34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3e:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T422,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample f25b256a515f… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample f25b256a515f…. Threat score 35/100. 0/1 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f25b256a515fa81fceeb4a457224d64273f7879ac351b28e6966cd74240b113e","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","f25b256a515fa81fceeb4a457224d64273f7879ac351b28e6966cd74240b113e"],"about":{"@type":"SoftwareApplication","name":"https://youtu.be/lkilosU5DRg","applicationCategory":["url"],"identifier":"f25b256a515fa81fceeb4a457224d64273f7879ac351b28e6966cd74240b113e","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":1},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T461,"\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_2520" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IE_EarlyTabStart_0xddc_Mutex" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_ConnHashTable<2520>_HashTable_Mutex" "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IESQMMUTEX_0_303" "\Sessions\1\BaseNamedObjects\IsoScope_9d8_IESQMMUTEX_0_331" "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" "Local\InternetShortcutMutex" "IsoScope_9d8_IESQMMUTEX_0_519" "Local\VERMGMTBlockListFileMutex" "{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" "IsoScope_9d8_IESQMMUTEX_0_331" "IsoScope_9d8_IESQMMUTEX_0_303" "UpdatingNewTabPageData"37:T5b0,"urlblockindex_1_.bin" has type "data" "CC197601BE0898B7B0FCC91FA15D8A69_6C4A99C03E7DE4B6C6393A091F204A4D" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442" has type "data" "77EC63BDA74BD0D0E0426DC8F8008506" has type "data" "RecoveryStore._03A7B49B-C486-11EB-813B-08002729FF4A_.dat" has type "Composite Document File V2 Document Cannot read section info" "CC197601BE0898B7B0FCC91FA15D8A69_DAA9E7652F9F36F9A35083C91EB27B4A" has type "data" "3C428B1A3E5F57D887EC4B864FAC5DCC" has type "data" "Cab7F06.tmp" has type "Microsoft Cabinet archive data 60080 bytes 1 file" "048YB3ZD.txt" has type "ASCII text" "CC197601BE0898B7B0FCC91FA15D8A69_5C15EEFD51F4C86A8CBBA0B97444D31E" has type "data" "bullet_1_" has type "PNG image data 15 x 15 8-bit colormap non-interlaced" "CC197601BE0898B7B0FCC91FA15D8A69_8097077265718C875BE2D5F298D4475C" has type "data" "CC197601BE0898B7B0FCC91FA15D8A69_F723D0D37D81E5A99211112142A12F9F" has type "data" "M0_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 820x450 frames 3" "en-US.3" has type "data" "KFOlCnqEu92Fr1MmWUlfBBc-_1_.woff" has type "Web Open Font Format flavor 65536 length 20396 version 1.1" "2JLCT05LW2H3X4AXZRUL.temp" has type "data" "CC197601BE0898B7B0FCC91FA15D8A69_537A4028B18543FC9455A04244B7A1E7" has type "data" "red_x_1_" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced"38:T533e,Pattern match: "https://youtu.be/lkilosU5DRg" Pattern match: "https://youtu.be" Heuristic match: "cacerts.digicert.com" Heuristic match: "GET /DigiCertGlobalRootG2.crt HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: cacerts.digicert.com" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "googleads.g.doubleclick.net" Heuristic match: "i.ytimg.com" Heuristic match: "r3---sn-q4fl6ns6.googlevideo.com" Heuristic match: "r3---sn-q4fl6nsd.googlevideo.com" Heuristic match: "r3---sn-q4flrnl7.googlevideo.com" Heuristic match: "static.doubleclick.net" Pattern match: "www.youtube.com" Heuristic match: "youtu.be" Heuristic match: "yt3.ggpht.com" Pattern match: "https://www.youtube.com/watch?v=lkilosU5DRg&feature=youtu.be" Pattern match: "http://polymer.github.io/LICENSE.txt" Heuristic match: "id 0:Wa.get)&&void 0!==Xa?Xa:function(){return this.firstChild}; function ab(a){a=a.prototype;a.hasOwnProperty(replaceChildren)||Object.defineProperty(a,replaceChildren,{configurable:!0,enumerable:!0,writable:!0,value:function(b){for(var c=[],d=0;d=d.start&&b<=d.end)return;if(b===d.end+1){d.end+=1;return}}a.Ga.push(new Hta(b))}}; g.Sta=function(a,b){a=g.q(a.Ga);for(var c=a.next();!c.done;c=a.next())if(c=c.value,b>=c.start&&b<=c.end)ret" Pattern match: "d.Jc/1E3+c,f=e+d.durationMs/1E3;if" Pattern match: "a.policy.mp/(b+c);c=Math.min(c,d);a.policy.Cc&&e&&(c=Math.max(c,a.policy.Cc));return" Heuristic match: "done;d=c.next())d=d.value,b=Qd(b,d,a.C[d]);return b}; Mwa=function(a){var b={};Object.assign(b,a.C);return b}; Nwa=function(a,b){b=new ywa({eK:g.vf(b),drmSessionId:a.sessionId});a.W(heartbeatparams,b)}; Jwa=function(a,b,c){if(!a.Ha())if(b){a.ea();mU(a,o" Pattern match: "https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2iU5mko18DfdwK5611JIjbUhE,c" Heuristic match: "Vwa[a.l.flavor];f.videoId=a.videoData.videoId;f.cpn=a.videoData.clientPlaybackNonce;f.sessionId=a.sessionId;f.licenseRequest=g.vf(b.message);f.drmParams=a.videoData.drmParams;isNaN(a.cryptoPeriodIndex)||(f.isKeyRotated=!0,f.cryptoPeriodIndex=a.cryptoPeriod" Heuristic match: "function(d){d.createMediaKeys().then(function(e){kxa(a,e,c)})},null)}}; kxa=function(a,b,c){var d=b.createSession(),e=a.l.values[0],f=Mwa(e);d.addEventListener(message,function(h){h=new Uint8Array(h.message);$wa(h,d,a.i.u,f,playready)}); d.addEventList" Heuristic match: "e_readahead)&&(c.B=!0);g.S(b,html5_allowable_liveness_drift_chunks)&&(c.i=g.S(b,html5_allowable_liveness_drift_chunks));g.S(b,html5_readahead_ratelimit)&&(c.Va=g.S(b,html5_readahead_ratelimit));switch($F(a)){case 21530001:c.i=(c.i+1)/5,LOW===a.l" Heuristic match: ".B);if(g.VF(a.videoData)){var b=a.Db();b[native]=+ +a.va;b.tgt=+a.l;a.W(g.BB(b))}}; Qya=function(a){if(!a.Y)if(a.B)if(isFinite(a.l))a.ea(),a.Y=a.B.seek(a.l-a.timestampOffset);else{a.ea();var b=a.B;aU(b);b.B.seeking&&b.ea();b.C&&$va(b.C,b.videoTrack.i" Heuristic match: "map(t)})})})}; zza=function(a,b,c,d,e){var f=this;this.videoData=a;this.vj=b;this.playerRequest=c;this.L=d;this.visibilityState=e;this.xhr=null;this.l=new ER;this.C=!1;this.u=new g.J(this.UN,1E4,this);this.G=!1;this.i=a.T();this.B=this.i.kf;this.DI=new EV(" Pattern match: "e.Jc/1E3;break}d=b;a=g.q(a.i);for" Pattern match: "www.watch.lists.getState" Heuristic match: "e;fa=N.next()){fa=fa.value;var ya=ICa(a,H,fa,d,e,f,h,U);ya instanceof DX?Q(ya,void 0,void 0,{renderer:fa.renderer,config:fa.config.adPlacementConfig,kind:fa.config.adPlacementConfig.kind,contentCpn:d,daiEnabled:f}): I.push.apply(I,g.ma(ya))}if(null===a.C||" Heuristic match: "new hX([new lI(f)]),adSlotLoggingData:e}}; dCa=function(a,b,c,d){var e=dY(a.l.get(),SLOT_TYPE_IN_PLAYER);c=new uY(a.i,c);var f=[new yY(a.i,e)],h=[new zY(a.i,e),new wY(a.i,b)];f={slotId:e,ob:SLOT_TYPE_IN_PLAYER,slotPhysicalPosition:1,ib:core,Yb:c,xc:f" Heuristic match: "on(){this.listeners=new Set}; fEa=function(a,b,c,d,e){iH.call(this,image-companion,a,b,c,d,e)}; l_=function(a,b,c,d,e,f,h,l){lZ.call(this,a,b,c,d);this.Ua=e;this.xe=f;this.G=l;this.Ci=!0;this.u=null;this.B=X(c.Ia,metadata_type_linked_player_bytes_layout" Pattern match: "https://pagead2.googlesyndication.com/pagead/osd.js" Pattern match: "pm.adsafeprotected.com/youtube" Pattern match: "tpc.googlesyndication.com/sodar/%{path" Pattern match: "www.ads.eventcache.getLastCompanionData,function(){return" Pattern match: "https://admin.youtube.com,https://viacon.corp.google.com,https://yurt.corp.google.com].includes(b)||a.rj?cGa:bGa}else" Pattern match: "b.wj/1E3;null!=d&&" Pattern match: "https://support.google.com/youtube/?p=missing_quality,target:this.I.T().G},oa:Missing" Pattern match: "https://www.youtube.com/generate_204?cpn=+this.videoData.clientPlaybackNonce+" Pattern match: "https://youtubei.googleapis.com/youtubei/+I.innertubeApiVersion+/player?key=+I.innertubeApiKey;var" Pattern match: "https://+U+E.baseUrl" Pattern match: "this.C.Xa/1E3,0!==b" Pattern match: "www.watch.lists.next" Pattern match: "this.wj/1E3,!0" Pattern match: "https://ajax.googleapis.com/ajax/libs/spf/2.4.0/LICENSE" Heuristic match: ";)}return b?new Lc(b,Kc):Rc}; Qc=function(a){if(a instanceof g.Bc)return'url('+g.Cc(a).replace(/\n \n \n \n\n'; a.content.insertBefore(Y().content.cloneNode(!0),a.content.firstChild);var b=a.content,c=b.insertBefore;if(void 0===Tob){var d=document.createElement("template");d.innerHTML="\x3c!--css_build_mark:video.youtube.src.web.polymer.main_desktop.ui.ytd_ratings.ytd.ratings.css.js--\x3e"; Tob=d}d=Tob;c.call(b,d.content.cloneNode(!0),a.content.firstChild);Uob=a}a=Uob;return a}}}); var s4=r4;s4.prototype.percentChanged=s4.prototype.percentChanged;x([xG("#defs"),y("design:type",HTMLElement)],s4.prototype,"defs",void 0);x([xG("#rating"),y("design:type",HTMLElement)],s4.prototype,"rating",void 0);x([Q(),y("design:type",Number)],s4.prototype,"percent",void 0);x([Q({value:6}),y("design:type",Number)],s4.prototype,"spacing",void 0);x([Q({value:yw.create("iron-meta",{type:"iconset"})}),y("design:type",cI)],s4.prototype,"meta",void 0); x([S("percent"),y("design:type",Function),y("design:paramtypes",[]),y("design:returntype",void 0)],s4.prototype,"percentChanged",null);s4=x([U({is:"ytd-ratings"})],s4);var Vob=function(){return N.apply(this,arguments)||this}; n(Vob,N); g.Object.defineProperties(Vob,{template:{configurable:!0,enumerable:!0,get:function(){if(void 0===Sob){var a=document.createElement("template");a.innerHTML='\x3c!--css_build_scope:ytd-offer-review-renderer--\x3e\x3c!--css_build_styles:video.youtube.src.web.polymer.shared.ui.styles.yt_base_styles.yt.base.styles.css.js,video.youtube.src.web.polymer.main_desktop.ui.renderers.watch_next.ytd_offer_review_renderer.ytd.offer.review.renderer.css.js--\x3e\n\n-\n\n';a.content.insertBefore(Y().content.cloneNode(!0), a.content.firstChild);var b=a.content,c=b.insertBefore;if(void 0===Rob){var d=document.createElement("template");d.innerHTML="\x3c!--css_build_mark:video.youtube.src.web.polymer.main_desktop.ui.renderers.watch_next.ytd_offer_review_renderer.ytd.offer.review.renderer.css.js--\x3e"; Rob=d}d=Rob;c.call(b,d.content.cloneNode(!0),a.content.firstChild);Sob=a}a=Sob;return a}}}); var t4=Vob;x([P(X.YtRendererBehavior),y("design:type",Object)],t4.prototype,"ytRendererBehavior",void 0);x([Q(),y("design:type",Object)],t4.prototype,"data",void 0);t4=x([U({is:"ytd-offer-review-renderer"})],t4);var u4=function(){var a=N.apply(this,arguments)||this;a.badges=[{textBadge:{label:Xo("CC")}}];return a}; n(u4,N);f=u4.prototype;f.configureRendererStamper=function(){return{"data.storefrontEntryPoint":{id:"storefront-entry-point",mapping:{compactTvfilmEntryPointRenderer:"ytd-compact-tvfilm-entry-point-renderer"}}}}; f.dataChanged=function(){var a=this.get("data.offerButton.buttonRenderer.serviceEndpoint");a&&a.commandMetadata&&a.commandMetadata.webHandleServiceEndpointExtension&&a.commandMetadata.webHandleServiceEndpointExtension.fireAutomatically?this.actionSenderBehavior.sendServiceRequestAction([a]):a&&a.webHandleServiceEndpointExtension&&a.webHandleServiceEndpointExtension.fireAutomatically&&this.actionSenderBehavior.sendServiceRequestAction([a])}; f.isEmptyContent=function(a){return this.isStorefrontEntryPointEmpty(a)&&this.shouldHideOfferModule(a)}; f.isStorefrontEntryPointEmpty=function(a){return!a||!a.storefrontEntryPoint}; f.shouldHideOfferModule=function(a){return!!a.hideVideoDetails}; f.isOfferModuleNavigationInactive=function(a){return!a.navigationEndpoint&&!a.serviceEndpoint}; f.maybeNavigateWithServiceEndpoint=function(){this.data&&this.data.navigationEndpoint||this.data&&this.data.serviceEndpoint&&this.actionSenderBehavior.sendServiceRequestAction([this.data.serviceEndpoint])}; g.Object.defineProperties(u4,{template:{configurable:!0,enumerable:!0,get:function(){if(void 0===Qob){var a=document.createElement("template");a.innerHTML='\x3c!--css_build_scope:ytd-movie-offer-module-renderer--\x3e\x3c!--css_build_styles:video.youtube.src.web.polymer.shared.ui.styles.yt_base_styles.yt.base.styles.css.js,video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_movie_offer_module_renderer.ytd.movie.offer.module.renderer.css.js--\x3e\n\n'; a.content.insertBefore(Y().content.cloneNode(!0),a.content.firstChild);var b=a.content,c=b.insertBefore;if(void 0===Pob){var d=document.createElement("template");d.innerHTML="\x3c!--css_build_mark:video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_movie_offer_module_renderer.ytd.movie.offer.module.renderer.css.js--\x3e"; Pob=d}d=Pob;c.call(b,d.content.cloneNode(!0),a.content.firstChild);Qob=a}a=Qob;return a}}}); var v4=u4;v4.prototype.dataChanged=v4.prototype.dataChanged;x([P(X.YtRendererBehavior),y("design:type",Object)],v4.prototype,"ytRendererBehavior",void 0);x([P(Z.YtRendererstamperBehavior),y("design:type",Object)],v4.prototype,"ytRendererstamperBehavior",void 0);x([P(V.YtActionSenderBehavior),y("design:type",Object)],v4.prototype,"actionSenderBehavior",void 0);x([Q(),y("design:type",Object)],v4.prototype,"data",void 0); x([Q({reflectToAttribute:!0,computed:"isEmptyContent(data)"}),y("design:type",Boolean)],v4.prototype,"hidden",void 0);x([Q(),y("design:type",Object)],v4.prototype,"badges",void 0);x([S("data"),y("design:type",Function),y("design:paramtypes",[]),y("design:returntype",void 0)],v4.prototype,"dataChanged",null);v4=x([U({is:"ytd-movie-offer-module-renderer"})],v4);var Wob;var Xob;var Yob;var Zob;var $ob=function(){return N.apply(this,arguments)||this}; n($ob,N); g.Object.defineProperties($ob,{template:{configurable:!0,enumerable:!0,get:function(){if(void 0===Zob){var a=document.createElement("template");a.innerHTML='\x3c!--css_build_scope:ytd-metadata-line-renderer--\x3e\x3c!--css_build_styles:video.youtube.src.web.polymer.shared.ui.styles.yt_base_styles.yt.base.styles.css.js,video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_metadata_line_renderer.ytd.metadata.line.renderer.css.js--\x3e

\n \n \n

\n';a.content.insertBefore(Y().content.cloneNode(!0), a.content.firstChild);var b=a.content,c=b.insertBefore;if(void 0===Yob){var d=document.createElement("template");d.innerHTML="\x3c!--css_build_mark:video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_metadata_line_renderer.ytd.metadata.line.renderer.css.js--\x3e"; Yob=d}d=Yob;c.call(b,d.content.cloneNode(!0),a.content.firstChild);Zob=a}a=Zob;return a}}}); var apb=$ob;x([Q(),y("design:type",Object)],apb.prototype,"data",void 0);apb=x([U({is:"ytd-metadata-line-renderer"})],apb);var bpb=function(){return N.apply(this,arguments)||this}; n(bpb,N); g.Object.defineProperties(bpb,{template:{configurable:!0,enumerable:!0,get:function(){if(void 0===Xob){var a=document.createElement("template");a.innerHTML='\x3c!--css_build_scope:ytd-media-masthead-renderer--\x3e\x3c!--css_build_styles:video.youtube.src.web.polymer.shared.ui.styles.yt_base_styles.yt.base.styles.css.js,video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_media_masthead_renderer.ytd.media.masthead.renderer.css.js--\x3e\n';a.content.insertBefore(Y().content.cloneNode(!0), a.content.firstChild);var b=a.content,c=b.insertBefore;if(void 0===Wob){var d=document.createElement("template");d.innerHTML="\x3c!--css_build_mark:video.youtube.src.web.polymer.main_desktop.ui.renderers.tvfilm.ytd_media_masthead_renderer.ytd.media.masthead.renderer.css.js--\x3e