545c1e8ae5b0c554b4.html\", Pattern match: \"http://www.xing.com/companies/buch-undoffsetdruckereih\", Pattern match: \"http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd\", Pattern match: \"https://www.druckdiscount24.de\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.druckdiscount24.de\", Found HTTPS url \"https://www.facebook.com\", Found HTTPS url \"https://www.trustedshops.com\", Found HTTPS url \"https://nvprofessional.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"chrome.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"chrome.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED packet out of window\" (SID: 2210020, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM ESTABLISHED invalid ack\" (SID: 2210029, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM Packet with invalid ack\" (SID: 2210045, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN invalid ack\" (SID: 2210030, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA STREAM FIN out of window\" (SID: 2210038, Rev: 3, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/26 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.google.com\"\n \"nvprofessional.com\"\n \"www.nvprofessional.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.251.153.120:443\"\n \"142.251.211.110:80\"\n \"142.250.190.238:443\"\n \"142.251.156.119:443\"\n \"142.251.16.84:443\"\n \"74.208.236.230:443\"\n \"142.250.188.1:443\"\n \"142.251.179.188:5228\"\n \"142.250.68.206:443\"\n \"172.217.113.4:443\"\n \"142.251.211.110:443\"\n \"172.217.117.4:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"android.clients.google.com\"\n \"chromewebstore.googleapis.com\"\n \"clients1.google.com\"\n \"clients2.google.com\"\n \"clients2.googleusercontent.com\"\n \"clientservices.googleapis.com\"\n \"mtalk.google.com\"\n \"nvprofessional.com\"\n \"optimizationguide-pa.googleapis.com\"\n \"www.google.com\"\n \"www.gstatic.com\"\n \"www.nvprofessional.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$37","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpwww.youtube.comuserwwwdruckdiscount24\" has type \"HTML document ASCII text with very long lines (55710)\"- [targetUID: 00000000-00003576]\n \"urlref_httpswww.druckdiscount24.deAGB\" has type \"HTML document Unicode text UTF-8 text with very long lines (951) with CRLF LF line terminators\"- [targetUID: 00000000-00003576]\n \"urlref_httpswww.trustedshops.combewertungbewerten_X278761D4E50612545C1E8AE5B0C554B4.html\" has type \"HTML document ASCII text with very long lines (21095)\"- [targetUID: 00000000-00003576]\n \"urlref_httpswww.facebook.comDruckdiscount24\" has type \"HTML document ASCII text with very long lines (2468)\"- [targetUID: 00000000-00003576]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /async/folae?async=_fmt:pb\"\n Found http requests in header \"GET /?u=6eiczcdsc7eg22i2sj2d56a\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.211.110 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"nvprofessional.com\" has high entropy\n Contacted domain: \"www.nvprofessional.com\" has high entropy\n Contacted domain: \"android.clients.google.com\" has high entropy\n Contacted domain: \"chromewebstore.googleapis.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy\n Contacted domain: \"clientservices.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"accounts.google.com\" (9 days old)\n Newly renewed or created SSL certificate: \"mtalk.google.com\" (9 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"android.clients.google.com\" (83 days old)\n Short term registered certificate: \"chromewebstore.googleapis.com\" (83 days old)\n Short term registered certificate: \"clients1.google.com\" (83 days old)\n Short term registered certificate: \"clients2.google.com\" (83 days old)\n Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"clientservices.googleapis.com\" (83 days old)\n Short term registered certificate: \"mtalk.google.com\" (83 days old)\n Short term registered certificate: \"optimizationguide-pa.googleapis.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)\n Short term registered certificate: \"www.gstatic.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.153.120\" on port \"443\"\n HTTPS traffic to \"142.250.190.238\" on port \"443\"\n HTTPS traffic to \"142.251.156.119\" on port \"443\"\n HTTPS traffic to \"142.251.16.84\" on port \"443\"\n HTTPS traffic to \"74.208.236.230\" on port \"443\"\n HTTPS traffic to \"142.250.188.1\" on port \"443\"\n HTTPS traffic to \"142.250.68.206\" on port \"443\"\n HTTPS traffic to \"172.217.113.4\" on port \"443\"\n HTTPS traffic to \"142.251.211.110\" on port \"443\"\n HTTPS traffic to \"172.217.117.4\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Pattern Matching","name":"Identifies external resources in HTML content","description":"External resources discovered in HTML content:\nnvprofessional.com | script | src","origin":"Binary File","mitre_attack_id":"T1071.001","relevance":3,"id":"binary-8602","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"file/memory contains long string with (Indicator: \"--user-data-dir\"; File: \"chrome.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"informative","category":"Unusual Characteristics","name":"High entropy HTML file","description":"Sample file \"urlref_httpwww.youtube.comuserwwwdruckdiscount24\" has high entropy 5.39577\n Sample file \"urlref_httpswww.trustedshops.combewertungbewerten_X278761D4E50612545C1E8AE5B0C554B4.html\" has high entropy 6.11887\n Sample file \"urlref_httpswww.facebook.comDruckdiscount24\" has high entropy 5.20463\n Sample file \"sample.bin\" has high entropy 5.49605","origin":"Binary File","mitre_attack_id":"T1027.006","relevance":5,"id":"binary-78","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"suspicious","category":"General","name":"GETs files from a web server","description":"$38","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"nvprofessional.com\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 13 domains and 13 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:android.clients.google.com":{"type":"Domain","value":"android.clients.google.com"},"Domain:chromewebstore.googleapis.com":{"type":"Domain","value":"chromewebstore.googleapis.com"},"Domain:clients1.google.com":{"type":"Domain","value":"clients1.google.com"},"Domain:clients2.google.com":{"type":"Domain","value":"clients2.google.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:clientservices.googleapis.com":{"type":"Domain","value":"clientservices.googleapis.com"},"Domain:mtalk.google.com":{"type":"Domain","value":"mtalk.google.com"},"Domain:nvprofessional.com":{"type":"Domain","value":"nvprofessional.com"},"Domain:optimizationguide-pa.googleapis.com":{"type":"Domain","value":"optimizationguide-pa.googleapis.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.gstatic.com":{"type":"Domain","value":"www.gstatic.com"},"Domain:www.nvprofessional.com":{"type":"Domain","value":"www.nvprofessional.com"},"File:13be0b5a114ead4d5920e8a19d6e3fdfbd77a8bddc6163b37411a7a5cd29d62f":{"type":"File","value":"13be0b5a114ead4d5920e8a19d6e3fdfbd77a8bddc6163b37411a7a5cd29d62f"},"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8":{"type":"File","value":"143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8"},"File:39d8c5c0f058e47d187c76b1b1b989b16b75132a9a9575596385a8e51cdcf1ff":{"type":"File","value":"39d8c5c0f058e47d187c76b1b1b989b16b75132a9a9575596385a8e51cdcf1ff"},"File:46dbd42e45cf861976a09e723accc313a493a91a1d812e74a3d811f68cd8891b":{"type":"File","value":"46dbd42e45cf861976a09e723accc313a493a91a1d812e74a3d811f68cd8891b"},"File:5c038d8577a715f17f7365a109cba77b800d308d20ecad33a840531211aff3e4":{"type":"File","value":"5c038d8577a715f17f7365a109cba77b800d308d20ecad33a840531211aff3e4"},"Ip:142.250.188.1":{"type":"Ip","value":"142.250.188.1"},"Ip:142.250.190.238":{"type":"Ip","value":"142.250.190.238"},"Ip:142.250.68.206":{"type":"Ip","value":"142.250.68.206"},"Ip:142.251.153.120":{"type":"Ip","value":"142.251.153.120"},"Ip:142.251.156.119":{"type":"Ip","value":"142.251.156.119"},"Ip:142.251.16.84":{"type":"Ip","value":"142.251.16.84"},"Ip:142.251.179.188":{"type":"Ip","value":"142.251.179.188"},"Ip:142.251.211.110":{"type":"Ip","value":"142.251.211.110"},"Ip:142.251.211.174":{"type":"Ip","value":"142.251.211.174"},"Ip:172.217.113.4":{"type":"Ip","value":"172.217.113.4"},"Ip:172.217.117.4":{"type":"Ip","value":"172.217.117.4"},"Ip:74.208.236.230":{"type":"Ip","value":"74.208.236.230"},"Url:/?u=6eiczcdsc7eg22i2sj2d56a":{"type":"Url","value":"/?u=6eiczcdsc7eg22i2sj2d56a"},"Url:/async/folae?async=_fmt:pb":{"type":"Url","value":"/async/folae?async=_fmt:pb"}},"chains":[{"id":"sandbox_network","root":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","edges":[{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.153.120"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.211.110"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.250.190.238"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.16.84"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:74.208.236.230"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.250.188.1"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.179.188"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.250.68.206"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:142.251.211.110"},{"edge_kind":"contacted_ip","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Ip:172.217.117.4"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.251.16.84"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:android.clients.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:android.clients.google.com","to_key":"Ip:142.251.211.174"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:chromewebstore.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:chromewebstore.googleapis.com","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:clients1.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients1.google.com","to_key":"Ip:142.251.211.110"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:clients2.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.google.com","to_key":"Ip:142.251.211.110"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.250.188.1"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:clientservices.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:clientservices.googleapis.com","to_key":"Ip:142.250.190.238"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:mtalk.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:mtalk.google.com","to_key":"Ip:142.251.179.188"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:nvprofessional.com"},{"edge_kind":"resolves_to","from_key":"Domain:nvprofessional.com","to_key":"Ip:74.208.236.230"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:optimizationguide-pa.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:optimizationguide-pa.googleapis.com","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.156.119"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:www.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.gstatic.com","to_key":"Ip:142.251.153.120"},{"edge_kind":"contacted_domain","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Domain:www.nvprofessional.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.nvprofessional.com","to_key":"Ip:74.208.236.230"},{"edge_kind":"contacted_url","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Url:/async/folae?async=_fmt:pb"},{"edge_kind":"contacted_url","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"Url:/?u=6eiczcdsc7eg22i2sj2d56a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","edges":[{"edge_kind":"extracted","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"File:46dbd42e45cf861976a09e723accc313a493a91a1d812e74a3d811f68cd8891b"},{"edge_kind":"extracted","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"File:13be0b5a114ead4d5920e8a19d6e3fdfbd77a8bddc6163b37411a7a5cd29d62f"},{"edge_kind":"extracted","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"File:5c038d8577a715f17f7365a109cba77b800d308d20ecad33a840531211aff3e4"},{"edge_kind":"extracted","from_key":"File:143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8","to_key":"File:39d8c5c0f058e47d187c76b1b1b989b16b75132a9a9575596385a8e51cdcf1ff"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":27,"spawned_processes_count":27,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":206,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":12,"dns_resolutions_count":13,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["malicious"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6af5e917aa687bec1207d2f7","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"contacted_countries":["USA"],"submit_name":"Factuur_261011367.html","analysis_start_time":"2026-11-12T16:28:08+00:00","indicators_count":{"informative":23,"suspicious":1,"malicious":1},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.251.153.120","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.251.211.110","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.250.190.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.251.156.119","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.251.16.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"74.208.236.230","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.250.188.1","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.251.179.188","port":5228,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.250.68.206","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"172.217.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"142.251.211.110","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"address":"172.217.117.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.16.84","ttl":131,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"android.clients.google.com","address":"142.251.211.174","ttl":235,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"chromewebstore.googleapis.com","address":"172.217.113.4","ttl":74,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"clients1.google.com","address":"142.251.211.110","ttl":288,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"clients2.google.com","address":"142.251.211.110","ttl":129,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"clients2.googleusercontent.com","address":"142.250.188.1","ttl":240,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"clientservices.googleapis.com","address":"142.250.190.238","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"mtalk.google.com","address":"142.251.179.188","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"nvprofessional.com","address":"74.208.236.230","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"optimizationguide-pa.googleapis.com","address":"172.217.113.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"www.google.com","address":"142.251.156.119","ttl":25,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"www.gstatic.com","address":"142.251.153.120","ttl":180,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"domain":"www.nvprofessional.com","address":"74.208.236.230","ttl":3600,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"http_requests":[{"host":"www.google.com","host_ip":"142.251.156.119:443","url":"/async/folae?async=_fmt:pb","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /async/folae?async=_fmt:pb HTTP/2\nHost: www.google.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nCookie: NID=534=GKYE-RDskTC8LPVay5-IVdoaY2cxRYeInQPPZ8S5DoikEUiJpDmtmqkHwf8t9stcL5BTVxVN4rX6CF8ACUA2gvkYH7uO0q2kTuFbXrGLjRR1Ke_s8Gx80ZvnCU7_YRD0MZrVNo4ijPzGwOw7wFCXf0W9d5m9j-bJ3w3T0-zMPC8IKakv79jqU1UeFkizD8HSmWAxbTqJ9JTvhoRsUycFc9Ht5HQ1JDPKVHHUr9RI8KRlTfSTNEjVSiW-gKl66z6tatkg4wVwJQ\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"host":"nvprofessional.com","host_ip":"74.208.236.230:443","url":"/?u=6eiczcdsc7eg22i2sj2d56a","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /?u=6eiczcdsc7eg22i2sj2d56a HTTP/2\nHost: nvprofessional.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Ch-Ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"\nSec-Ch-Ua-Mobile: ?0\nSec-Fetch-Site: cross-site\nAccept-Language: en-US,en;q=0.9\nSec-Ch-Ua-Platform: \"Windows\"\nPriority: u=1\nAccept-Encoding: gzip, deflate, br, zstd\nAccept: */*\nSec-Fetch-Dest: script","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}],"processes":[{"pid":3576,"ppid":0,"name":"chrome.exe","command_line":"--single-argument C:\\Factuur_261011367.html","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","uid":"00000000-00003576","icon":"$39"},{"pid":6156,"ppid":3576,"name":"chrome.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Google\\Chrome\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Crashpad\" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=145.0.7632.75 --initial-client-data=0x148,0x14c,0x150,0x128,0x154,0x7ffefbca00a8,0x7ffefbca00b4,0x7ffefbca00c0","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00006156"},{"pid":5100,"ppid":3576,"name":"chrome.exe","command_line":"--type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,7705892007215100060,9170263409319045064,262144 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1900 /prefetch:2","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00005100"},{"pid":3256,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=2072,i,5794897241161476593,3117746712704708553,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2088 /prefetch:11","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00003256"},{"pid":7200,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=2224,i,16322852433644797549,9887312586957025921,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2712 /prefetch:13","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00007200"},{"pid":5408,"ppid":3576,"name":"chrome.exe","command_line":"--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1794498088699967 --launch-time-ticks=2827149707 --metrics-shmem-handle=3260,i,15588008182277824419,5965521427308645508,2097152 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3288 /prefetch:1","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00005408"},{"pid":7628,"ppid":3576,"name":"chrome.exe","command_line":"--type=renderer --no-pre-read-main-dll --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1794498088699967 --launch-time-ticks=2827147045 --metrics-shmem-handle=3244,i,9662426789983162254,15071715805123386671,2097152 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3248 /prefetch:1","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00007628"},{"pid":2812,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5220,i,7522246761159701899,15464426311012705327,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5224 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00002812"},{"pid":8056,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5412,i,1855881548860547295,9073039345383529564,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5440 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00008056"},{"pid":2532,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5260,i,13479985345763727149,3082939495510935867,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5100 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00002532"},{"pid":3156,"ppid":3576,"name":"chrome.exe","command_line":"--type=renderer --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1794498088699967 --launch-time-ticks=2839164700 --metrics-shmem-handle=5048,i,12866938822558822207,2415338582929600029,2097152 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5276 /prefetch:9","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00003156"},{"pid":4776,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5836,i,6659193606644854820,10997303107331623016,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5840 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00004776"},{"pid":4076,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5096,i,7020438578412103513,10787763228474830934,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5848 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00004076"},{"pid":1076,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5944,i,16156115686512231339,17627963434460817148,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5864 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00001076"},{"pid":5124,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5896,i,16775534271199908976,6216304258736624523,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=5872 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00005124"},{"pid":3804,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5992,i,16337841357598593464,1035729377157126121,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5996 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00003804"},{"pid":5808,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=6128,i,14954588791807342055,13562054785975037587,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5984 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00005808"},{"pid":8008,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5916,i,7152769443546038735,848104872985646737,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5860 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00008008"},{"pid":1928,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=6248,i,9659115796898687795,17725515625409067415,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5900 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00001928"},{"pid":4036,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=6240,i,9443254971339425337,16747763183687559172,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6312 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00004036"},{"pid":2384,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=6448,i,13031371033238229763,16629829301801783801,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=6264 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00002384"},{"pid":5708,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --metrics-shmem-handle=5836,i,7947163029285524231,6454662947113349104,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709005989750323 --mojo-platform-channel-handle=6452 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00005708"},{"pid":1640,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=6412,i,17732306719387389909,2021664735702462166,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709006926792172 --mojo-platform-channel-handle=6316 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00001640"},{"pid":4840,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=6388,i,10273311163833668962,9744202486494537548,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=6188 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00004840"},{"pid":7140,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5972,i,17240551672035475189,9116399120423889704,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=6272 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00007140"},{"pid":7824,"ppid":3576,"name":"chrome.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22621.1194 --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5756,i,16468980971097803799,7171779515208878969,262144 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709009737917719 --mojo-platform-channel-handle=5740 /prefetch:10","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00007824"},{"pid":3888,"ppid":3576,"name":"chrome.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --metrics-shmem-handle=5788,i,963559693206650487,15742721262526807974,524288 --field-trial-handle=1948,i,15982819297409956563,12010901860633984801,262144 --variations-seed-version=20260827-010038.268000-production --trace-process-track-uuid=3190709010674959568 --mojo-platform-channel-handle=3864 /prefetch:14","sha256":"7ad24ac1cd935701492f557b34a662a5edf6f6ba3d52e9b2b3d6c1de51695f89","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00003576","uid":"00000000-00003888"}],"all_imported_dlls":["msvcp_win.dll","netutils.dll","cryptsp.dll","wininet.dll","sspicli.dll","kernel32.dll","shell32.dll","devobj.dll","mfplat.dll","KernelBase.dll","gdi32.dll","TextInputFramework.dll","dcomp.dll","rpcrt4.dll","WinTypes.dll","ResourcePolicyClient.dll","winnsi.dll","bcryptprimitives.dll","gdi32full.dll","ExplorerFrame.dll","DXCore.dll","urlmon.dll","powrprof.dll","netapi32.dll","Windows.UI.dll","OnDemandConnRouteHelper.dll","omadmapi.dll","windows.storage.dll","combase.dll","msctf.dll","OneCoreUAPCommonProxyStub.dll","dwmapi.dll","Windows.StateRepositoryCore.dll","usermgrcli.dll","SHCore.dll","msasn1.dll","InputHost.dll","vk_swiftshader.dll","mfcore.dll","wbemcomn.dll","MpOAV.dll","advapi32.dll","wpnapps.dll","cryptngc.dll","optimization_guide_internal.dll","libGLESv2.dll","wbemsvc.dll","msvcrt.dll","fwbase.dll","PCPKsp.dll","BitsProxy.dll","d3dcompiler_47.dll","rasadhlp.dll","dhcpcsvc6.dll","winsta.dll","twinapi.dll","npmproxy.dll","Windows.StateRepositoryPS.dll","wkscli.dll","ncrypt.dll","CapabilityAccessManagerClient.dll","UserMgrProxy.dll","ntdll.dll","chrome_elf.dll","gpapi.dll","cryptbase.dll","apphelp.dll","imm32.dll","linkinfo.dll","rsaenh.dll","comctl32.dll","ws2_32.dll","winmm.dll","winhttp.dll","fastprox.dll","D3DSCache.dll","user32.dll","DWrite.dll","userenv.dll","shdocvw.dll","dsreg.dll","dnsapi.dll","atlthunk.dll","dxgi.dll","directxdatabasehelper.dll","AcLayers.dll","cfgmgr32.dll","FirewallAPI.dll","DataExchange.dll","FWPUCLNT.DLL","directml.dll","ntmarta.dll","secur32.dll","wintrust.dll","mobilenetworking.dll","msvcp110_win.dll","pfclient.dll","ncryptprov.dll","coml2.dll","win32u.dll","ole32.dll","clbcatq.dll","oleacc.dll","CoreUIComponents.dll","netprofm.dll","amsi.dll","dxilconv.dll","kernel.appcore.dll","setupapi.dll","Windows.FileExplorer.Common.dll","libEGL.dll","d3d10warp.dll","ucrtbase.dll","Windows.UI.Immersive.dll","sxs.dll","Windows.ApplicationModel.dll","tbs.dll","RTWorkQ.dll","wbemprox.dll","nsi.dll","shlwapi.dll","sechost.dll","d3d11.dll","iertutil.dll","dhcpcsvc.dll","bcrypt.dll","mf.dll","dxil.dll","srvcli.dll","D3D12.dll","dpapi.dll","nlansp_c.dll","IPHLPAPI.DLL","Windows.Media.dll","Windows.System.Launcher.dll","mswsock.dll","D3D12Core.dll","KBDUS.DLL","dxcompiler.dll","UdvUU988.dll","uxtheme.dll","wtsapi32.dll","mscms.dll","ngcksp.dll","twinapi.appcore.dll","directmanipulation.dll","oleaut32.dll","pdh.dll","perfos.dll","chrome.dll","propsys.dll","wlanapi.dll","MpClient.dll","version.dll","crypt32.dll","profapi.dll","MMDevAPI.dll","CryptoWinRT.dll","CoreMessaging.dll","mdmregistration.dll","umpdc.dll","webauthn.dll","ntasn1.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpwww.youtube.comuserwwwdruckdiscount24","sha256":"46dbd42e45cf861976a09e723accc313a493a91a1d812e74a3d811f68cd8891b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"urlref_httpswww.druckdiscount24.deAGB","sha256":"13be0b5a114ead4d5920e8a19d6e3fdfbd77a8bddc6163b37411a7a5cd29d62f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"urlref_httpswww.trustedshops.combewertungbewerten_X278761D4E50612545C1E8AE5B0C554B4.html","sha256":"5c038d8577a715f17f7365a109cba77b800d308d20ecad33a840531211aff3e4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"urlref_httpswww.facebook.comDruckdiscount24","sha256":"39d8c5c0f058e47d187c76b1b1b989b16b75132a9a9575596385a8e51cdcf1ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"files_written":[{"path":"pipe\\crashpad_3576_CDCDAVPCEDWBRVGF","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E122B924-B4ED-4437-BC94-A96B6AA901B6}","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{45F5205B-FA7A-11ED-8886-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.15207257066468381168","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.12308723667188432288","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.8768605052975665821","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.4006643613721380024","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.2104.8451021378873904661","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.5073182321220952730","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.17477511866124138183","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.4680603872945836362","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.6882014879785044178","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.9389900376224609365","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.2251525282653813014","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.2104.13559693834019336699","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.6477584783942635359","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.10100375170237267548","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.5577706779134961944","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.202460955446491146","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.14129903535444178312","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.11727863172773327152","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.15855467487487660046","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.2927660489441178990","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.4989466385561889761","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.698870002969438277","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.14340271926382197500","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.16452608486255347849","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.2637023564492379039","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3576.6688.15939335177115753028","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.5408.4732.7544347777621577790","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.7628.1128.316792402574787445","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"path":"pipe\\LOCAL\\mojo.3156.924.17871420063734058341","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Data_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for Oracle_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Data Provider for SqlServer_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NET Memory Cache 4.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\.NETFramework_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_2.0.50727_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_4.0.30319_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\aspnet_state_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BITS_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ESENT_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\LSM_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Outlook_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfDisk_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfNet_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfOS_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\PerfProc_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\rdyboost_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RemoteAccess_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Spooler_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TapiSrv_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Tcpip_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\TermService_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGatherer_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UGTHRSVC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\usbhub_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\W3SVC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WmiApRpl_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\WSearchIdxPi_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:3576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ASP.NET_2.0.50727_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:3576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"W3SVC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"MSDTC Bridge 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ASP_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"MSDTC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"rdyboost_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"TermService_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"PerfDisk_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"PerfProc_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET Data Provider for SqlServer_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET CLR Networking_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ESENT_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Windows Workflow Foundation 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ServiceModelOperation 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"LSM_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Tcpip_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"BITS_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"PerfNet_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SMSvcHost 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"TapiSrv_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ASP.NET_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"usbhub_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"RemoteAccess_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SMSvcHost 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"MSDTC Bridge 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"UGatherer_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Spooler_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET Memory Cache 4.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET Data Provider for Oracle_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ServiceModelService 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"PerfOS_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Outlook_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"UGTHRSVC_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET CLR Networking 4.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ServiceModelEndpoint 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"aspnet_state_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ASP.NET_64_2.0.50727_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"ASP.NET_4.0.30319_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NET CLR Data_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"WSearchIdxPi_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"WmiApRpl_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":".NETFramework_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Windows Workflow Foundation 3.0.0.0_Perf_Library_Lock_PID_df8","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3576:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3576:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Microsoft.Windows.Health.TestInProduction.RegistryStore.AggregateResults","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutexf01b4d95cf55d32a.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5f7b5f1e01b83767.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Mutex5a2098e080cf7ac4.automaticDestinations-ms","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__OMADM_NAMED_MUTEX__","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{A946A6A9-917E-4949-B9BC-6BADA8C7FD63}","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:6156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:6156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5100:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:5100:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:5100:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:3256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:7200:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:7628:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:2812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:2812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:8056:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:2532:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:4776:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:4776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:4776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4776:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:4076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:4076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:4076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:1076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:1076:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1076:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:3804:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:5808:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5808:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:1928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:1928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:1928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:1928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1928:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:2384:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5708:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:5708:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:5708:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5708:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:1640:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:4840:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:7140:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7824:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"Local\\SM0:7824:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:7824:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]},{"name":"SM0:3888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6af5e917aa687bec1207d2f7"}]}]}},"report_ids":{"sandbox_job_ids":["6af5e917aa687bec1207d2f7"]}}}]]}] 2c:[["$","title","0",{"children":"Suspicious Sample 143f262b1a6b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 143f262b1a6b…. Threat score 35/100. 0/26 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 143f262b1a6b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 143f262b1a6b…. Threat score 35/100. 0/26 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/143f262b1a6bcf4a5ec07737396b613d9c700bfa41286da367c9580fe5d71bc8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 143f262b1a6b… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 143f262b1a6b…. Threat score 35/100. 0/26 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null