33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 3a:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 35:T1b91,Submission context: "If you have trouble viewing this email, read the online version.[https://app.go.sage.com/e/es.aspx?s=1265708786&e=9986399&elq=2503b3c6bc274a01be0058efeaf4f469] Sage See how Sage Copilot accelerates finance workflows--------------------------------------------------Register now Hi Marina, -----------------------------------------------------------------------We've refreshed our Coffee Break demo to help you see what's possible with Sage Intacct in less time, and with more clarity around real-world finance outcomes.In a short, guided walkthrough, we'll explore how teams are using Sage Intacct and Sage Copilot to: Reduce manual work and eliminate reconciliation bottlenecks Surface insights faster with automated reporting and AI-driven suggestions Improve accuracy with connected, real-time financials Support growth without introducing more complexity Consider your next coffee run covered. Verified Attendees will receive a $10 Starbucks card as a thank-you. Whether you're evaluating new tools or improving existing workflows, this session delivers a practical look at what's next in finance automation. Reserve your spot to learn why organizations continue to choose Sage Intacct. Cheers,Ema Alspaugh Register now View full terms and conditions. ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Offer valid for verified demo attendees only. Limit to one Starbucks Card per person. Sent via Reachdesk 3-5 business days after the demo. Starbucks is not affiliated with or sponsoring this offer.Instagram Facebook LinkedIn Twitter YouTube Unsubscribe | Manage Preferences | Privacy Policy We sent this email to marina.fieraru@hays.com . If this is not your email address then this email has been forwarded to you by that user or another system beyond our control.Sage | 601 West Hastings Street, Ste 1800 | Vancouver, BC V6B 1M8, Canada 2026 The Sage Group plc or its licensors. All rights reserved. "36:Tc52,Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCADCHEADBAAAA" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process AcroRd32.exe created mutex with name "SM0:4868:168:WilStaging_02" Process AcroRd32.exe created mutex with name "Local\SM0:4868:168:WilStaging_02" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "DBWinMutex" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process AcroRd32.exe created mutex with name "Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process AcroRd32.exe created mutex with name "{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCADCHEADBAAAA" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process AcroRd32.exe created mutex with name "DirectSound DllMain mutex (0x00001304)" Process AcroRd32.exe created mutex with name "SM0:4868:64:WilError_03" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4868:168:WilStaging_02"37:T968,"AdobeFnt14.lst.4868" has type "PostScript document text"- [targetUID: 00000000-00004868] "A9Rp4dufz_wwt5q9_3r8.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rp4dufz_wwt5q9_3r8.tmp]- [targetUID: 00000000-00004868] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00004868] "A9Rzmifk_wwt5qc_3r8.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rzmifk_wwt5qc_3r8.tmp]- [targetUID: 00000000-00004868] "A9Rosyo3c_wwt5qb_3r8.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rosyo3c_wwt5qb_3r8.tmp]- [targetUID: 00000000-00004868] "shellcode_obj.1793912234444.bin" has type "data"- [targetUID: 00000000-00004868] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00004868] "A9Rafe1w8_wwt5q7_3r8.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rafe1w8_wwt5q7_3r8.tmp]- [targetUID: 00000000-00004868] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00004868] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00004868] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00004868] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00004868] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00004868] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00004868] "FAPCEFA.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPCEFA.tmp]- [targetUID: 00000000-00004868]38:T524,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00004868] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00004868] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00004868] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00004868] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00004868] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00004868] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00004868] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00004868]39:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 9a5e3ff0b279… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 9a5e3ff0b279…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"attachment (5)_url_012.bin\",\"applicationCategory\":[\"pdf\"],\"identifier\":\"9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793912261757,"unified_at":"2026-11-05T20:57:41.757Z","metadata":{"hashes":{"sha256":"9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","sha1":"21c790fbd37a3d6fba0497e49cfaa829742f9e12","md5":"70450ba4d7cca14dd096b1c9764f0cd6","sha512":"73274002fd2f1dfc3f0ec30a987f1986dfc4b4058ffe26a218c521ad01f4c0bce4251a3fad7b4093c7de9b85ea81c7db8c46b3df5f4e4bbd01cf1a7f2e4e605a","ssdeep":"1536:ikXvxneca3PVh/+9Y53CWEIOI9XV1aBgAghUkXvxneca3Pr/+9Y53CWEIOI9XV17:Pfx/a9dYhIygHhfx/a/YhIygHh","ssdeep_chunks":["1536:ikXvxne","1536:kXvxnec","1536:Xvxneca","1536:vxneca3","1536:xneca3P","1536:neca3PV","1536:eca3PVh","1536:ca3PVh/","1536:a3PVh/+","1536:3PVh/+9","1536:PVh/+9Y","1536:Vh/+9Y5","1536:h/+9Y53","1536:/+9Y53C","1536:+9Y53CW","1536:9Y53CWE","1536:Y53CWEI","1536:53CWEIO","1536:3CWEIOI","1536:CWEIOI9","1536:WEIOI9X","1536:EIOI9XV","1536:IOI9XV1","1536:OI9XV1a","1536:I9XV1aB","1536:9XV1aBg","1536:XV1aBgA","1536:V1aBgAg","1536:1aBgAgh","1536:aBgAghU","1536:BgAghUk","1536:gAghUkX","1536:AghUkXv","1536:ghUkXvx","1536:hUkXvxn","1536:UkXvxne","1536:neca3Pr","1536:eca3Pr/","1536:ca3Pr/+","1536:a3Pr/+9","1536:3Pr/+9Y","1536:Pr/+9Y5","1536:r/+9Y53","1536:OI9XV17","3072:ikXvxne","3072:kXvxnec","3072:Xvxneca","3072:vxneca3","3072:xneca3P","3072:neca3PV","3072:eca3PVh","3072:ca3PVh/","3072:a3PVh/+","3072:3PVh/+9","3072:PVh/+9Y","3072:Vh/+9Y5","3072:h/+9Y53","3072:/+9Y53C","3072:+9Y53CW","3072:9Y53CWE","3072:Y53CWEI","3072:53CWEIO","3072:3CWEIOI","3072:CWEIOI9","3072:WEIOI9X","3072:EIOI9XV","3072:IOI9XV1","3072:OI9XV1a","3072:I9XV1aB","3072:9XV1aBg","3072:XV1aBgA","3072:V1aBgAg","3072:1aBgAgh","3072:aBgAghU","3072:BgAghUk","3072:gAghUkX","3072:AghUkXv","3072:ghUkXvx","3072:hUkXvxn","3072:UkXvxne","3072:neca3Pr","3072:eca3Pr/","3072:ca3Pr/+","3072:a3Pr/+9","3072:3Pr/+9Y","3072:Pr/+9Y5","3072:r/+9Y53","3072:OI9XV17","1536:Pfx/a9d","1536:fx/a9dY","1536:x/a9dYh","1536:/a9dYhI","1536:a9dYhIy","1536:9dYhIyg","1536:dYhIygH","1536:YhIygHh","1536:hIygHhf","1536:IygHhfx","1536:ygHhfx/","1536:gHhfx/a","1536:Hhfx/a/","1536:hfx/a/Y","1536:fx/a/Yh","1536:x/a/YhI","1536:/a/YhIy","1536:a/YhIyg","1536:/YhIygH"],"imphash":"Unknown"},"file_info":{"file_name":"attachment (5)_url_012.bin","file_type":["pdf"],"file_type_id":"pdf","file_size":112079,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793912000000,"last_seen":1793912000000,"last_multi_scan":1793912000000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"info","type":"obj","values":[{"name":"creation_date","type":"str","values":["D:20261013202922+00'00'"]},{"name":"title","type":"str","values":["Coffee Break Demo Campaign Terms and Conditions"]},{"name":"creator","type":"str","values":["M365 Copilot"]},{"name":"author","type":"str","values":["Smith, Jaylan"]},{"name":"subject","type":"str","values":["(unspecified)"]},{"name":"producer","type":"str","values":["PDFsharp 6.2.4 (Original: ReportLab PDF Library - (opensource))"]},{"name":"mod_date","type":"str","values":["D:20261013202922+00'00'"]}]},{"name":"encrypted","type":"bool","values":[false]},{"name":"version","type":"str","values":["1.4"]},{"name":"page_count","type":"int","values":[2]}]}]},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":20,"suspicious_count":0,"malicious_count":0,"total":20},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains an object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/1999/02/22-rdf-syntax-ns#\", Pattern match: \"http://ns.adobe.com/xap/1.0/mm/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AcroRd32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"AcroRd32.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.4868\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.92393","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AcroRd32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004868)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"General","name":"Additional Submission Context","description":"$35","origin":"File/Memory","relevance":10,"id":"string-42","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"General","name":"Contains an object with compressed stream data","description":"Object ID 5 contains compressed stream data: /CIDInit /ProcSet findresource begin\n12 dict begin\nbegincmap\n/CIDSystemInfo\n<< /Registry (AAAAAA+LiberationSans-Bold)\n/Ordering (AAAAAA+LiberationSans-Bold)\n/Supplement 0\n>> def\n/CMapName /AAAAAA+LiberationSans-Bold def\n/CMapType 2 def\n1 beginc ...\n Object ID 6 contains compressed stream data: \\x00\\x01\\x00\\x00\\x00\n\\x00\\x80\\x00\\x03\\x00POS/2\\xf8>\\x87\\x96\\x00\\x00\\x00\\xdc\\x00\\x00\\x00`cmap\tW\n\\x17\\x00\\x00\\x01<\\x00\\x00\\x01\\x16cvt _\\xe2_\\x80\\x00\\x00\\x02T\\x00\\x00\\x02Jfpgms\\xd3#\\xb0\\x00\\x00\\x04\\xa0\\x00\\x00\\x07\\x05glyf\\x07\\xad\\x0f`\\x00\\x00?\\xa8\\x00\\x ...\n Object ID 10 contains compressed stream data: \\x00\\x01\\x00\\x00\\x00\n\\x00\\x80\\x00\\x03\\x00POS/2\\xf7\\x12\\x86\\x87\\x00\\x00\\x00\\xdc\\x00\\x00\\x00`cmap\tW\n\\x17\\x00\\x00\\x01<\\x00\\x00\\x01\\x16cvt C\\x9dC\\xea\\x00\\x00\\x02T\\x00\\x00\\x02\\x16fpgms\\xd3#\\xb0\\x00\\x00\\x04l\\x00\\x00\\x07\\x05glyfvQn\\xc1\\x00\\x00?t\\x00\\x00p\\xe0he ...","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$36","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"shellcode_obj.1793912234444.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"addressbook.acrodata\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"attachment (5)_url_012.bin\" was detected as \"PDF\" and name: \"Format\"\n \"attachment (5)_url_012.bin\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$37","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rp4dufz_wwt5q9_3r8.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rp4dufz_wwt5q9_3r8.tmp]\n \"A9Rzmifk_wwt5qc_3r8.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rzmifk_wwt5qc_3r8.tmp]\n \"A9Rosyo3c_wwt5qb_3r8.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rosyo3c_wwt5qb_3r8.tmp]\n \"A9Rafe1w8_wwt5q7_3r8.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rafe1w8_wwt5q7_3r8.tmp]\n \"FAPCEFA.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPCEFA.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"AcroRd32.exe\" opens a process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (UID: 00000000-00004868)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 75040000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"shellcode_obj.1793912234444.bin has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$38","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}],"intel_graph":{"map":{"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1":{"type":"File","value":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},"File:0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b":{"type":"File","value":"0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b"},"File:1fcf7b05c1bc683e4544dce20b3fae8fb695cecf479dbc9a435aa94a92f99841":{"type":"File","value":"1fcf7b05c1bc683e4544dce20b3fae8fb695cecf479dbc9a435aa94a92f99841"},"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60":{"type":"File","value":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e":{"type":"File","value":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"},"File:4d0f72518ccca7aefa41279d996bc3e3c9f3718f07acb62797f47205673bce30":{"type":"File","value":"4d0f72518ccca7aefa41279d996bc3e3c9f3718f07acb62797f47205673bce30"},"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68":{"type":"File","value":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975":{"type":"File","value":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e":{"type":"File","value":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},"File:7e816dbe4cded79b502771d22931168cac2dcdc7a61a407d78f8adf41c2442e3":{"type":"File","value":"7e816dbe4cded79b502771d22931168cac2dcdc7a61a407d78f8adf41c2442e3"},"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa":{"type":"File","value":"9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa"},"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08":{"type":"File","value":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},"File:b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf":{"type":"File","value":"b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf"},"File:be9335d7d480c3c00f554045f1d173e97b5ad24f708cdc3af3cd0a32c2e0a42c":{"type":"File","value":"be9335d7d480c3c00f554045f1d173e97b5ad24f708cdc3af3cd0a32c2e0a42c"},"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3":{"type":"File","value":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71":{"type":"File","value":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"}},"chains":[{"id":"sandbox_files","root":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","edges":[{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:7e816dbe4cded79b502771d22931168cac2dcdc7a61a407d78f8adf41c2442e3"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:1fcf7b05c1bc683e4544dce20b3fae8fb695cecf479dbc9a435aa94a92f99841"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:be9335d7d480c3c00f554045f1d173e97b5ad24f708cdc3af3cd0a32c2e0a42c"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:4d0f72518ccca7aefa41279d996bc3e3c9f3718f07acb62797f47205673bce30"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},{"edge_kind":"extracted","from_key":"File:9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa","to_key":"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":47,"imported_dlls_count":123,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6aececbff0a08664200f9b92","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"attachment (5)_url_012.bin","analysis_start_time":"2026-11-05T20:53:20+00:00","indicators_count":{"informative":20,"suspicious":0,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}],"processes":[{"pid":4868,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\attachment_5__url_012.bin.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00000000-00004868","icon":"$39"}],"all_imported_dlls":["dpapi.dll","coloradapterclient.dll","GdiPlus.dll","rpcrt4.dll","wow64.dll","msvcrt.dll","SHCore.dll","comdlg32.dll","MMDevAPI.dll","TextShaping.dll","SensApi.dll","KernelBase.dll","AGM.dll","dsound.dll","devobj.dll","wow64win.dll","msvcr100.dll","bcryptprimitives.dll","AdobeXMP.dll","AXSLE.dll","ccme_base.dll","OnDemandConnRouteHelper.dll","IPHLPAPI.DLL","user32.dll","ole32.dll","combase.dll","rsaenh.dll","CoreMessaging.dll","AcGenral.dll","netutils.dll","cryptsp.dll","iertutil.dll","BIB.dll","thumbcache.dll","shlwapi.dll","ucrtbase.dll","version.dll","msacm32.dll","cryptbase.dll","crypt32.dll","WinTypes.dll","NPSWF32.dll","mswsock.dll","BIBUtils.dll","msvcp_win.dll","dcomp.dll","dxgi.dll","mscms.dll","oleaut32.dll","urlmon.dll","windows.storage.dll","ntmarta.dll","avrt.dll","kernel32.dll","userenv.dll","imm32.dll","comctl32.dll","winnsi.dll","winmm.dll","profapi.dll","d3d11.dll","rasadhlp.dll","ccme_ecc.dll","msasn1.dll","uxtheme.dll","samcli.dll","DataExchange.dll","wow64cpu.dll","wkscli.dll","dnsapi.dll","twinapi.appcore.dll","powrprof.dll","msvcp100.dll","TextInputFramework.dll","cryptocme.dll","mpr.dll","kernel.appcore.dll","sqlite.dll","secur32.dll","WindowsCodecs.dll","policymanager.dll","AcroRd32.dll","ACE.dll","propsys.dll","ntdll.dll","msctf.dll","netapi32.dll","schannel.dll","ksuser.dll","ccme_ecdrbg.dll","win32u.dll","CoolType.dll","shell32.dll","advapi32.dll","srvcli.dll","AXE8SharedExpat.dll","mlang.dll","nsi.dll","ccme_base_non_fips.dll","apphelp.dll","gdi32full.dll","dwmapi.dll","wldp.dll","CoreUIComponents.dll","ieframe.dll","cfgmgr32.dll","sechost.dll","bcrypt.dll","wsock32.dll","gdi32.dll","ccme_asym.dll","gpapi.dll","msvcp110_win.dll","ws2_32.dll","wininet.dll","umpdc.dll","winhttp.dll","coml2.dll","winmmbase.dll","clbcatq.dll","sspicli.dll","FWPUCLNT.DLL","psapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"shellcode_obj.1793912234444.bin","sha256":"7e816dbe4cded79b502771d22931168cac2dcdc7a61a407d78f8adf41c2442e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Annss.dat","sha256":"1fcf7b05c1bc683e4544dce20b3fae8fb695cecf479dbc9a435aa94a92f99841","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Annssi.dat","sha256":"be9335d7d480c3c00f554045f1d173e97b5ad24f708cdc3af3cd0a32c2e0a42c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Annssk.dat","sha256":"4d0f72518ccca7aefa41279d996bc3e3c9f3718f07acb62797f47205673bce30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"A9Rafe1w8_wwt5q7_3r8.tmp","sha256":"b572c39b15d22f892554f5568a1586b589876c3fcdaa84c5477724b6fd3ef8cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"A9Rosyo3c_wwt5qb_3r8.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"A9Rp4dufz_wwt5q9_3r8.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"A9Rzmifk_wwt5qc_3r8.tmp","sha256":"0e07cc568c6a9039584d1f267d6a2eb4cce1c83e27b79b588bd6406e6eb4772b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"FAPCEFA.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"AdobeFnt14.lst.4868","sha256":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}],"files_written":[{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%TEMP%\\FAPCEFA.tmp","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.4868","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCADCHEADBAAAA","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"SM0:4868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Local\\SM0:4868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCADCHEADBAAAA","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"DirectSound DllMain mutex (0x00001304)","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"SM0:4868:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4868:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4868:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00001304)","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6aececbff0a08664200f9b92"}]}]}},"report_ids":{"sandbox_job_ids":["6aececbff0a08664200f9b92"]}}}]]}] 2c:[["$","title","0",{"children":"Sample 9a5e3ff0b279… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 9a5e3ff0b279…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa"}],["$","meta","4",{"property":"og:title","content":"Sample 9a5e3ff0b279… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 9a5e3ff0b279…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a5e3ff0b279df4873d738cec5563b5ca1c94bc0f96ffeb8a4bf179d3fa3acaa"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 9a5e3ff0b279… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 9a5e3ff0b279…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null