24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 1d82b6683c5a… — Score 55/100 — Hybrid Analysis","description":"Suspicious verdict for sample 1d82b6683c5a…. Threat score 55/100. 0/5 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047"],"about":{"@type":"SoftwareApplication","name":"http://buildertrend.net/","applicationCategory":["url"],"identifier":"1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047","additionalType":"Suspicious sample"},"threatScore":55,"antivirusDetections":{"malicious":0,"total":5},"behavioralIndicators":{"malicious":0,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T472,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2200" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_898_IE_EarlyTabStart_0x6b4_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_898_ConnHashTable<2200>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_898_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_898_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\InternetShortcutMutex" "Local\URLBLOCK_DOWNLOAD_MUTEX" "IsoScope_898_ConnHashTable<2200>_HashTable_Mutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "UpdatingNewTabPageData" "IsoScope_898_IESQMMUTEX_0_331" "IsoScope_898_IESQMMUTEX_0_519"26:T626,"buildertrend-logo-stacked--white-2color_1_.svg" has type "SVG Scalable Vector Graphics image" "urlblockindex_1_.bin" has type "data" "rootMasterWebforms.chunk.19fdd9f9519487a934e0_1_.js" has type "UTF-8 Unicode text with very long lines with no line terminators" "multiSelect_1_.js" has type "HTML document ASCII text with very long lines with no line terminators" "N7TT8SFA.txt" has type "ASCII text" "~DF391CF9FBD68B69C9.TMP" has type "data" "toastNotifications.chunk.4d4838805e2258325ecf_1_.css" has type "ASCII text with very long lines with no line terminators" "WEKPX6WE.txt" has type "ASCII text" "sdk_1_.js" has type "ASCII text with very long lines" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "5PGAM912.txt" has type "ASCII text" "1BjrYUERys4_1_.js" has type "ASCII text with very long lines" "vendor.chunk.98a00881fca481ab3b68_1_.css" has type "ASCII text with very long lines with CRLF LF line terminators" "page_1_.htm" has type "HTML document ASCII text with very long lines" "mem5YaGs126MiZpBA-UN_r8OUuhv_1_.woff" has type "Web Open Font Format flavor 65536 length 18668 version 1.1" "commons.chunk.f9994361223eed614f74_1_.css" has type "ASCII text with very long lines" "BE8B021F9E811DFC8C8A28572A17C05A_C0A4BFC0819758DD30694E95FB55AB17" has type "data" "fontawesome-webfont_1_.eot" has type "Embedded OpenType (EOT)" "toastNotifications.chunk.e43ef6e843bd4607a438_1_.js" has type "ASCII text with very long lines" "EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D" has type "data"27:T6843,Pattern match: "http://buildertrend.net/" Pattern match: "http://buildertrend.net" Heuristic match: "buildertrend.net" Heuristic match: "ocsp.godaddy.com" Heuristic match: "GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Heuristic match: "GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Heuristic match: "GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQD%2FXWF%2F1kzxeA%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.godaddy.com" Heuristic match: "cdn.appdynamics.com" Heuristic match: "col.eum-appdynamics.com" Heuristic match: "connect.facebook.net" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "js.appcenter.intuit.com" Heuristic match: "scontent-ort2-2.xx.fbcdn.net" Heuristic match: "static.xx.fbcdn.net" Heuristic match: "staticxx.facebook.com" Heuristic match: "stats.g.doubleclick.net" Pattern match: "www.facebook.com" Pattern match: "www.gstatic.com" Heuristic match: "GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate DNT: 1 Connection: Keep-Alive Host: buildertrend.net" Heuristic match: "d=[]}return e.prototype.add_node=function(e){returnOPTGROUP===e.nodeName.toUpperCase()?this.add_group(e):this.add_option(e)},e.prototype.add_group=function(e){var t,n,i,o,r,s;for(t=this.parsed.length,this.parsed.push({array_index:t,group:!0,label:e.label" Heuristic match: "et):a(e.target).parents(.active-result).first()).length)return this.result_highlight=t,this.result_select(e),this.search_field.focus()},t.prototype.search_results_mouseover=function(e){var t;if(t=a(e.target).hasClass(active-result)?a(e.target):a(e.targ" Heuristic match: "h(off,!0),e.nonEditable||false!=this.attributes.contenteditable?e.nonEditable&&!e.nestedEditable&&true==this.attributes.contenteditable&&t.push(nestedEditable,!0):t.push(nonEditable,!0),t.length){e=CKEDITOR.tools.copy(e);for(var n=0;n tr > th,;.%1 table.%2 > tbody > tr > td, .%1 table.%2 > tbody > tr > th,;.%1 table.%2 > thead > tr > td, .%1 table.%2 > thead > tr > th,;.%1 table.%2 > tfoot > tr > td, .%1 table.%2 > tfoot > tr > th;{;border : #d3d3d3 1px dotted;}.split(;)).jo" Heuristic match: ";table!=t&&tableProperties!=t||((t=(e=e.data.definition).getContents(info).get(txtBorder)).commit=CKEDITOR.tools.override(t.commit,function(i){return function(e,t){i.apply(this,arguments);var n=parseInt(this.getValue(),10);t[!n||n<=0?addClass:re" Pattern match: "svc.webspellchecker.net/spellcheck31/wscbundle/wscbundle.js" Heuristic match: "rapper.on(dragover,function(e){e.data.preventDefault()}),e.wrapper.on(mouseenter,e.updateDragHandlerPosition,e),setTimeout(function(){e.on(data,e.updateDragHandlerPosition,e)},50),!e.inline&&(t.on(mousedown,f,e),CKEDITOR.env.ie&&CKEDITOR.env.versio" Pattern match: "http://export.highcharts.com/,width:800,enableImages:!1,buttons:{exportButton:{symbol:exportIcon,x:-10,symbolFill:#A8BF77,hoverSymbolFill:#768F3E,_id:exportButton,_titleKey:exportButtonTitle,menuItems:[{textKey:downloadPNG,onclick:function(){t" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "www.highcharts.com/errors/+e;if(t)throw" Pattern match: "http://www.w3.org/2000/svg,Oe=!!le.createElementNS&&!!le.createElementNS(Ie,svg).createSVGRect,Me=xe&&parseInt(Ee.split(Firefox/)[1],10)" Pattern match: "http://code.highcharts.com/2.3.5/modules/canvas-tools.js,VMLRadialGradientURL:http://code.highcharts.com/2.3.5/gfx/vml-radial-gradient.png},chart:{borderColor:#4572A7,borderRadius:5,defaultSeriesType:line,ignoreHiddenSeries:!0,spacingTop:10,spacingR" Pattern match: "http://www.highcharts.com,position:{align:right,x:-10,verticalAlign:bottom,y:-5},styl" Pattern match: "http://www.w3.org/1999/xlink,href,e" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "this.len/(e+a||1),this.transB=this.horiz?this.left:this.bottom,this.minPixelPadding=n*s},setTickPositions:function(e){var" Heuristic match: "TickAmounts:function(){!1!==this.options.chart.alignTicks&&et(this.axes,function(e){e.adjustTickAmount()}),this.maxTicks=null},redraw:function(e){var t,n=this.axes,i=this.series,o=this.tracker,r=this.legend,s=this.isDirtyLegend,a=this.isDirtyBox,l=i.length" Heuristic match: "bled||e.scrollbar.enabled)&&(t.scroller=new Highcharts.Scroller(t)),t.tracker=new r(t,e),t.render(),t.renderer.draw(),n&&n.apply(t,[t]),et(t.callbacks,function(e){e.apply(t,[t])}),t.cloneRenderTo(!0),at(t,load))}}).callbacks=[];var yt=function(){};yt.pro" Heuristic match: "s.id+'>+this.p.loadtext+).insertBefore(t),a(this).attr({cellspacing:0,cellpadding:0,border:0,role:grid,aria-multiselectable:!!this.p.multiselect,aria-labelledby:gbox_+this.id});var K=function(e,t){return e=parseInt(e,10),isNaN(e)?t|" Heuristic match: ".treeGrid)for(t in o.p.treeReader)o.p.treeReader.hasOwnProperty(t)&&delete r[o.p.treeReader[t]];void 0!==l&&(o.p.data[l]=a.extend(!0,o.p.data[l],r)),r=null}}catch(e){f=!1}f&&(string===e?a(i).addClass(u):object===e&&a(i).css(u),a(o).triggerHandler(jqGr" Heuristic match: "wnProperty(t)&&delete f.p.postData[t]})}else vvc.extend(f.p.postData,i);f.p.searchurl&&(t=f.p.url,vvc(f).jqGrid(setGridParam,{url:f.p.searchurl}));var l=stop===vvc(f).triggerHandler(jqGridToolbarBeforeClear);!l&&vvc.isFunction(b.beforeClear)&&(l=b.be" Heuristic match: "=this.endMs&&(t=this.endMs-1),t},s.prototype.equals=function(e){return this.startMs===e.startMs&&this.endMs===e.endMs},s.prototype.clone=function(){var e=new s(this.startMs,this.endMs);return e." Heuristic match: "l(this)||this;return e=e||{},t.overflowX=e.overflowX||e.overflow||auto,t.overflowY=e.overflowY||e.overflow||auto,t}return i.__extends(e,n),e.prototype.render=function(){this.el=this.renderEl(),this.applyOverflow()},e.prototype.renderEl=function(){retur" Heuristic match: "Footprint.isAllDay,t,n)},e.prototype._getTimeText=function(e,t,n,i,o){return null==i&&(i=this.eventTimeFormat),null==o&&(o=this.displayEventEnd),this.displayEventTime&&!n?o&&t?this.view.formatRange({start:e,end:t},!1,i):e.format(i):},e.prototype.computeE" Heuristic match: "c-body > tr > td).append(e),this.dayGrid.headContainerEl=this.el.find(.fc-head-container),this.dayGrid.setElement(t)},e.prototype.unrenderSkeleton=function(){this.dayGrid.removeElement(),this.scroller.destroy()},e.prototype.renderSkeletonHtml=function()" Heuristic match: "getUnzonedRangeOption(validRange,this._view.calendar.getNow())||new p.default},e.prototype.buildCurrentRangeInfo=function(e,t){var n,i=this._view.viewSpec,o=null,r=null,s=null;return i.duration?(o=i.duration,r=i.durationUnit,s=this.buildRangeFromDuration" Pattern match: "http://fullcalendar.io/docs/google_calendar/" Pattern match: "www.google.com\/calendar\/feeds\/([^\/]*)/.exec(t)" Pattern match: "http://www.w3.org/2000/svg,chartCount:0,seriesTypes:{},symbolSizes:{},svg:o,win:t,marginNames:[plotTop,marginRight,marginBottom,plotLeft],noop:function(){},charts" Heuristic match: "yShadows();return this},destroyShadows:function(){(this.shadows||[]).forEach(function(e){this.safeRemoveChild(e)},this),this.shadows=void 0},xGetter:function(e){returncircle===this.element.nodeName&&(x===e?e=cx:y===e&&(e=cy)),this._defaultGetter(" Pattern match: "http://www.w3.org/1999/xlink,href,t" Pattern match: "https://www.highcharts.com?credits,position:{align:right,x:-10,verticalAlign:bottom,y:-5},style:{cursor:pointer,color:#999999,fontSize:9px},text:Highcharts.com}},me.setOptions=function(e){return" Heuristic match: "):f.x)),i.axisTitleMargin=Ue(n,h),i.getMaxLabelDimensions&&(i.maxLabelDimensions=i.getMaxLabelDimensions(a,s)),l=this.tickSize(tick),g[d]=Math.max(g[d],i.axisTitleMargin+u+b*i.offset,h,e&&s.length&&l?l[0]+b*i.offset:0),r=r.offset?0:2*Math.floor(i.axisLin" Pattern match: "Math.PI/2&&(n+=2*Math.PI),s.slicedTranslation={translateX:Math.round(Math.cos(n)*l),translateY:Math.round(Math.sin(n)*l)},i=Math.cos(n)*e[2]/2,o=Math.sin(n)*e[2]/2,s.tooltipPos=[e[0]+.7*i,e[1]+.7*o],s.half=n" Pattern match: "https://export.highcharts.com/,printMaxWidth:780,scale:2,buttons:{contextButton:{className:highcharts-contextbutton,menuClassName:highcharts-contextmenu,symbol:menu,titleKey:contextButtonTitle,menuItems:printChart" Pattern match: "http://momentjs.com/guides/#/warnings/zone/,function(e,t){return" Pattern match: "http://fancyapps.com/fancybox/\n" Pattern match: "http://bugs.jquery.com/ticket/6724\n\t\t\t\trez.w" Pattern match: "http://bugs.jquery.com/ticket/12273\n\t\t\tif" Pattern match: "c.mod/2?a+=c.mod:a-l" Pattern match: "www.jacklmoore.com/autosize\n*/\n" Pattern match: "jquery.org/license" Pattern match: "http://knockoutjs.com/\n" Pattern match: "http://www.json.org/json2.js" Heuristic match: "e)\r\n } else a.a.fa(c, d)\r\n }, qc: function (a, c) { b(a) ? a.parentNode.insertBefore(c, a.nextSibling) : a.firstChild ? a.insertBefore(c, a.firstChild) : a.appendChild(c) }, kc: function (c, d, " Pattern match: "http://www.opensource.org/licenses/mit-license\n" Pattern match: "http://knockoutjs.com/\n///" Pattern match: "http://opensource.org/licenses/mit-license.php" Pattern match: "http://www.w3.org/TR/html-markup/input:\r\n\t\t\t\t\t\t\t//" Pattern match: "https://localforage.github.io/localForage\n" Pattern match: "https://mozilla.github.io/localForage/#definedriver" Pattern match: "http://www.plupload.com/license\n" Pattern match: "Math.PI/180,r=document.createElement(canvas),o=r.getContext(2d),a=e.width,s=e.height;switch" Pattern match: "http://www.opensource.org/licenses/mit-license.php\n" Pattern match: "http://+e" Heuristic match: "init:function(e,t,n,i){var o,a;o=e,a=i,$(o).chosen({disable_search:a.disableSearch,disable_search_threshold:a.disableSearchThreshold,search_contains:!0,fixed_width:!1,width:100%,placeholder_text_single:ko.unwrap(a.defaultSelectionValue)}),$(o).on(chosen" Pattern match: "https://knockoutjs.com/documentation/binding-context.html" Pattern match: "http://qtip2.com/options,type:a.types.object,defaultValue:{}},showTooltip:{description:This" Heuristic match: "ze=i.default(e.defaultButtonSize,),n.vertical=i.default(e.vertical,!1),n};o.prototype.dispose=function(){i.partialDispose(this)},i.isNotRegistered(bt-button-group)&&(n(./jscript/Components/Common/bt-button-group.scss),ko.components.register(bt-butto" Pattern match: "https://swisnl.github.io/jQuery-contextMenu/docs.html,examples" Heuristic match: "ilter={value:-1,selectedValue:ko.observable(-1)},o.selectedModalFilter={value:-1,selectedValue:ko.observable(-1)},o.savedFilters=ko.observableArray(),o.savedFiltersForSettingsDialog=ko.observableArray(),o.components=ko.observableArray(),o.defaultFilter=ko." Heuristic match: "BTStorage.Stores.SessionStorage).setItem(filtersBeforePostback_+o.filterKey()+_selectedFilter,o.selectedFilter.selectedValue()))},0),o.initialLoad()||o.triggeredReset()||o.requiresPostbackForDataLoad()||btToastMessages.success(Results updated,{preven" Heuristic match: "taLoad()?(BTStorage.GetStore(BTStorage.Stores.SessionStorage).setItem(filtersBeforePostback_+o.filterKey()+_fieldValues,o.getFilterValues()).then(function(e){o.hidFilterString(JSON.stringify(o.getFilterValues(!0))),d(o.hidFilterString(),storage #3)})" Heuristic match: "e()})})},r=function(e){ko.utils.arrayForEach(e,function(e){e.typeId()==l.File?e.value.fileName.extend({isCustomField:!0}):e.value.extend({isCustomField:!0})})};n(./jscript/Components/Custom Fields/bt-custom-fields.scss),n(./jscript/Components/BTFormCo" Heuristic match: "on-subcategory-header-editable.js),n(./jscript/Components/Entities/Roles/bt-permission-entry-editable.js),n(./jscript/Components/Entities/Roles/bt-permission-check-all.js),n(./jscript/Components/Entities/Roles/bt-permission-copy-popup.js),n(./jscri" Heuristic match: "rs(null)),n.assignedUsersLoaded(!0)}return n.brandColor=e.brandColor,n.rolesList=ko.observableArray([]),n.showCustomFields=e.showCustomFields||ko.observable(!1),n.selectedRole=ko.observable({}),n.showRolesList=ko.observable(!0),n.showReadOnlyDetails=ko.obs" Heuristic match: "m-autosize .bt-multi-line-text--value)),(n=e).outerHeight(0),d(n),n.unbind(input,c),r\r\n \r\n \r\n Owner\r\n " Pattern match: "https://api.vimeo.com,refresh_interval:1e3,contentType:application/octet-stream},t.file={id:e.id,ticket:null,file:e.file,nativeFile:e.file.getNative(),tile:e.title,description:e.description,bytesUploaded:0,progressAsPecent:function(){return" Pattern match: "e.size/1024/1024" Pattern match: "https://player.vimeo.com/video/\" Pattern match: "https://connect.facebook.net/en_US/all.js#xfbml=1\;\n" Pattern match: "https://twitter.com/share\" Pattern match: "https://www.pinterest.com/pin/create/button/" Pattern match: "http://www.houzz.com/buttonsAndBadges\n" Pattern match: "https://buildertrend.net/" Pattern match: "fontawesome.io/license/http://fontawesome.io/license/"28:T568,"staticxx.facebook.com" (Indicator: "facebook.com") "www.facebook.com" (Indicator: "facebook.com") "validForPostalCode:" .",genericError:" .",hostedFieldsTokenizationFailOnDuplicateError:" .",hostedFieldsFailedTokenizationError:" .",hostedFieldsFieldsInvalidError:" .",hostedFieldsTokenizationNetworkErrorError:" . .",hostedFieldsTokenizationCvvVerificationFailedError:" . .",paypalAccountTokenizationFailedError:"- PayPal. .",paypalFlowFailedError:"- PayPal. .",paypalTokenizationRequestActiveError:" " (Indicator: "paypal"), "GET /v2.4/plugins/page.php?adapt_container_width=false&app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D44%23cb%3Df6ef72f23b0ae5%26domain%3Dbuildertrend.net%26origin%3Dhttps%253A%252F%252Fbuildertrend.net%252Ff20e89a2610562c%26relation%3Dparent.parent&container_width=0&height=80&hide_cover=false&href=https%3A%2F%2Fwww.facebook.com%2Fbuildertrend%3Ffref%3Dts%26ref%3Dbr_tf&locale=en_US&sdk=joey&show_facepile=false&show_posts=false&small_header=true&width=235 HTTP/1.1 Accept: text/html application/xhtml+xml */* Referer: https://buildertrend.net/ Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip deflate Host: www.facebook.com DNT: 1 Connection: Keep-Alive" (Indicator: "facebook.com")29:T7ea,"iexplore.exe" wrote bytes "c03a736e" to virtual address "0x76701FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x76661164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x75F911BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "a035736e" to virtual address "0x779E1298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "60d2766e" to virtual address "0x6C8EFEC4" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x779B1210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "60d2766e" to virtual address "0x76701D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x773511B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d2766e" to virtual address "0x773513B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "a035736e" to virtual address "0x7782B0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "c03a736e" to virtual address "0x6C8EFE80" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60cd766e" to virtual address "0x6C8EFEC0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a035736e" to virtual address "0x75CB1144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "a035736e" to virtual address "0x7448139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x761817CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x74481250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "c0bf746e" to virtual address "0x76701F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "a035736e" to virtual address "0x7670202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033736e" to virtual address "0x779E1100" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "3030736e" to virtual address "0x6C8EFE90" (part of module "IEFRAME.DLL")2a:T154e,Found malicious artifacts related to "157.240.18.19": ... URL: https://cdn.fbsbx.com/v/t59.2708-21/58411453_591524354683147_9201344304939794432_n.bz/video_95752.bz?_nc_cat=105&_nc_oc=AQlB8bqFX8er-7mYe1tplmScOL9rgImc9MymUvhvytb3HOjgcnmGbmlca3mCBy9B9qE&_nc_ht=cdn.fbsbx.com&oh=b98b2129edce69c9aa89ab91028ec01c&oe=5D35BB8F&dl=1 (AV positives: 1/71 scanned on 11/08/2019 06:39:30) URL: https://cdn.fbsbx.com/v/t59.2708-21/57506712_387585875176921_2730138146871181312_n.bz/video_93219.bz?_nc_cat=110&_nc_oc=AQlUtZ0p4BfiA-1NfWWbgkFggpyqv89X7IeLhjOD5sk2W4K2eK6L3FIeyO19-vOKU0E&_nc_ht=cdn.fbsbx.com&oh=5bc9809b92f9decfaf302ca1db565631&oe=5D383FF4&dl=1&fbclid=IwAR1bF--t-xRohTbz7jjjSxQLG8VAp8TERzHmpp2Qk71ycO-blkChw2JV-nE (AV positives: 1/71 scanned on 11/03/2019 14:43:11) URL: https://static.xx.fbcdn.net/rsrc.php/v3iV-e4/yY/l/zh_TW/4zF5FArGvVc.js (AV positives: 1/71 scanned on 10/26/2019 06:31:37) URL: https://scontent.xx.fbcdn.net/v/t1.0-1/c29.0.100.100a/p100x100/1379841_10150004552801901_469209496895221757_n.jpg?_nc_cat=1 (AV positives: 1/71 scanned on 10/21/2019 03:01:50) URL: https://cdn.fbsbx.com/v/t59.2708-21/19292275_110555956246103_6778920593229086720_n.zip/Fw-Iptu-2017.zip?dl=1&oe=59600C6F&oh=027c201762f343a7c60198a244431aee (AV positives: 2/71 scanned on 09/27/2019 02:05:19) File SHA256: 833658395a1a7857f035162523f6d977e762de413be018a930a34780673db1a6 (Date: 10/24/2019 15:50:45) File SHA256: 363610d7363188cc1e73be875aaddff98ed681dfe0b112bd7d7e3f74b6585410 (Date: 10/24/2019 12:04:53) File SHA256: 4d080446d916b4262f55da64e79e588eb4d3bf2bd95eff1db93b04e0b4b3adc9 (Date: 10/23/2019 02:24:09) File SHA256: 701e578ae80238de2809bdf46e25c0980b78a6f2ca8d441f4092b4d21d5ebaf3 (Date: 10/23/2019 02:19:03) File SHA256: 36887a7157d7ebe876406e8b52efb9d66efa4f7b01463e013b0e1a88fdf89885 (Date: 10/07/2019 09:42:14) File SHA256: 851f4687c84c553abf267c6cc5ecc665dfca59e97393754d250834bca2f91095 (AV positives: 33/73 scanned on 09/06/2019 23:07:09) File SHA256: d802589f8a2f179e6a621239eedcaceab9a3aa6be51901652c1c952d5a54c55c (AV positives: 6/68 scanned on 08/28/2019 21:45:29) File SHA256: 1c23b8bb580efd0154cf26547d4fa695244985bcd0e0d8e090824d42d8eb8520 (AV positives: 2/70 scanned on 07/09/2019 01:32:38) File SHA256: 5149b52ec35f5b91a1a8c15014dc55df82edd4fd9d38848a2692e40d022b387d (AV positives: 1/67 scanned on 07/01/2019 13:38:11) File SHA256: 80324f0c30c7e5b2edd08d8115b500ffc1ccc8ab45291036bc9c5ad844ed6466 (AV positives: 1/72 scanned on 07/01/2019 18:49:27) Found malicious artifacts related to "74.125.192.156": ... URL: http://pubads.g.doubleclick.net/activity;dc_iu=/6245/ebay.ebayus.bcode;dc_seg=16762450;ord=e061b759-cc1b-4843-abc0-9afd17432ddb (AV positives: 1/63 scanned on 04/28/2015 21:06:54) URL: http://pubads.g.doubleclick.net/activity;dc_iu=/9494403/DFPAudiencePixel;ord=1;dc_seg=31491010 (AV positives: 1/63 scanned on 04/28/2015 12:34:56) URL: http://pubads.g.doubleclick.net/activity;dc_iu=/4246/DFP_Audience_Pixel;dc_seg=22540930;blog=gizmodo;ord=5010412032715.977;postId=1700474148;tags=image%20cache space san%20francisco photos landscapes geography (AV positives: 1/63 scanned on 04/28/2015 12:34:12) URL: http://pubads.g.doubleclick.net/activity;xsp=459146;ord=3284554514567.1313 (AV positives: 1/63 scanned on 04/28/2015 12:33:08) URL: http://pubads.g.doubleclick.net/activity;dc_iu=/8264/DFPAudiencePixel;ord=1;dc_seg=28276330;ord=5702f634-631a-4184-ba83-bc75f306e121 (AV positives: 1/63 scanned on 04/28/2015 12:32:57) File SHA256: a4921c25b1471a3866f61858fb1bbf59f0e378c0b5c2bedcda0265f507f93c03 (AV positives: 1/57 scanned on 03/21/2015 19:19:55) File SHA256: 8679362afe8969e39c8a67bd10dc4f154067e9b1c67b774f41efb11315df5314 (AV positives: 20/53 scanned on 09/01/2014 13:42:11) File SHA256: e717b4a152e1951565d90cd594868766146f57248bc9e1e37f317f7234fd5f15 (AV positives: 1/52 scanned on 07/16/2014 14:45:47) File SHA256: 82f536a7e9a946e5378badc7cc58611011e7154a392143c8748112a0995e82b3 (AV positives: 23/49 scanned on 04/14/2014 08:42:40) File SHA256: d24c3391c3947566c73bd9a9e4d36895d234b5b5e13eff14442b9fe4fb7910f8 (AV positives: 18/51 scanned on 04/14/2014 08:41:40) Found malicious artifacts related to "99.84.168.41": ... URL: http://l3.lonlife.org/hezi/client/ (AV positives: 2/71 scanned on 11/11/2019 15:44:05) URL: http://l3.lonlife.org/ (AV positives: 1/71 scanned on 11/11/2019 15:09:41) URL: http://miniclip.com/game-files/3-foot-ninja/ (AV positives: 1/71 scanned on 11/11/2019 13:44:11) URL: http://resource.chevalmobile.com/material/2019-10-29/qeNj (AV positives: 1/71 scanned on 11/08/2019 18:12:10) URL: http://rice.childrenhair.icu/?affId=1006&instId=11&appTitle=PDF+Annotator+7.0.0.703+incl+Patch&s1=3184&s2=30402697&setupName=cpSetup&appVersion=2.92&exe=1 (AV positives: 1/71 scanned on 11/08/2019 16:34:56) File SHA256: 25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393 (AV positives: 1/70 scanned on 11/11/2019 10:19:28) File SHA256: a22c034dbb6adb9b8fbdb9c4fae8428d85351d9784aca29b975a597c7dc5d58f (AV positives: 5/68 scanned on 10/13/2019 03:55:50) File SHA256: 90b2d35cd5e08370ed20db81197dd9da1a4dbb421f71293fd5733ea49eb7b3e1 (AV positives: 1/72 scanned on 09/28/2019 02:42:51) File SHA256: 08ab5e23ed1b3c397fefa6c6e9436b62c83397aab6cc17cdb7639920ea7dbac9 (AV positives: 6/71 scanned on 09/05/2019 21:39:02) File SHA256: ea5226cc3180ea1771465d369dbbbb483b18e53945eb5029ef33b52397700b2f (AV positives: 3/73 scanned on 09/03/2019 22:38:56)2b:Te42,The input sample is signed with a certificate issued by "CN=WR3, O=Google Trust Services, C=US" (SHA1: FD:A5:04:0B:CF:0A:E8:50:64:C2:05:57:1B:87:6D:98:15:49:C4:5D; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: E2:51:CB:7D:AF:59:31:04:5A:80:45:45:A0:F4:5B:C2:26:A0:BD:76; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=GeoTrust TLS RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: AD:7D:87:AA:89:0B:D5:3C:0A:01:97:20:7D:C1:BB:DA:9F:88:11:D0; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 8B:3C:5B:9B:86:7D:4B:E4:6D:1C:B5:A0:1D:45:D6:7D:C8:E9:40:82; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 5D:9B:5B:BE:24:B7:4B:CA:F3:05:47:2F:AB:3F:3C:F7:4E:C3:4D:BC; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M02, O=Amazon, C=US" (SHA1: 64:5C:40:26:CE:8F:E3:FA:A7:04:07:EB:FA:DA:CB:A6:76:AF:8C:BB; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon Root CA 1, O=Amazon, C=US" (SHA1: 41:4A:20:60:B7:38:C6:35:CC:7F:C2:43:E0:52:61:55:92:83:0C:53; see report for more information) The input sample is signed with a certificate issued by "CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 06:B2:59:27:C4:2A:72:16:31:C1:EF:D9:43:1E:64:8F:A6:2E:1E:39; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 6E:CC:D1:3D:F7:CC:2B:BA:13:AD:E2:E5:B5:3A:38:EA:02:12:4C:41; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 3C:2E:67:30:A6:95:F3:D3:61:49:AB:AC:BC:D1:CF:77:3E:33:8F:B7; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 04:FF:92:E7:16:B0:49:91:8B:B7:8D:C6:93:B9:20:B4:2A:33:9F:A8; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 33:6A:80:2B:88:EE:62:F2:64:C6:75:F9:B4:9D:B1:A1:18:83:73:AA; see report for more information)2c:Tc04,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAIyUlEQVR4XqXWd1DUZxoHcKJRqQsqXry/biYznp4ICAhYYgENBwLKggUMUqNn1IuKpwZRT0WMINWxotwYFTSI4oGAUrYvu7B02GVhKRbAlhixYPvje8/7W1BpE+O9M99hB3Z/z+d93rIYGHzksBE8hK3oHmzEHZRbsJG0wlqig41MCxt5A6YraihVcChTwJ4yq7IEA5/xScNe+BgsduJfYCvupNzlANMkLZRmWEsbYS1rgE1pLQEqCaCEc4UYc6qLMK+2APNrcj4N4iDsgaPoORxE3bAX/0oA6gA3+9uwFrdjmpgBGmEl0WCarA7W8lrYKipgp1RhZiUBagoxvy4XC9VX4d6cjsVtZz4e4iR4AUfhC31xEc1e9BDTxfcJ0KWfPRW34orrAVbSOkJUE0DFtd+xQoKZVSUcwK3xIty16VjSehIrOw7+PsJR+Ipm/gIzRM84gIPoN27206k46wA3e2r9VFaYi5peM0AtdaES05XlcFSxDtzsBWRgSUsqlradQgABVnZED49wEryGk+g1AVj7WQeeUAd+IcADDmAt0a+9lUTLzZ4Vniqpx98ktZgqZYAq2gsq2gcS2gM34FJ/FW6aCwQ4heW3E7CqMwZBXbsQ+iBiMMJZ+AZONHsnEetAD3XgKaWbCrO176KfnTR7Bmiiog3vCg/MNFklIcpoIxZhbk0uXBsuw7P5FHzbExFwNxohDyLx7cMhAGzmTqI3VPxlL+AZ7AS/YUrOHUzJbaO0YvL1ZgLouPYPLNwXK1kV7QUlHcMbBPgvXOsZIBW+bXHwvxODkHsRBNiI9Y/D3iO42YtY9LOfdPEWLPcVgheRDfMdebCIvIGxkfmU6xi3PRtf/JiPL7MqBxXXA9hRFMGxXIDZVXlY2JAOD20qlrdHw/92FII7NyP8/ndY/yjwPcCJAM4EsLr2K8wjC2G6vRBmUSLw9shhHq2ARUwZxsYoMS6mFOOjJRi/T4DxuwvwRXQ+JuXVDFgCFWxLZXBWXcfcqky41p7F4sYUeDfFYeWtHxDUsRFhXWvwjweB2PDIDwbOtPGcRW8xKb0TRhE3YbJTCtO95TA7UAPeoXqYx6lhEa/GWMq4BDUsE+pgebgKlocUsIwWwDIqF19e0XfDSlpFl5KcAHLMUORjduVVuNSkwbMxCXzdXqxo246A9k0I7VyDtfcDse7hchjMKu7BlMuPYLhVAKMoJYz3VcM0Rg2zWC14cU0wT2iGRaIOY5N1GEcZn0JJ1mJCkhoTDldgQowElrvy8Nd8Jd2KMtjKBLCTF8C57DK+qjgHl+oT8FTHwEe7E8t1m7H6VjhC7gYjvNMfa7v4MLDPeQLT3eUYE6WC0b46GMc0wuTHJpjG6mB2WAdefAvME1tgkdRKiFaMS2klRBP+fESDP6U0YkJ8JSFkmBhbDCsRAxQTIA8zlRfwlSoNCyqPwUsdDb42kgBbsKptDYJvByPszjI9YPKlhxi9sxJj9tTBMFoDo5gmGB+kHGruj0jQI8yjSvGXzdmDjtGEA2JMyi6BvewKHOUX4Vz6E+aqUuFaEQfPuh3wbtgBP+0GfNMajKBbqzjAtx0+MLBMasaoqFqM3qvBmGgtDA9oOYRRL8IkliBxegRvmwjG7rGDiveNyWdvwF6SQYAMzFKcxlxlPFxUcfCo2Q7v+q3ga9bDXxuAwJZlCGnnI/y2Nwws4nX4fLcao/ZoMHqfFmP26xGGAxE75DD2iIWxd/KwAPufGeAcnKTHMFuegHllcfi6fDvcVFvhVbMOPvVhWKYOxDc6P6zWeSG83Q0GI6MaMJIAn+9pxKi9jYRo5BBjPkQc0FDhRJgsSYHJ0uPDAuwEqXCQpBHgKAEOY17pfrgqthJgPbyqgsGvD8IKzXLqAh+BTX9HsM4VBiN2EmCXhhCawQi2JAyxPh/GXgTgn6CkDguwFyRjhvgYZkkPUQ5igTwCC5URcCtfh8XlQVhSHQh+zTL4a7zgr3ZHQMN8GHy2U40RUeohEaN7EUa+x2nmR2Hqdxqmy9KGBNgUJcNekES3aRzdK9GYI92N+bItcJV/BzdFkB5QwQe/yht+NR4EcNM/p0iigFKphKK0FHK5HFKpFBKxBGKRCEKhECUlJSguKkZRYSFu3riJy9nXYeg7+J8Lu6I4AiTAUbAfs0S7MUe0BfOlG+AqC8PXpUHwKFsJb5UP+NVe8Kv2eP95Vvzt27cfnfy8POrE0F2YUbwXTiX/xkzBNgJEEGAdAUKxSBYAD4UPFit94F3u3f+zbObswS9fvkRDy30s3JQJ57Xpg9LT08O973puLi3Df2AyzFKwMad4A2YL/4l5wjC4ildhkWQFFkl9hn4/a3sfgKW+5R5cv78EpzXn+oUB3rx5g5ycHA7A9oIZ7YmBz/vDg635QIDLxnQ4hp/tlxcvXnCAa9nX+gHM+KdgtvTkR0N4HvGwcDn8/v1sw/UB6nVdWLDhPGaEpfVPaBqeP3+O169fI/vq1f4A31Q9wuckeD7HwVt6bBCG55UEnmcieIsTYMFCiHd/ZLu9DxB+KAcOoacHJ+Q0nj17xgGuZGUNDeAzwAkC6BG8JUdh7n2EkgJzr2SYeyZREgkQD1P3DwDsqDHAo8fdsAs+1ZuTXLJK6riw10+fPsWrV6+QlZn5fwHMPT5oPxvsnDNAW8cjTF994l2ySmq5trOZZxbVoLu7mwNkXvqZO4afAmDL0K84G+yS6VsC900/wTbwKPx+yHhXnM2cFX/y5AkHuJRxEaZU1NTvDAFSPxLAZp8wuDgb7IZjAPZweW0bbFYdQfD+y9yu/xDBwpAZ6el0LR+DKRU082WF9cXN6HtiKADPKwWmXh+s+cDBrte+W44dM0VdOyKPF3AbjqH60ndML5w/jxHbqmAYQqeBvh/MaOebUVH2U1+YQr/neTNAyvCF+0ZBQQF3vbIbjl0y7Jyzo8Z2O9twbM1Z29nMWfHUM2fxWaQa7EtsZGQdRv2rjL4ti2D8vRAWEUJM3FqMiaGZv1+4d/wPO0tiqUVEX6wAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":55,"unified_at_epoch_ms":1790293182563,"unified_at":"2026-09-24T23:39:42.563Z","metadata":{"hashes":{"sha256":"1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047","sha1":"8ba9264d189c9182ca6b61dcfa2055e739365c83","md5":"aa6dc8fcbe40d060316cb975267dd7d6","sha512":"c3b642a0d4912e8149ac103e6c19dc6b81506f7489447095f5979c8538be28d574d8d405a3e846bee728f47fc01bae2933665c425af6fd55f2feb3ba6224a44d","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"http://buildertrend.net/","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1573501886000,"last_seen":1744133285000,"last_multi_scan":1744133285000}},"detections":{"summary":{"verdict":"suspicious","score":55,"tags":["ransomware","phishing"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":5},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":20,"suspicious_count":6,"malicious_count":0,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"bforeai":{"name":"BforeAI","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"BforeAI","permalink":"https://bfore.ai/","extra_fields":[{"name":"percent","value":0}]},"cleandns":{"name":"CleanDNS","success":true,"verdict":"undetected","status":"no-result","progress":100,"data_source":"CleanDNS","permalink":"https://www.cleandns.com/","extra_fields":[{"name":"domain","value":"buildertrend.net"},{"name":"percent","value":0},{"name":"reports_count","value":0}]},"criminalip":{"name":"Criminal IP","success":false,"verdict":"undetected","status":"error","progress":100,"data_source":"Criminal IP","permalink":"https://www.criminalip.io/","extra_fields":[{"name":"is_url_analysis","value":true}]},"scamadviser":{"name":"ScamAdviser","success":true,"verdict":"clean","status":"clean","progress":100,"data_source":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","report_link":"https://www.scamadviser.com/check-website/buildertrend.net?utm_source=hybridanalysis","extra_fields":[{"name":"domain","value":"buildertrend.net"},{"name":"percent","value":0}]},"urlscanio":{"name":"urlscan.io","success":true,"verdict":"undetected","status":"no-classification","progress":100,"data_source":"urlscan.io","permalink":"https://urlscan.io/","report_link":"https://urlscan.io/result/01961671-eacf-731f-a7cf-976d622fc8dc/","extra_fields":[{"name":"percent","value":0}]}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"suspicious","value":"Suspicious domain detected"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contacts random domain names"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/71 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"buildertrend.net\"\n \"ocsp.godaddy.com\"\n \"ocsp.pki.goog\"\n \"cdn.appdynamics.com\"\n \"col.eum-appdynamics.com\"\n \"connect.facebook.net\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"js.appcenter.intuit.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"34.96.101.148:80\"\n \"34.96.101.148:443\"\n \"72.167.18.239:80\"\n \"172.217.164.170:443\"\n \"172.217.8.4:443\"\n \"172.217.7.131:80\"\n \"172.217.12.227:443\"\n \"157.240.18.19:443\"\n \"172.217.7.206:443\"\n \"172.217.164.131:443\"\n \"74.125.192.156:443\"\n \"99.84.168.41:443\"\n \"157.240.18.35:443\"\n \"34.197.90.182:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00010165-00002200) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://buildertrend.net/\" (UID: 00010165-00002200)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2200 CREDAT:275457 /prefetch:2\" (UID: 00010191-00002120)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"iexplore.exe\" with commandline \"http://buildertrend.net/\" (UID: 00010165-00002200)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2200 CREDAT:275457 /prefetch:2\" (UID: 00010191-00002120)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 884)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$28","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$29","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"suspicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 34.96.101.148 on port 80 is sent without HTTP header\n TCP traffic to 34.96.101.148 on port 443 is sent without HTTP header\n TCP traffic to 72.167.18.239 on port 80 is sent without HTTP header\n TCP traffic to 172.217.164.170 on port 443 is sent without HTTP header\n TCP traffic to 172.217.8.4 on port 443 is sent without HTTP header\n TCP traffic to 172.217.7.131 on port 80 is sent without HTTP header\n TCP traffic to 172.217.12.227 on port 443 is sent without HTTP header\n TCP traffic to 157.240.18.19 on port 443 is sent without HTTP header\n TCP traffic to 172.217.7.206 on port 443 is sent without HTTP header\n TCP traffic to 172.217.164.131 on port 443 is sent without HTTP header\n TCP traffic to 74.125.192.156 on port 443 is sent without HTTP header\n TCP traffic to 99.84.168.41 on port 443 is sent without HTTP header\n TCP traffic to 157.240.18.35 on port 443 is sent without HTTP header\n TCP traffic to 34.197.90.182 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string: .3dm\n .3gp\n .csv\n .doc\n .dot\n .ppt\n .rtf\n .xls\n .adp\n .ai\n .al\n .asp\n .avi\n .bak\n .bat\n .bmp\n .cdr\n .cer\n .cmd\n .crt\n .cs\n .csh\n .csv\n .dat\n .der\n .doc\n .docm\n .docx\n .dot\n .dotx\n .dwg\n .dxf\n .eml\n .eps\n .flv\n .gif\n .html\n .jpe\n .jpeg\n .jpg\n .js\n .lay\n .layout\n .log\n .m4a\n .m4v\n .md\n .mdb\n .mkv\n .mov\n .mp4\n .mpg\n .msg\n .ods\n .odt\n .pages\n .pdf\n .pl\n .png\n .pps\n .ppsx\n .ppt\n .pptx\n .ps\n .psd\n .rar\n .rtf\n .rvt\n .svg\n .tif\n .tiff\n .txt\n .wav\n .wmv\n .wpd\n .wps\n .xlm\n .xls\n .xlsm\n .xlsx\n .xlt\n .xltx\n .zip","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"buildertrend.net\"\n \"cdn.mxpnl.com\"\n \"cdnjs.cloudflare.com\"\n \"connect.buildertrend.paragon.so\"\n \"connect.useparagon.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"maps.googleapis.com\"\n \"sentry.io\"\n \"www.google.com\"\n \"www.gstatic.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Network Related","name":"Contacts random domain names","description":"\"cdnjs.cloudflare.com\" seems to be random","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cdnjs.cloudflare.com\" has high entropy\n Contacted domain: \"connect.buildertrend.paragon.so\" has high entropy\n Contacted domain: \"connect.useparagon.com\" has high entropy\n Contacted domain: \"fonts.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"buildertrend.net\" (90 days old)\n Short term registered certificate: \"cdnjs.cloudflare.com\" (90 days old)\n Short term registered certificate: \"connect.useparagon.com\" (90 days old)\n Short term registered certificate: \"fonts.googleapis.com\" (83 days old)\n Short term registered certificate: \"fonts.gstatic.com\" (83 days old)\n Short term registered certificate: \"maps.googleapis.com\" (83 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)\n Short term registered certificate: \"www.gstatic.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: buildertrend.net\nConnection: keep-alive\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.56\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\" Response ==> HTTP/1.1 301 Moved Permanently\nCache-Control: private\nLocation: https://buildertrend.net:443/\nContent-Length: 0\nDate: Tue\n 08 Apr 2025 17:28:35 GMT\nContent-Type: text/html; charset=UTF-8 with no response body","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"level":"suspicious","category":"Network Related","name":"Suspicious domain detected","description":"Input URL or Contacted Domain: \"paragon.so\" has been identified as suspicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-86","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 15 domains and 15 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}]},"activity":{"stats":{"process_count":29,"spawned_processes_count":29,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":212,"dropped_files_count":0,"extracted_files_count":52,"files_written_count":228,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":11,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":25,"dns_resolutions_count":22,"contacted_urls_count":10,"http_requests_count":10},"behavior_tags":["ransomware","phishing"],"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"67f55ca5eee19780840e6096","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":55,"contacted_countries":["USA"],"submit_name":"1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047.url","analysis_start_time":"2025-04-08T17:28:05+00:00","indicators_count":{"informative":14,"suspicious":2,"malicious":0},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5dc9bbbd0388389760779519","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","contacted_countries":["IRL","USA"],"submit_name":"1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047.url","analysis_start_time":"2019-11-11T19:51:38+00:00","indicators_count":{"informative":14,"suspicious":6,"malicious":0},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"34.96.101.148","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"34.96.101.148","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"72.167.18.239","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.164.170","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.8.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.7.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.12.227","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"157.240.18.19","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.7.206","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"172.217.164.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"74.125.192.156","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"99.84.168.41","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"157.240.18.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"34.197.90.182","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"address":"34.160.176.84","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"34.160.176.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"142.251.214.138","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"35.186.247.156","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"35.186.235.23","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"52.10.6.208","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"172.217.164.100","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"142.251.46.234","port":443,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"142.251.46.195","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"104.21.47.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"address":"104.17.25.14","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}],"dns_resolutions":[{"domain":"buildertrend.net","address":"34.96.101.148","ttl":142,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"BuilderTREND Solutions","registrar_name_servers":"PDNS05.DOMAINCONTROL.COM","registrar_creation_date":"2006-07-24T03:13:51+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"cdn.appdynamics.com","address":"13.249.79.86","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"col.eum-appdynamics.com","address":"3.219.162.204","ttl":59,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"AppDynamics, Inc","registrar_creation_date":"2013-04-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"connect.facebook.net","address":"31.13.93.26","ttl":731,"country":"Ireland","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Facebook, Inc.","registrar_name_servers":"A.NS.FACEBOOK.COM","registrar_creation_date":"2004-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"fonts.googleapis.com","address":"172.217.6.138","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"fonts.gstatic.com","address":"216.58.194.99","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"js.appcenter.intuit.com","address":"23.0.149.100","ttl":13,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Intuit Inc.","registrar_creation_date":"1994-02-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"ocsp.godaddy.com","address":"72.167.18.239","ttl":277,"country":"United States","registrar_name":"LIQUIDNET LTD.","registrar_organization":"Go Daddy Operating Company, LLC","registrar_name_servers":"A1-245.AKAM.NET","registrar_creation_date":"1999-03-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"ocsp.pki.goog","address":"172.217.7.131","ttl":295,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"scontent-ort2-2.xx.fbcdn.net","address":"157.240.18.19","ttl":59,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"static.xx.fbcdn.net","address":"31.13.93.26","ttl":3373,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"staticxx.facebook.com","address":"31.13.93.26","ttl":3008,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"stats.g.doubleclick.net","address":"173.194.67.156","ttl":21526,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"www.facebook.com","address":"31.13.93.35","ttl":3122,"country":"Ireland","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"domain":"www.gstatic.com","address":"216.58.194.131","ttl":299,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"cdn.mxpnl.com","address":"35.186.235.23","ttl":5157,"country":"United States","registrar_name":"ENOM, INC.","registrar_organization":"MIXPANEL, INC.","registrar_name_servers":"NS1.P16.DYNECT.NET","registrar_creation_date":"2012-08-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"cdnjs.cloudflare.com","address":"104.17.25.14","ttl":223,"country":"United States","registrar_name":"CloudFlare, Inc.","registrar_organization":"CloudFlare, Inc.","registrar_name_servers":"NS3.CLOUDFLARE.COM","registrar_creation_date":"2009-02-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"connect.buildertrend.paragon.so","address":"52.10.6.208","ttl":60,"country":"United States","registrar_name":"NameCheap","registrar_organization":"Privacy service provided by Withheld for Privacy ehf","registrar_name_servers":"glen.ns.cloudflare.com","registrar_creation_date":"2021-02-11T22:47:57+00:00","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"connect.useparagon.com","address":"104.21.47.240","ttl":300,"country":"United States","registrar_name":"NAMECHEAP INC","registrar_organization":"Privacy service provided by Withheld for Privacy ehf","registrar_name_servers":"GLEN.NS.CLOUDFLARE.COM","registrar_creation_date":"2019-08-30T01:43:08+00:00","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"maps.googleapis.com","address":"142.251.46.234","ttl":300,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"sentry.io","address":"35.186.247.156","ttl":655,"country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"domain":"www.google.com","address":"172.217.164.100","ttl":85,"country":"United States","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}],"http_requests":[{"host":"buildertrend.net","host_ip":"34.96.101.148:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: buildertrend.net\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"},{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D","method":"GET","header":"GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D","method":"GET","header":"GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.godaddy.com","host_ip":"72.167.18.239:80","url":"//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQD%2FXWF%2F1kzxeA%3D%3D","method":"GET","header":"GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQD%2FXWF%2F1kzxeA%3D%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.godaddy.com","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQC%2BwDeiSaNPxQIAAAAASJYt","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQC%2BwDeiSaNPxQIAAAAASJYt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEENgBO69TxB8AgAAAABIlRA%3D","method":"GET","header":"GET /gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEENgBO69TxB8AgAAAABIlRA%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCisUKLlKY2sggAAAAAGfpo","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCisUKLlKY2sggAAAAAGfpo HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBAdCn5cn%2FpRAgAAAABIlVo%3D","method":"GET","header":"GET /gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEBAdCn5cn%2FpRAgAAAABIlVo%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.7.131:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDwjyggyoh8GggAAAAAGfpy","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDwjyggyoh8GggAAAAAGfpy HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}],"processes":[{"pid":6260,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\system32\\ieframe.dll\",OpenURL C:\\sample.url","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\system32\\rundll32.exe","uid":"00000000-00006260","icon":"$2c"},{"pid":8168,"ppid":6260,"name":"msedge.exe","command_line":"--single-argument http://buildertrend.net/","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006260","uid":"00000000-00008168"},{"pid":4860,"ppid":8168,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=107.0.5304.110 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 \"--annotation=prod=Microsoft Edge\" --annotation=ver=107.0.1418.56 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0x144,0x7ffe7e3fb208,0x7ffe7e3fb218,0x7ffe7e3fb228","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004860"},{"pid":7916,"ppid":8168,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00007916"},{"pid":3664,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:3","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00003664"},{"pid":7076,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00007076"},{"pid":4332,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1903101460 --mojo-platform-channel-handle=2804 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004332"},{"pid":5760,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1903406683 --mojo-platform-channel-handle=2812 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00005760"},{"pid":2612,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3576 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00002612"},{"pid":2396,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1904546660 --mojo-platform-channel-handle=4248 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00002396"},{"pid":4344,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1908044825 --mojo-platform-channel-handle=5200 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004344"},{"pid":6236,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1908325912 --mojo-platform-channel-handle=4108 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00006236"},{"pid":2240,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3952 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00002240"},{"pid":3128,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5160 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00003128"},{"pid":6904,"ppid":8168,"name":"msedge.exe","command_line":"--type=renderer --display-capture-permissions-policy-allowed --js-flags=--ms-user-locale= --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --time-ticks-at-unix-epoch=-1744156610740590 --launch-time-ticks=1909192359 --mojo-platform-channel-handle=5132 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:1","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00006904"},{"pid":4936,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5696 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004936"},{"pid":7228,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4192 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00007228"},{"pid":6388,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5024 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00006388"},{"pid":4380,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6300 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004380"},{"pid":7744,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4300 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00007744"},{"pid":1676,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3344 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00001676"},{"pid":4736,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2536 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004736"},{"pid":4536,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6012 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004536"},{"pid":4572,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00004572"},{"pid":1960,"ppid":8168,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6036 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:2","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00001960"},{"pid":6292,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2524 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00006292"},{"pid":1284,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00001284"},{"pid":6572,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5376 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00006572"},{"pid":7328,"ppid":8168,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6068 --field-trial-handle=1916,i,951404440476510564,14214094894576471304,131072 /prefetch:8","sha256":"accd0aa3ae9f8b376215e8dd833ee762f2a7cdc6535eb27df0e670e9e689b620","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00008168","uid":"00000000-00007328"}],"all_imported_dlls":["ieproxy.dll","ieframe.dll","winnsi.dll","SensApi.dll","RpcRtRemote.dll","cryptnet.dll","mscoree.dll","nlaapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","nsi.dll","oleaccrc.dll","ExplorerFrame.dll","d2d1.dll","MSOHEV.DLL","psapi.dll","dnsapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","wininet.dll","version.dll","normaliz.dll","msctf.dll","userenv.dll","netapi32.dll","d3d10warp.dll","sechost.dll","iertutil.dll","profapi.dll","bcryptprimitives.dll","cryptbase.dll","dwmapi.dll","apphelp.dll","wkscli.dll","SwDir_1231201.dll","kernel32.dll","api-ms-win-downlevel-version-l1-1-0.dll","sxs.dll","netutils.dll","devobj.dll","jp2ssv.dll","dhcpcsvc.dll","shlwapi.dll","imm32.dll","srvcli.dll","mlang.dll","msimtf.dll","lpk.dll","uxtheme.dll","oleacc.dll","duser.dll","propsys.dll","wshqos.dll","msvcr90.dll","d3d11.dll","WSHTCPIP.DLL","rpcrt4.dll","ws2_32.dll","cryptsp.dll","credssp.dll","shell32.dll","setupapi.dll","cfgmgr32.dll","IPHLPAPI.DLL","URLREDIR.DLL","UIAutomationCore.dll","ntmarta.dll","advapi32.dll","gdi32.dll","IEShims.dll","urlmon.dll","sqmapi.dll","msvcr100.dll","dxgi.dll","msvcrt.dll","webio.dll","ncrypt.dll","mscoreei.dll","npctrl.dll","rsaenh.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleaut32.dll","wintrust.dll","deploy.dll","ole32.dll","WindowsCodecs.dll","npmproxy.dll","rasadhlp.dll","user32.dll","mshtml.dll","powrprof.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","winhttp.dll","ssv.dll","imagehlp.dll","sspicli.dll","xmllite.dll","KernelBase.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","ieui.dll","mscorwks.dll","netprofm.dll","Wldap32.dll","gpapi.dll","winmm.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","comctl32.dll","comdlg32.dll","secur32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msasn1.dll","msimg32.dll","bcrypt.dll","jscript9.dll","mswsock.dll","DWrite.dll","wship6.dll","dui70.dll","UIAnimation.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","clbcatq.dll","FWPUCLNT.DLL","usp10.dll","rpcss.dll","crypt32.dll","schannel.dll","t2embed.dll","d3dcompiler_47.dll","KBDUS.DLL","mfplat.dll","wevtapi.dll","mf.dll","dxilconv.dll","mdmregistration.dll","Windows.System.Profile.RetailInfo.dll","dmcmnutils.dll","twinapi.dll","CoreUIComponents.dll","ntdll.dll","SHCore.dll","dbghelp.dll","actxprxy.dll","msvproc.dll","windows.storage.dll","cldapi.dll","srumapi.dll","oneds.dll","vk_swiftshader.dll","win32u.dll","DataExchange.dll","ucrtbase.dll","atlthunk.dll","kernel.appcore.dll","onramp.dll","dsreg.dll","PCPKsp.dll","ResourcePolicyClient.dll","libEGL.dll","OneCoreUAPCommonProxyStub.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","Windows.Networking.Connectivity.dll","combase.dll","winmmbase.dll","microsoft_apis.dll","mscms.dll","mfsensorgroup.dll","BitsProxy.dll","OneCoreCommonProxyStub.dll","dcomp.dll","directmanipulation.dll","vaultcli.dll","D3D12.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","ntasn1.dll","telclient.dll","msvcp_win.dll","msedge.dll","Windows.Web.dll","mfperfhelper.dll","Windows.UI.dll","wldp.dll","linkinfo.dll","tbs.dll","gdi32full.dll","WofUtil.dll","fwbase.dll","msmpeg2vdec.dll","DolbyDecMFT.dll","libGLESv2.dll","vulkan-1.dll","WinTypes.dll","Windows.Media.dll","rmclient.dll","TextInputFramework.dll","Windows.Security.Authentication.Web.Core.dll","dpapi.dll","winsta.dll","RTWorkQ.dll","wlanapi.dll","msvcp110_win.dll","wtsapi32.dll","fltLib.dll","fwpolicyiomgr.dll","twinapi.appcore.dll","ffmpeg.dll","Windows.Security.Authentication.OnlineId.dll","msedge_elf.dll","CoreMessaging.dll","edputil.dll","FirewallAPI.dll","dxva2.dll","aepic.dll","CompPkgSup.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"en-US.2","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"1E0PZNAA.txt","sha256":"cea704d9e065d54b868983a5f7e41c992905ab0ab131704658d10642268ae82f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"1W3FIVO0.txt","sha256":"01e07f6f74c1bd0574d79436cf9f84f8874b4996c7d218b4a2854f41c6167b70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"38RNN8Q1.txt","sha256":"6971af721feccd2cf77d8beb233d14fb66d80426afe11fed1ecf3603de4a4492","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"3ZD2O163.txt","sha256":"c54a4d00196aaf4fda35a0461551e591b1b4f141b7edeb0e437424f4fc6602ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"5PGAM912.txt","sha256":"6c2a48d64eea1801bd15dcbdc25c6d8325809ce1e156cfdb0404e27958eaf1c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"BTKZJOHB.txt","sha256":"693b5ed77cbeb0db6d5d4a79a408813ab66e135f8e1adefc7fcd3c8657abc6c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"CAD1HP44.txt","sha256":"e67789405e2b167108a1fba493035e57cbd3c629769776355a6b7a9580d1d664","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"CRQY5KTG.txt","sha256":"9ca40c080db894a742553550bb97f7f5123175026b535d6aaea922634a1acf2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"CYP3OXLT.txt","sha256":"c233bab1533883fbe5188b82493f9297b36c39b9ff559a81c5f20d6259e2d92b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"DV37SB8B.txt","sha256":"637081d97a9251cba0e604d5e280373934a311499f07aff3c945fd716d5aa16d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"GFCH5VH0.txt","sha256":"765012d1f93c9d237856abc1b939d0bed11345cc9342a36101ff5d77efd9af6b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"HPLFWYMN.txt","sha256":"5a00ff519ce40fe40ee72d1e09d70e94cb9b0efaded26f7ed8499456eaf3a7c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"HU05ZLBB.txt","sha256":"fb7df58f8cd05264bd9aaf51f17be558f5079cd0bc1544c9639e8843cbf16d17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"K92IK4TC.txt","sha256":"2b5e73b43fd358f25f2f70f2a0f5188f2811ff5e666f6615f74cd995ad30bb70","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"MHZX255K.txt","sha256":"6a29a4903a5d80ba42273287cd0252328b8721d0a23b32ee85ced10787f941f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"N7TT8SFA.txt","sha256":"d3f1ac1677241dd197dd86aba191c57aac3031217055f56aac18db9948e05073","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"O264768W.txt","sha256":"486dacfa4d18c2e3fd4cad43ee9818c6b4de3b405d9920d3bb502a5085b5fb88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"P3RJ6JAP.txt","sha256":"e54e1455e89f685f6e7e9451e0092ca7a4db5069a06e5271d3045d6b755c2133","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"SBDA1WJS.txt","sha256":"8776eeb40c0ec65310b73ce9bd0c21c33290063b73a601d805463a23cfbf78a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"SC8KL64X.txt","sha256":"85621053a90a76cbab28207028db8f9757ea1cbc945b4938d6751cdc67856c03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"SREAK39D.txt","sha256":"29fc1551bdd233c1c8b4c6641ef3b38fa67a59c2d7dd12da12af7870d1eca5a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"SWTOTF7W.txt","sha256":"01323f3c81b4d5f794e54c44a0badf8d476fce62492c33dcba1d86bd1571b2ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"T171C2XV.txt","sha256":"7042f0d60cf54ea067cb4160e63befd86785ab5e82982487c56abbde81201b80","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"TI96VY4R.txt","sha256":"80efea35780ae758655217c84dd4269a3df3a852a2b8ae385b0582a446e02b49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"TTWVGD1Z.txt","sha256":"eb35ca442e9ffa3cb27afbf8e1241293ef1505bb5774a30c794f41a158bf0a45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"U00T6MZG.txt","sha256":"a1598810f07f4191ce56bde1335e816a2658f246755fa7d36b077154d2e712d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"V227GNPD.txt","sha256":"496a80582eacfe0adec717a1d2959950ab03fa5eed9a56d1739c1bd5b9b29520","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"WEKPX6WE.txt","sha256":"91ac49e2d1fd50705262e62d22dfef56e004ff06fc8ca0466d2003e4d06b82f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"WICONHF1.txt","sha256":"361a734b0f05e844c7adfcb30a24c4b307de66fae8de9408877af9c93f582f78","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"X3VBW5QS.txt","sha256":"458998e2f5f566cae0f7042274e02d6c1e886ddea82b92561a6d03a61a6d87f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Y168S9OC.txt","sha256":"0d51e67f694bcc591980e5d64ecb219f3c7208b915253ed208a8522632cd3eea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"ZHSBA1IU.txt","sha256":"75316816ba4ed4ddc469c7d7b26b5e06acb43f2cf11c282bbe30949e3f43cf8f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"verD102.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"imagestore.dat","sha256":"0b6a5eeeee9e6ca0ed93d38c5447144d4abcd3e9f2095cbf76c3cc618505e270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"JZ3AKFYH.htm","sha256":"3ba2d07e1de31455973b1aa71a86f7320384b14e4270e499834170d479492acb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"PSXWGP0K.htm","sha256":"3e27bf6d22bedaea6bd1b5546554d5ee7b1c1e1f1b0a3489591f3d2008ae25b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"1E11E75149C17A93653DA7DC0B8CF53F_37163FF53E3B99F5EAB32C736B49281A","sha256":"daaef5ae831bb3308f6ba4785822dee5271dab67c464a026298a3384d3c93dbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sha256":"e52d707f05541bfffe14b8304e11618a0e447000e0cbf08e0e948db2f773fea1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_A8C3357E0EDCC2B0F37CD34282989E6E","sha256":"a11f0c77c371d131958d343adbc388054a837689a786cdf70950d8aa2fd1c09c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"a542c598d49df691d55f165e621e751e88929154bee09839c86dd04d3e7e9091","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sha256":"014e0724f80196a72ad3192ef008cdcba1c8b3b26df7c7104c8ee664e19f0ac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sha256":"13448dae131611582d5e67b582bdaa7ec1069f563780855be8d5acdee4a7f6e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"35DDEDF268117918D1D277A171D8DF7B_B8D93006F9BB8A9D4CD6D37865B71D1D","sha256":"40b90327bc131cae2c58dc1f7e4098f68760f08876a9da7244b5c1ba1a35fd5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"bb251a0f05ec32629e724687406c561f619625046721bdcd78f413a13b78c489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sha256":"bb3cdadf240543ff8085c09949992d71df9429d0298343180ccdef63667e7dad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"ADB64C60CDC7941BDBC3C36834FDDE51_AABC00B3B047C7662F780BF1DF3E5D7D","sha256":"41a36eeea63e828c0d7673f24b1eb5f38e6b768c9bb692cf5e1abba0215708a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_0803FA4637FACE663C85DA507CD1901D","sha256":"046ded10344574d97f84fef6a6d196f8cc6a9bd50407f589e39a66df6f36f102","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_8EA1CA7EFA00E219F5588E185629CC42","sha256":"037f9c4ecb872594cc9fd5f3884b166832bc27d115160117eb71924e9bdb2019","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"BE8B021F9E811DFC8C8A28572A17C05A_C091E73CB028C0DBB2F53630B1350448","sha256":"e3e61bf2ba6a46036d897fd556428fc4de19d1ddecf387ae235b56dd74e21736","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"urlref_httpbuildertrend.net","sha256":"f630a4848fcca117d23c24f1bb2c5374afb97157c1897030fecad090b9f6e4c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:\\1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047.url","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\~DF391CF9FBD68B69C9.TMP","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{D9B0D933-04BC-11EA-B153-0A0027488D3C}.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\PSXWGP0K.htm","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_AD876BD6070522D4EE8560FE72EBB41A","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C5FD5BF0CE6372B1CAFE381FD0BC969C","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\ADB64C60CDC7941BDBC3C36834FDDE51_AABC00B3B047C7662F780BF1DF3E5D7D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\ADB64C60CDC7941BDBC3C36834FDDE51_AABC00B3B047C7662F780BF1DF3E5D7D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\~DF19C47EFF042D0B86.TMP","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\223DE96EE265046957A660ED7C9DD9E7_5F4A6047A3FBCAF69FE9965B6C68B6B7","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\67F6625BC22310D5C99DDE12020DBD90","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\ADB64C60CDC7941BDBC3C36834FDDE51_C36B8174B49D20CC3ACC06D3F9B16F46","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\737F397B945DB3295D622A4BBBC19246","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ERV9N2EC.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\V227GNPD.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SBDA1WJS.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\JZ3AKFYH.htm","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\webpackruntime.chunk.93a29769c9e8f9214463[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\vendor.chunk.d8a338ca7eb36189ddcd[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{D9B0D931-04BC-11EA-B153-0A0027488D3C}.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\btConstants.chunk.cd0d325012cea969d3b2[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8DC4A47.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\commons.chunk.f9994361223eed614f74[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\rootMasterWebforms.chunk.30f1f18d51291a544efe[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SC8KL64X.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\P3RJ6JAP.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\TabSpecificCssIncludes_BuildertrendFontIcons[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZHSBA1IU.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\login.chunk.6fd46504866e25a135fe[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\smartBannerCss[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\new-ajax-loader[1].gif","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BTKZJOHB.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\buildertrend-logo-stacked--white-2color[1].svg","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DV37SB8B.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[4].ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\notifications[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\O264768W.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\multiSelect[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mobileOV[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\WebResource[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WEKPX6WE.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\UserControlIncludes_Qtip[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1W3FIVO0.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\UserControlIncludes_QtipTooltip[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_C0A4BFC0819758DD30694E95FB55AB17","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_C0D69C20AF2D1F2E2507FCC50BF1348F","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\521F25E202FF760B8461B88413F425E7","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\css[2].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DOMStore\\HVI1ZDNF\\buildertrend[1].xml","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\~dxjgamc.tmp","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_C0A4BFC0819758DD30694E95FB55AB17","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\DYBRXUFE.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\api[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\vendor.chunk.98a00881fca481ab3b68[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\commons.chunk.77a3b4d3d8ddecbd910c[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\toastNotifications.chunk.4d4838805e2258325ecf[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\login.chunk.a159b2e3a81528efcf89[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\rootMasterWebforms.chunk.19fdd9f9519487a934e0[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\toastNotifications.chunk.e43ef6e843bd4607a438[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T171C2XV.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\TabSpecificCssIncludes_LoginNoIframe[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\IntuitOpenIDConnectSignIn[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PI95A64D\\analytics[2].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_1374AC543829516A5CA56081CD00C32A","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_8EA1CA7EFA00E219F5588E185629CC42","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_D30008D892EAB558B2E8C1380F77DA34","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\EDC238BFF48A31D55A97E1E93892934B_A7467B47637944C1E4B4025C763E391F","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0270780F846F08BEFE0DD8112D932FEF","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\blackBackTrans[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\fontawesome-webfont[1].eot","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_8EA1CA7EFA00E219F5588E185629CC42","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_B8D93006F9BB8A9D4CD6D37865B71D1D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\35DDEDF268117918D1D277A171D8DF7B_C3A7A996F10EEE032B36B9615761068A","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BEC6224B02D155A396218A2504F3EE0B","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\739F2FF4259CDC6CBE7B90F1A95601EF","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\intuit.ipp.anywhere[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN_r8OUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\intuit.ipp.anywhere[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_A8C3357E0EDCC2B0F37CD34282989E6E","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_A8C3357E0EDCC2B0F37CD34282989E6E","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\35DDEDF268117918D1D277A171D8DF7B_B8D93006F9BB8A9D4CD6D37865B71D1D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\sdk[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\analytics[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\sdk[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\404HCFVH.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\AONJLIHR.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_C091E73CB028C0DBB2F53630B1350448","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\SLD1THWF\\sdk[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\adrum-ext.f13718297ad3d9e6b80d6bc11e953001[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_0803FA4637FACE663C85DA507CD1901D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_E1564DC17D4154863F6644B10BC974EE","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Ii98aXZRCNs[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mqbJw8qnVJu[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\1BjrYUERys4[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\recaptcha__en[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\svFKQXueTby[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_0803FA4637FACE663C85DA507CD1901D","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%PROGRAMFILES%\\Microsoft Silverlight\\5.1.50907.0\\npctrl.dll","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CAD1HP44.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\38RNN8Q1.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HPLFWYMN.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%WINDIR%\\Fonts\\tahoma.ttf","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_C091E73CB028C0DBB2F53630B1350448","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_EFE58094E0F98B364A08B5A6CB7A7FCB","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\xd_arbiter[1].htm","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\page[1].htm","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\oHGdtoYvIml[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\iNvDn9MydGf[1].js","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\4duqlulqMFL[1].css","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\64596097_2937462236269690_6060828419552182272_n[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\50456995_2677712708911312_6289973368699486208_n[1].png","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%TEMP%\\~DF5383986B1D0EF027.TMP","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_F180B3281280E7C593730B4F5A7D4777","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6B17EC2CD0C9B19353018FF1C12BC489","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\5B9763FB83E74617D0DB58992800F69B","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1E11E75149C17A93653DA7DC0B8CF53F_37163FF53E3B99F5EAB32C736B49281A","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1E11E75149C17A93653DA7DC0B8CF53F_37163FF53E3B99F5EAB32C736B49281A","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{E3754363-04BC-11EA-B153-0A0027488D3C}.dat","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZN1CVVJS.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\verD102.tmp","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\SREAK39D.txt","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2200","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IE_EarlyTabStart_0x6b4_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_ConnHashTable<2200>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_ConnHashTable<2200>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_2200","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IE_EarlyTabStart_0x6b4_Mutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\https://buildertrend.net/","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"IsoScope_898_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://buildertrend.net/","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_898_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"5dc9bbbd0388389760779519"}]},{"name":"SM0:6260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"name":"Local\\SM0:6260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"name":"InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"name":"SM0:6260:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]},{"name":"Local\\SM0:6260:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"67f55ca5eee19780840e6096"}]}]}},"report_ids":{"sandbox_job_ids":["67f55ca5eee19780840e6096","5dc9bbbd0388389760779519"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample 1d82b6683c5a… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 1d82b6683c5a…. Threat score 55/100. 0/5 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 1d82b6683c5a… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 1d82b6683c5a…. Threat score 55/100. 0/5 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1d82b6683c5add76fcc918343561397e77745015346e59164e5acae95890a047"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 1d82b6683c5a… — Score 55/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 1d82b6683c5a…. Threat score 55/100. 0/5 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]