26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T439,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample e5cfcae0d940… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample e5cfcae0d940…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","keywords":["malware analysis","sandbox report","threat intelligence","e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483"],"about":{"@type":"SoftwareApplication","name":"MV AE MERCURY _ AC POLYUMETCORE _ CP DD 06-10-26 _ INITIAL FREIGHT INVOICE_MV.AE MERCURY INITIAL FREIGHT INVOICE.pdf","applicationCategory":["pdf"],"identifier":"e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1f63,Submission context: "Eda / Sofia Good day RE: MV AE MERCURY / POLYMETCORE - CPDD 06.10.2026 Foll fm owners (Encl.1)++ QTE ++ Good day Please see revised initial freight invoice as attached. ++ UNQTE ++|Please always reply to operations@clarksons.gr|Sofia PantazopoulouOperations | Dry Cargo | Clarkson Hellas LtdT: +30 210 4586700 | M: +30 6946 924 518Group Email: operations@clarksons.gr For any urgent queries, please follow message with a phone call. 284 Kifissias Avenue |Chalandri| 152 32| Greece www.clarksons.com Please consider the environment before printing this e-mail _____ Reference Nr.: 90047333Date: 22/10/2026 15:06From: Eda BARIN To: OPERATIONS Cc: Subject: RE: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICESofia / Eda Hi, Thanks but she loaded 55050,053 mts but it is 55050,530 mts on owners invoice. Pls see attached cargo documents showing cargo quantity as 55050,053 mts Best RegardsCOREX Shipping Tel: + 90 212 290 30 80 pbx E-Mail : chartering@corexshipping.comTeams : eda.barn From: CLARKSONS Hellas Sent: Thursday, October 22, 2026 1:19 PMTo: Eda BARIN Cc: volkan@corexshipping.comSubject: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICE Eda / Sofia Good day RE: MV AE MERCURY / POLYMETCORE - CPDD 06.10.2026 Foll fm owners (Encl.1) ++ QTE ++ good day! pls note attached MV.AE MERCURY INITIAL FREIGHT INVOICE which inserted INVOICE NUMBER. Charterer pls recheck that cargo quantity is 55050.053 mts as per BL, thus figures in owner's invoice no need amend. ++ UNQTE ++ |Please always reply to operations@clarksons.gr| Sofia PantazopoulouOperations | Dry Cargo | Clarkson Hellas LtdT: +30 210 4586700 | M: +30 6946 924 518Group Email: operations@clarksons.gr For any urgent queries, please follow message with a phone call. 284 Kifissias Avenue |Chalandri| 152 32| Greece www.clarksons.com Please consider the environment before printing this e-mail _____ Reference Nr.: 90045153Date: 22/10/2026 12:16From: Eda BARIN >To: OPERATIONS >Cc: >Subject: RE: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICESofia / Eda Hi, Thanks but need below number to be inserted on invoice. And thought owners would revise the amount at the same time. (as per our below mail) Best RegardsCOREX Shipping Tel: + 90 212 290 30 80 pbx E-Mail : chartering@corexshipping.comTeams : eda.barn From: CLARKSONS Hellas > Sent: Thursday, October 22, 2026 12:02 PMTo: Eda BARIN >Cc: volkan@corexshipping.com Subject: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICE Eda / Sofia Good day RE: MV AE MERCURY / POLYMETCORE - CPDD 06.10.2026 Foll fm owners which crossed with yr last : Pls be advised that the invoice number as flwg ++ QTE ++ TS 20261014-01 ++ UNQTE ++ |Please always reply to operations@clarksons.gr| Sofia PantazopoulouOperations | Dry Cargo | Clarkson Hellas LtdT: +30 210 4586700 | M: +30 6946 924 518Group Email: operations@clarksons.gr For any urgent queries, please follow message with a phone call. 284 Kifissias Avenue |Chalandri| 152 32| Greece www.clarksons.com Please consider the environment before printing this e-mail _____ Reference Nr.: 90044538Date: 22/10/2026 11:49From: Eda BARIN >To: OPERATIONS >Cc: >Subject: RE: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICESofia / Eda Hi, RE: MV AE MERCURY / POLYMETCORE - CPDD 06.10.2026 Would you pls ask owners to insert INVOICE NUMBER . Apart from that , there is small calculation mistake . Amount should be as below thus Pls ask owners to amend invoice amount whicle adding invoice number. Freight : 55055,053 * 41 = usd 2257052,173.-3,75 pct comm = usd 84639,46.-95 pct freight = usd 2144199,564.-Amount to be paid = usd 2059560,108.- Thanks Best RegardsCOREX Shipping Tel: + 90 212 290 30 80 pbx E-Mail : chartering@corexshipping.comTeams : eda.barn From: CLARKSONS Hellas > Sent: Friday, October 16, 2026 11:23 AMTo: Eda BARIN >Cc: volkan@corexshipping.com Subject: MV AE MERCURY / AC POLYUMETCORE / CP DD 06-10-26 / INITIAL FREIGHT INVOICE Eda / Sofia Good day RE: MV AE MERCURY / POLYMETCORE - CPDD 06.10.2026 Foll fm owners : (Encl.2) ++ QTE ++ Good day Please see initial freight invoice for charterers payment in time. ++ UNQTE ++ Best Regards, |Please always reply to operations@clarksons.gr| Sofia PantazopoulouOperations | Dry Cargo | Clarkson Hellas LtdT: +30 210 4586700 | M: +30 6946 924 518Group Email: operations@clarksons.gr For any urgent queries, please follow message with a phone call. 284 Kifissias Avenue |Chalandri| 152 32| Greece www.clarksons.com Please consider the environment before printing this e-mail _____ All services undertaken are done so strictly in accordance with the terms and conditions applicable to those particular services, a copy of which is available at Terms of Business. Copies are also available on request.This message is private and confidential. If you have received it in error, you are on notice of its status. Please notify us immediately by reply email and then delete this message from your system. Please do not copy it or use it for any purposes, or disclose its contents to any other person; to do so could be a breach of confidence. Emails may be monitored.The Clarksons Group are committed to protecting and respecting your privacy, for more information please see our privacy policy: Privacy Policy. Details of Clarkson group companies and their regulators (where applicable) can be found at this url: Disclosure . _____ If you no longer wish to receive these emails, please click this unsubscribe link: Unsubscribe / Opt Out. The Clarksons Group are committed to protecting and respecting your privacy, for more information please see our Privacy Policy. _____"28:Tf2f,Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9128:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9128:168:WilStaging_02" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:9128:64:WilError_03" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\DBWinMutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\DirectSound DllMain mutex (0x000023A8)" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process AcroRd32.exe created mutex with name "\BaseNamedObjects\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer"29:T8d4,"A9Rijz4ws_4g9mrr_71k.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rijz4ws_4g9mrr_71k.tmp]- [targetUID: 00000000-00009128] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00009128] "A9Rzbejxs_4g9mrs_71k.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rzbejxs_4g9mrs_71k.tmp]- [targetUID: 00000000-00009128] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00009128] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00009128] "AdobeFnt14.lst.9128" has type "PostScript document text"- Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\Cache\AdobeFnt14.lst.9128]- [targetUID: 00000000-00009128] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00009128] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00009128] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00009128] "AdobeFnt14.lst.9128" has type "PostScript document text"- [targetUID: 00000000-00009128] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00009128] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00009128] "GlobSettings" has type "ASCII text"- Location: [%APPDATA%\Adobe\Acrobat\11.0\JSCache\GlobSettings]- [targetUID: 00000000-00009128] "FAPB1F4.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPB1F4.tmp]- [targetUID: 00000000-00009128]2a:T633,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00009128] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00009128] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00009128] Dropped file: "AdobeFnt14.lst.9128" - Location: [%LOCALAPPDATA%\Adobe\Acrobat\11.0\Cache\AdobeFnt14.lst.9128]- [targetUID: 00000000-00009128] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00009128] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00009128] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00009128] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00009128] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00009128] Dropped file: "GlobSettings" - Location: [%APPDATA%\Adobe\Acrobat\11.0\JSCache\GlobSettings]- [targetUID: 00000000-00009128]2b:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792741187299,"unified_at":"2026-10-23T07:39:47.299Z","metadata":{"hashes":{"sha256":"e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","sha1":"d59ea3f184e95cbfc7f311755f12fe70fa5740e8","md5":"fc65745d45a66a3ef823123ff2c13305","sha512":"f210515d40fecebc5846f3602e85227e1e867757eec37cdcfa247cd737a980bfcfabe76a389f71db254a754ba9358b74d0552b2c27d4a62664af0fc917633c75","ssdeep":"6144:6C/qujvmfWOUXq46ANt69hVkth5rgfmVL:6CSuKfKa49NM7kprgfiL","ssdeep_chunks":["6144:6C/qujv","6144:C/qujvm","6144:/qujvmf","6144:qujvmfW","6144:ujvmfWO","6144:jvmfWOU","6144:vmfWOUX","6144:mfWOUXq","6144:fWOUXq4","6144:WOUXq46","6144:OUXq46A","6144:UXq46AN","6144:Xq46ANt","6144:q46ANt6","6144:46ANt69","6144:6ANt69h","6144:ANt69hV","6144:Nt69hVk","6144:t69hVkt","6144:69hVkth","6144:9hVkth5","6144:hVkth5r","6144:Vkth5rg","6144:kth5rgf","6144:th5rgfm","6144:h5rgfmV","6144:5rgfmVL","12288:6C/qujv","12288:C/qujvm","12288:/qujvmf","12288:qujvmfW","12288:ujvmfWO","12288:jvmfWOU","12288:vmfWOUX","12288:mfWOUXq","12288:fWOUXq4","12288:WOUXq46","12288:OUXq46A","12288:UXq46AN","12288:Xq46ANt","12288:q46ANt6","12288:46ANt69","12288:6ANt69h","12288:ANt69hV","12288:Nt69hVk","12288:t69hVkt","12288:69hVkth","12288:9hVkth5","12288:hVkth5r","12288:Vkth5rg","12288:kth5rgf","12288:th5rgfm","12288:h5rgfmV","12288:5rgfmVL","6144:6CSuKfK","6144:CSuKfKa","6144:SuKfKa4","6144:uKfKa49","6144:KfKa49N","6144:fKa49NM","6144:Ka49NM7","6144:a49NM7k","6144:49NM7kp","6144:9NM7kpr","6144:NM7kprg","6144:M7kprgf","6144:7kprgfi","6144:kprgfiL"],"imphash":"Unknown"},"file_info":{"file_name":"MV AE MERCURY _ AC POLYUMETCORE _ CP DD 06-10-26 _ INITIAL FREIGHT INVOICE_MV.AE MERCURY INITIAL FREIGHT INVOICE.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":258037,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792740924000,"last_seen":1792740924000,"last_multi_scan":1792740924000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"page_count","type":"int","values":[1]},{"name":"info","type":"obj","values":[{"name":"creator","type":"str","values":["HP Scan"]},{"name":"producer","type":"str","values":["HP Scan Extended Application"]},{"name":"mod_date","type":"str","values":["D:20261023145448-08'00'"]},{"name":"creation_date","type":"str","values":["D:20261023145448-08'00'"]}]},{"name":"encrypted","type":"bool","values":[false]},{"name":"version","type":"str","values":["1.7"]}]}]},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":21,"suspicious_count":0,"malicious_count":0,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains an object with compressed stream data"},{"type":"informative","value":"Contains object with excessive content length"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"aEsW\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AcroRd32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"AcroRd32.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\Cache\\AdobeFnt14.lst.9128\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\AcroFnt11.lst\"\n \"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.9128\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst\"\n \"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.9128\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.59086","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AcroRd32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00009128)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Additional Submission Context","description":"$27","origin":"File/Memory","relevance":10,"id":"string-42","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Contains an object with compressed stream data","description":"Object ID 2 contains compressed stream data: No filters","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Contains object with excessive content length","description":"Object ID 1 contains embedded data with content is: /Type /XObject /Subtype /Image /Name /Im1 /Width 1654 /Height 2338 /Length 256639/ColorSpace /DeviceRGB /BitsPerComponent 8 /Filter [ /DCTDecode ] >> stream\n\\xff\\xd8\\xff\\xe0\\x00\\x10JFIF\\x00\\x01\\x01\\x01\\x00\\xc8\\x00\\xc8\\x00\\x00\\xff\\xdb\\x00C\\x00\\x08\\x06 ...","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":3,"id":"static-185","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"addressbook.acrodata\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"MV AE MERCURY _ AC POLYUMETCORE _ CP DD 06-10-26 _ INITIAL FREIGHT INVOICE_MV.AE MERCURY INITIAL FREIGHT INVOICE.pdf\" was detected as \"PDF\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"General","name":"PDF contains only a single page","description":"Tag \"pages\" has a value of \"1\"","origin":"Static Parser","relevance":5,"id":"static-58","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rijz4ws_4g9mrr_71k.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rijz4ws_4g9mrr_71k.tmp]\n \"A9Rzbejxs_4g9mrs_71k.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rzbejxs_4g9mrs_71k.tmp]\n \"FAPB1F4.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPB1F4.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"AcroRd32.exe\" opens a process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (UID: 00000000-00009128)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://cldcmpss.blob.core.windows.net/bc01/3701ff961d8748feaceff70af4ffdb5920251103112202.png\"\n Heuristic match: \"mv.ae\"\n Pattern match: \"https://www.verisign.com/rpa\"\n Pattern match: \"www.adobe.com/misc/pki/prod_svce_cps.html0http://crl.adobe.com/cds\\.crl0z0x1us1#0!adobe\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 75030000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}],"intel_graph":{"map":{"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1":{"type":"File","value":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60":{"type":"File","value":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},"File:535c383f7288251c273a457c95d5dbeec484938d5753f87e2ad241b7bc9a702b":{"type":"File","value":"535c383f7288251c273a457c95d5dbeec484938d5753f87e2ad241b7bc9a702b"},"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68":{"type":"File","value":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},"File:5c3fc5b9060907bab786c2864721a2448bcc39fcc3ca0641c8d6afe7a05df63e":{"type":"File","value":"5c3fc5b9060907bab786c2864721a2448bcc39fcc3ca0641c8d6afe7a05df63e"},"File:5dd4349f1558536bd9773f5e9ddd07ee290136b36ed57c3898c0d374106b0442":{"type":"File","value":"5dd4349f1558536bd9773f5e9ddd07ee290136b36ed57c3898c0d374106b0442"},"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e":{"type":"File","value":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},"File:7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486":{"type":"File","value":"7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486"},"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08":{"type":"File","value":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3":{"type":"File","value":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},"File:de6307982ed412de62734d1260c7ab2ccacfd69f7cb84581f4d35beb912f3dc6":{"type":"File","value":"de6307982ed412de62734d1260c7ab2ccacfd69f7cb84581f4d35beb912f3dc6"},"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483":{"type":"File","value":"e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483"},"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71":{"type":"File","value":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},"File:fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e":{"type":"File","value":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e"}},"chains":[{"id":"sandbox_files","root":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","edges":[{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:5c3fc5b9060907bab786c2864721a2448bcc39fcc3ca0641c8d6afe7a05df63e"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:535c383f7288251c273a457c95d5dbeec484938d5753f87e2ad241b7bc9a702b"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:5dd4349f1558536bd9773f5e9ddd07ee290136b36ed57c3898c0d374106b0442"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:de6307982ed412de62734d1260c7ab2ccacfd69f7cb84581f4d35beb912f3dc6"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},{"edge_kind":"extracted","from_key":"File:e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483","to_key":"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":47,"imported_dlls_count":124,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6adb0e3c6d3259ca9d068a3b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"MV AE MERCURY _ AC POLYUMETCORE _ CP DD 06-10-26 _ INITIAL FREIGHT INVOICE_MV.AE MERCURY INITIAL FREIGHT INVOICE.pdf","analysis_start_time":"2026-10-23T07:35:25+00:00","indicators_count":{"informative":20,"suspicious":0,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}],"processes":[{"pid":9128,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\MVAEMERCURY_ACPOLYUMETCORE_CPDD06-10-26_INITIALFREIGHTINVOICE_MV.AEMERCURYINITIALFREIGHTINVOICE.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00000000-00009128","icon":"$2b"}],"all_imported_dlls":["msvcr100.dll","TextShaping.dll","rsaenh.dll","user32.dll","AGM.dll","ieframe.dll","rasadhlp.dll","iertutil.dll","BIB.dll","twinapi.appcore.dll","thumbcache.dll","winmmbase.dll","ntmarta.dll","clbcatq.dll","avrt.dll","ccme_base.dll","kernel32.dll","samcli.dll","sqlite.dll","MMDevAPI.dll","shlwapi.dll","WindowsCodecs.dll","msvcp110_win.dll","ccme_base_non_fips.dll","oleaut32.dll","shell32.dll","cryptsp.dll","winnsi.dll","gdi32.dll","combase.dll","dcomp.dll","dpapi.dll","AXSLE.dll","wow64.dll","rpcrt4.dll","srvcli.dll","AdobeXMP.dll","winhttp.dll","mlang.dll","ole32.dll","sspicli.dll","msimg32.dll","advapi32.dll","wininet.dll","wow64cpu.dll","uxtheme.dll","bcryptprimitives.dll","profapi.dll","devobj.dll","policymanager.dll","ccme_asym.dll","CoreMessaging.dll","mpr.dll","WinTypes.dll","comdlg32.dll","netapi32.dll","OnDemandConnRouteHelper.dll","psapi.dll","KernelBase.dll","SHCore.dll","CoreUIComponents.dll","nsi.dll","mscms.dll","version.dll","comctl32.dll","secur32.dll","mswsock.dll","dsound.dll","wkscli.dll","cfgmgr32.dll","imm32.dll","CoolType.dll","apphelp.dll","gdi32full.dll","urlmon.dll","crypt32.dll","winmm.dll","IPHLPAPI.DLL","cryptocme.dll","wow64win.dll","bcrypt.dll","wldp.dll","sechost.dll","msvcp_win.dll","windows.storage.dll","coloradapterclient.dll","gpapi.dll","win32u.dll","DataExchange.dll","ksuser.dll","dwmapi.dll","ws2_32.dll","NPSWF32.dll","propsys.dll","SensApi.dll","msasn1.dll","userenv.dll","TextInputFramework.dll","umpdc.dll","GdiPlus.dll","wsock32.dll","msvcrt.dll","ACE.dll","AXE8SharedExpat.dll","AcGenral.dll","msacm32.dll","msvcp100.dll","kernel.appcore.dll","FWPUCLNT.DLL","netutils.dll","dnsapi.dll","ccme_ecdrbg.dll","coml2.dll","ucrtbase.dll","AcroRd32.dll","ccme_ecc.dll","ntdll.dll","msctf.dll","d3d11.dll","dxgi.dll","cryptbase.dll","BIBUtils.dll","powrprof.dll","schannel.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"GlobSettings","sha256":"7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Annss.dat","sha256":"5c3fc5b9060907bab786c2864721a2448bcc39fcc3ca0641c8d6afe7a05df63e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Annssi.dat","sha256":"535c383f7288251c273a457c95d5dbeec484938d5753f87e2ad241b7bc9a702b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Annssk.dat","sha256":"5dd4349f1558536bd9773f5e9ddd07ee290136b36ed57c3898c0d374106b0442","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"AdobeFnt14.lst.9128","sha256":"de6307982ed412de62734d1260c7ab2ccacfd69f7cb84581f4d35beb912f3dc6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"A9Rijz4ws_4g9mrr_71k.tmp","sha256":"fa5fdebe80ec0ce7dc40738b4fd46a9e9b36eca6a810c523ee6ef3fd40b4179e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"A9Rzbejxs_4g9mrs_71k.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"FAPB1F4.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}],"files_written":[{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%TEMP%\\FAPB1F4.tmp","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\AdobeFnt14.lst.9128","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.9128","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:9128:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x000023A8)","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Local\\SM0:9128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"SM0:9128:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"SM0:9128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCCECHIKDCAAAA","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"DirectSound DllMain mutex (0x000023A8)","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCCECHIKDCAAAA","sources":[{"report_type":"sandbox","report_id":"6adb0e3c6d3259ca9d068a3b"}]}]}},"report_ids":{"sandbox_job_ids":["6adb0e3c6d3259ca9d068a3b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample e5cfcae0d940… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample e5cfcae0d940…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483"}],["$","meta","4",{"property":"og:title","content":"Sample e5cfcae0d940… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample e5cfcae0d940…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e5cfcae0d940a1afacc20d671eb6dc2e5b8d2589b6fd4b079377668ec651c483"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample e5cfcae0d940… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample e5cfcae0d940…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]