26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T465,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Comet.A Sample fe892c485599… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample fe892c485599…. Malware family: Comet.A. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","keywords":["Malicious","Comet.A","malware analysis","sandbox report","threat intelligence","fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6"],"about":{"@type":"SoftwareApplication","name":"download","applicationCategory":["peexe","executable"],"identifier":"fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Comet.A","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7e09,Found reference to API (Indicator: "Toolhelp32ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStockObject"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMenu"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "sample.bin"), Found reference to API (Indicator: "getservbyport"; Source: "sample.bin"), Found reference to API (Indicator: "SysAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayPtrOfIndex"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GetAcceptExSockaddrs"; Source: "sample.bin"), Found reference to API (Indicator: "IsIconic"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIconEx"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowEnabled"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteMenu"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyState"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemID"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "OffsetRect"; Source: "sample.bin"), Found reference to API (Indicator: "getprotobyname"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "getservbyname"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "DrawEdge"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "sample.bin"), Found reference to API (Indicator: "closesocket"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "UnregisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "IsChild"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteExA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "ntohl"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveMenu"; Source: "sample.bin"), Found reference to API (Indicator: "ntohs"; Source: "sample.bin"), Found reference to API (Indicator: "SystemParametersInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "getsockname"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "DefFrameProcA"; Source: "sample.bin"), Found reference to API (Indicator: "VariantInit"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdW"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassNameByClassIdA"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetIconInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalHandle"; Source: "sample.bin"), Found reference to API (Indicator: "InflateRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharLowerA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "ShowOwnedPopups"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAddressToStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAddressToStringW"; Source: "sample.bin"), Found reference to API (Indicator: "WSACancelAsyncRequest"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAIoctl"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "__WSAFDIsSet"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyIcon"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "CharToOemA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDIBits"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RedrawWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseCapture"; Source: "sample.bin"), Found reference to API (Indicator: "CharLowerBuffA"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteDC"; Source: "sample.bin"), Found reference to API (Indicator: "EndUpdateResourceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDCEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemCount"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuItemInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceNextA"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateIcon"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceNextW"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayGetLBound"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteObject"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToDosDateTime"; Source: "sample.bin"), Found reference to API (Indicator: "BeginUpdateResourceA"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32Next"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetQosByName"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SetScrollInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFindAtomA"; Source: "sample.bin"), Found reference to API (Indicator: "SetClassLongA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyMenu"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyNameTextA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncSelect"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuState"; Source: "sample.bin"), Found reference to API (Indicator: "WSAInstallServiceClassA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAInstallServiceClassW"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetParent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCapture"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceBeginA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowPlacement"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceBeginW"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenu"; Source: "sample.bin"), Found reference to API (Indicator: "EnableMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtomA"; Source: "sample.bin"), Found reference to API (Indicator: "InsertMenuA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColorBrush"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPropA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "WSASetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClipboardFormatA"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "GetScrollPos"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetParent"; Source: "sample.bin"), Found reference to API (Indicator: "RemovePropA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "WSACleanup"; Source: "sample.bin"), Found reference to API (Indicator: "InternetGetConnectedState"; Source: "sample.bin"), Found reference to API (Indicator: "OpenMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalDrives"; Source: "sample.bin"), Found reference to API (Indicator: "InternetCloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "ShowScrollBar"; Source: "sample.bin"), Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListNext"; Source: "sample.bin"), Found reference to API (Indicator: "SetMenuItemInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "DrawIcon"; Source: "sample.bin"), Found reference to API (Indicator: "GetObjectA"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "OemToCharA"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "RegFlushKey"; Source: "sample.bin"), Found reference to API (Indicator: "SetScrollRange"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "InternetReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExA"; Source: "sample.bin"), Found reference to API (Indicator: "VariantClear"; Source: "sample.bin"), Found reference to API (Indicator: "ShowCursor"; Source: "sample.bin"), Found reference to API (Indicator: "MapWindowPoints"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "sample.bin"), Found reference to API (Indicator: "WSARecvEx"; Source: "sample.bin"), Found reference to API (Indicator: "FrameRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetFocus"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSysColor"; Source: "sample.bin"), Found reference to API (Indicator: "InsertMenuItemA"; Source: "sample.bin"), Found reference to API (Indicator: "StretchBlt"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API (Indicator: "htons"; Source: "sample.bin"), Found reference to API (Indicator: "htonl"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMenu"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetServByName"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStringToAddressW"; Source: "sample.bin"), Found reference to API (Indicator: "GetErrorInfo"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStringToAddressA"; Source: "sample.bin"), Found reference to API (Indicator: "SelectObject"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowDC"; Source: "sample.bin"), Found reference to API (Indicator: "InvalidateRect"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysReAllocStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "LoadKeyboardLayoutA"; Source: "sample.bin"), Found reference to API (Indicator: "WSASend"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetMalloc"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetServByPort"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "DrawTextA"; Source: "sample.bin"), Found reference to API (Indicator: "WindowFromPoint"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingA"; Source: "sample.bin"), Found reference to API (Indicator: "VariantCopy"; Source: "sample.bin"), Found reference to API (Indicator: "InternetOpenUrlA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualRect"; Source: "sample.bin"), Found reference to API (Indicator: "IntersectRect"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WSALookupServiceEnd"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetClientRect"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SetScrollPos"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardState"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadIconA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardLayout"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "DrawMenuBar"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "WinHelpA"; Source: "sample.bin"), Found reference to API (Indicator: "BeginPaint"; Source: "sample.bin"), Found reference to API (Indicator: "GetScrollRange"; Source: "sample.bin"), Found reference to API (Indicator: "GetTextMetricsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayCreate"; Source: "sample.bin"), Found reference to API (Indicator: "CheckMenuItem"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "MapVirtualKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "AnimateWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursorPos"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "FillRect"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "VariantCopyInd"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetHostByName"; Source: "sample.bin"), Found reference to API (Indicator: "ScrollWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyaddr"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "WaitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowsHookExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetMenuStringA"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetHostByAddr"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "SetStretchBltMode"; Source: "sample.bin"), Found reference to API (Indicator: "getpeername"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "WSARemoveServiceClass"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "SetErrorMode"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "SetRect"; Source: "sample.bin"), Found reference to API (Indicator: "SetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetTopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateResourceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetScrollInfo"; Source: "sample.bin"), Found reference to API (Indicator: "getsockopt"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "IsRectEmpty"; Source: "sample.bin"), Found reference to API (Indicator: "SetPropA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "DefMDIChildProcA"; Source: "sample.bin"), Found reference to API (Indicator: "ClientToScreen"; Source: "sample.bin"), Found reference to API (Indicator: "GetCursor"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSubMenu"; Source: "sample.bin"), Found reference to API (Indicator: "PtInRect"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "PostMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameA"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32ListFirst"; Source: "sample.bin"), Found reference to API (Indicator: "EnableScrollBar"; Source: "sample.bin"), Found reference to API (Indicator: "TransmitFile"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetProtoByName"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API (Indicator: "WSASocketA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetClassNameA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "ActivateKeyboardLayout"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "TrackPopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "AcceptEx"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSolidBrush"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "Heap32First"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "getprotobynumber"; Source: "sample.bin"), Found reference to API (Indicator: "DrawFrameControl"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "ScreenToClient"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetClipboardData"; Source: "sample.bin"), Found reference to API (Indicator: "recvfrom"; Source: "sample.bin"), Found reference to API (Indicator: "SafeArrayGetUBound"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFontIndirectA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDateFormatA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncGetProtoByNumber"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePopupMenu"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "VariantChangeType"; Source: "sample.bin"), Found reference to API (Indicator: "IsZoomed"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "ioctlsocket"; Source: "sample.bin"), Found reference to API (Indicator: "IsDialogMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowA"; Source: "sample.bin"), Found reference to API (Indicator: "CallNextHookEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadBitmapA"; Source: "sample.bin"), Found reference to API (Indicator: "KillTimer"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "EnumThreadWindows"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetServiceClassInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T527,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "Module32Next" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "sample.bin"), Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "sample.bin"), Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Module32First" (Indicator: "Module32First"; Source: "sample.bin"), Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "sample.bin"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "sample.bin"), Found reference to API "Process32First" (Indicator: "Process32First"; Source: "sample.bin")29:T5d2,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "sample.bin"), Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "sample.bin"), Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "sample.bin"), Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "sample.bin"), Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API "gethostname" (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API "WSAAsyncGetHostByName" (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API "No data to read.$Can not bind in port range (%d - %d)" (Indicator: " bind "; Source: "sample.bin"), Found reference to API "Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Socket is not connected..Cannot send or receive after socket is closed.#Too many references, cannot splice." (Indicator: " send "; Source: "sample.bin"), Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API "Connection Closed Gracefully.;Could not bind socket. Address and port are already in use.4Failed attempting to retrieve time zone information." (Indicator: " bind "; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791737728066,"unified_at":"2026-10-11T16:55:28.066Z","metadata":{"hashes":{"sha256":"fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","sha1":"6fe767347543cf94386c17d98306ffd2798b2438","md5":"19f88273e1076a090e4ec439c2ee560c","imphash":"332f7ce65ead0adfb3d35147033aabe9","pehash":"329d271f96a09567a863c08a7efd2d019868799f"},"file_info":{"file_name":"download","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4404736,"entropy":7.92,"compile_timestamp":"1992-06-19T22:22:17","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1787687303000,"last_seen":1788147116000,"last_multi_scan":1788147116000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":8,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":"CODE","virtual_address":"0x1000","virtual_size":629740,"raw_size":629760},{"name":"DATA","virtual_address":"0x9b000","virtual_size":11860,"raw_size":12288},{"name":"BSS","virtual_address":"0x9e000","virtual_size":4581},{"name":".idata","virtual_address":"0xa0000","virtual_size":10818,"raw_size":11264},{"name":".tls","virtual_address":"0xa3000","virtual_size":16},{"name":".rdata","virtual_address":"0xa4000","virtual_size":57,"raw_size":512},{"name":".reloc","virtual_address":"0xa5000","virtual_size":43392,"raw_size":43520},{"name":".rsrc","virtual_address":"0xb0000","virtual_size":3705984,"raw_size":3706368}],"section_names":["CODE","DATA","BSS",".idata",".tls",".rdata",".reloc",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":57},"sandbox_signatures":{"informative_count":101,"suspicious_count":2,"malicious_count":2,"total":105},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Zorex.X1799","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.DarkKomet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"DR/Delphi.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Comet.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Agen-8002901-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Comet.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Delf.NBX virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"W32.Delf.NBX.jczl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Downloader.mz!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Synares.a$SA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DarkKomet.tp6k","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/XRedRAT-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/Synaptics","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.YMOP-5085","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr22.OHM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Agent.DE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Delf.Win32.76144","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Comet.A","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"NAPWHICH","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Replication Through Removable Media","attack_id":"T1091","attack_id_wiki":"https://attack.mitre.org/techniques/T1091","identifiers":[{"type":"suspicious","value":"Has the ability to infect usb drives"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"Software\\\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecute=\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\"), Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"xredline1@gmail.com\", Pattern match: \"xredline2@gmail.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /C \" (Indicator: \"cmd.exe /c\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-174","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"MAPI32.DLL\" (Indicator: \"MAPI32.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1137","id":"string-571","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"sample.bin\"), Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-91","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeSystemProfilePrivilege\" (Indicator: \"SeSystemProfilePrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Has the ability to infect usb drives","description":"\"autorun.inf\" (Indicator: \"autorun.inf\") in Source: sample.bin, \"[autorun]\" (Indicator: \"[autorun]\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1091","id":"string-175","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"sample.bin\"), Found reference to API \"GetKeyNameTextA\" (Indicator: \"GetKeyNameText\"; Source: \"sample.bin\"), Found reference to API \"MapVirtualKeyExA\" (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\"), Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"sample.bin\"), Found reference to API \"MapVirtualKeyA\" (Indicator: \"MapVirtualKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-88","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegNotifyChangeKeyValue\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\"), Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; Source: \"sample.bin\"), Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"sample.bin\"), Found reference to API \"GetDCOrgEx\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"No route to host.\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"Resolving hostname %s.\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-84","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-532","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Could not load certificate.#Could not load key, check password.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-915","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\"), Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\"), Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-539","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvDisconnect\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecvEx\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSASendDisconnect\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"smtp.gmail.com\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"smtp.gmail.com\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"TIdSMTP\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"IdSMTP\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"smtp.gmail.com\", Pattern match: \"https://docs.google.com/uc?id=0bxsmxgfpizfsvlvsoglevgxuzvk&export=download\", Pattern match: \"https://www.dropbox.com/s/n1w4p8gc6jzo0sg/supdate.ini?dl=1\", Pattern match: \"https://www.dropbox.com/s/fzj752whr3ontsm/ssllibrary.dll?dl=1\", Pattern match: \"http://xred.site50.net/syn/ssllibrary.dll\", Pattern match: \"https://www.dropbox.com/s/zhp1b06imehwylq/synaptics.rar?dl=1\", Pattern match: \"http://xred.site50.net/syn/synaptics.rar\", Pattern match: \"http://xred.site50.net/syn/supdate.ini\", Heuristic match: \"xredline1@gmail.com\", Pattern match: \"http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978\", Pattern match: \"https://docs.google.com/uc?id=0bxsmxgfpizfstmlvykxhsdg5tzq&export=download\", Heuristic match: \"xred.mooo.com\", Pattern match: \"afraid.org/api\", Heuristic match: \"xredline2@gmail.com;xredline3@gmail.com\", Pattern match: \"https://docs.google.com/uc?id=0bxsmxgfpizfsvzuyahfyvkqxefk&export=download\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download\" (Indicator: \"docs.google.com\"; Source: \"sample.bin\"), Found string \"https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download\" (Indicator: \"docs.google.com\"; Source: \"sample.bin\"), Found string \"https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download\" (Indicator: \"docs.google.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://docs.google.com\", Found HTTPS url \"https://www.dropbox.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\", \"0.0.0.1\", \"1.0.0.4\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-241","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"xredline1@gmail.com\" (Indicator: \"@gmail.\"; Source: \"sample.bin\"), Found reference to API \"xredline2@gmail.com;xredline3@gmail.com\" (Indicator: \"@gmail.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-248","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowTextLengthA\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfo\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoW\" in \"sample.bin\", Found system information discovery API: \"GetMonitorInfoA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"PostMessageA\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\"), Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"sample.bin\"), Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"sample.bin\"), Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Reg -> \" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Size Exceeded.\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-901","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"OpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"Domain:451ebbe1c8f95384bd1b076cb98f737936946559303dabc6072e8518f6c18367":{"type":"Domain","value":"docs.google.com","verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},"File:02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b":{"type":"File","value":"02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:08dc3437090874c9586587dc667be41c34d9250dc6fa19f77d701a5d850c282e":{"type":"File","value":"08dc3437090874c9586587dc667be41c34d9250dc6fa19f77d701a5d850c282e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 87 x 63, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:0f83ad2bb1aa2b81f6eaab36293a84720235f80576f1d09fef168d4d2ba22f21":{"type":"File","value":"0f83ad2bb1aa2b81f6eaab36293a84720235f80576f1d09fef168d4d2ba22f21","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 8, image size 146, resolution 2834 x 2834 px/m, 53 important colors, cbSize 412, bits offset 266","filetype_short":"BMP","mime_type":"image/bmp"},"File:105c6d2f5daa488c3bb3ce563bd745414331b9c48ab9031b7c7a644716d3dbc9":{"type":"File","value":"105c6d2f5daa488c3bb3ce563bd745414331b9c48ab9031b7c7a644716d3dbc9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 249 x 1, 8-bit/color RGB, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:140b6d96ee0bef6917ee2e2f04057426f62b7a750b480515b6e83a43cc347b13":{"type":"File","value":"140b6d96ee0bef6917ee2e2f04057426f62b7a750b480515b6e83a43cc347b13","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 74 x 82, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0":{"type":"File","value":"17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0","filetype":"ISO-8859 text, with no line terminators","filetype_short":"ISO8859TEXT","mime_type":"application/octet-stream"},"File:1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5":{"type":"File","value":"1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:1ab315c00c6d12c7bad2da843bde992d98dcabff8fb291491cb49da8df4068fa":{"type":"File","value":"1ab315c00c6d12c7bad2da843bde992d98dcabff8fb291491cb49da8df4068fa","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:1b2217da42989d271a22ac4235de3ef33b53633e24a7466eaa975ed8d05ba6bd":{"type":"File","value":"1b2217da42989d271a22ac4235de3ef33b53633e24a7466eaa975ed8d05ba6bd","filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:1df7ada2023179df21331b49955adcf4e716f59ea40cb855523459089b00516c":{"type":"File","value":"1df7ada2023179df21331b49955adcf4e716f59ea40cb855523459089b00516c","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 24, image size 432, cbSize 486, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde":{"type":"File","value":"1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309":{"type":"File","value":"1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40":{"type":"File","value":"1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:20a62c9d9199698ba316567c0f63d0d28a9a076bedb3eb5323d997e2eb5a3061":{"type":"File","value":"20a62c9d9199698ba316567c0f63d0d28a9a076bedb3eb5323d997e2eb5a3061","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 180 x 15, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6":{"type":"File","value":"214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:266b6d714ef60cfe2d740385c00cde52d7e563f92380f7ae9f203ad2a0014cf1":{"type":"File","value":"266b6d714ef60cfe2d740385c00cde52d7e563f92380f7ae9f203ad2a0014cf1","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 120 x 15, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:2b9c6ee9f967b6091c6ea786ab0146235c4c22fcc8d994f069a51f8d47430288":{"type":"File","value":"2b9c6ee9f967b6091c6ea786ab0146235c4c22fcc8d994f069a51f8d47430288","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"MS Windows icon resource - 6 icons, 256x256, 32 bits/pixel, -128x-128, 32 bits/pixel","filetype_short":"ICO","mime_type":"image/vnd.microsoft.icon"},"File:2c95f20bc44cd43d21670ecf55d763f0f8ae1a7f5124c3c42e36dd769a36351e":{"type":"File","value":"2c95f20bc44cd43d21670ecf55d763f0f8ae1a7f5124c3c42e36dd769a36351e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 16 x 16 x 8, image size 256, cbSize 1334, bits offset 1078","filetype_short":"BMP","mime_type":"image/bmp"},"File:2d7fcf748c620a92cecfa549205c821a9efb6a3959742766218f22eae5fede4d":{"type":"File","value":"2d7fcf748c620a92cecfa549205c821a9efb6a3959742766218f22eae5fede4d","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 188 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:3102da9330e700d895957cf4381a38fd17af3ed0275aa1119ae1da07dea4ea69":{"type":"File","value":"3102da9330e700d895957cf4381a38fd17af3ed0275aa1119ae1da07dea4ea69","filetype":"Generic INItialization configuration [setting]","mime_type":"text/plain"},"File:3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389":{"type":"File","value":"3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:3387ea79c3a7ae024f14dbce2dcbf1d1de349cbc53ef4059d38ddd311a05ec18":{"type":"File","value":"3387ea79c3a7ae024f14dbce2dcbf1d1de349cbc53ef4059d38ddd311a05ec18","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 13 x 13 x 8, image size 208, cbSize 1286, bits offset 1078","filetype_short":"BMP","mime_type":"image/bmp"},"File:33b82c3fe72a34ee4677d14a06e18e966f867806195782253b337b177cb91c8e":{"type":"File","value":"33b82c3fe72a34ee4677d14a06e18e966f867806195782253b337b177cb91c8e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade":{"type":"File","value":"39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5":{"type":"File","value":"401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:40c6dfc0d9ac853df3b4e210ae23046d40ba6162a56cc7d8550df2e265ccbaa8":{"type":"File","value":"40c6dfc0d9ac853df3b4e210ae23046d40ba6162a56cc7d8550df2e265ccbaa8","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 32 x 8, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:43177d0ee2337b8984057e3889896cd92d6b57dab6c94c2ea8830607e8dfd947":{"type":"File","value":"43177d0ee2337b8984057e3889896cd92d6b57dab6c94c2ea8830607e8dfd947","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 17 x 68, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:4339e9046b1509a0c52a231b4acdf7e0facace915fe52924d3a63eec0cdf62d9":{"type":"File","value":"4339e9046b1509a0c52a231b4acdf7e0facace915fe52924d3a63eec0cdf62d9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 68 x 17, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:462be4956a37fd09d41574e407da47563a815220bee7da1b672f5e156c26fe94":{"type":"File","value":"462be4956a37fd09d41574e407da47563a815220bee7da1b672f5e156c26fe94","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 16 x 16 x 8, image size 256, cbSize 1334, bits offset 1078","filetype_short":"BMP","mime_type":"image/bmp"},"File:4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b":{"type":"File","value":"4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:494187ea526824eb1db4cc72edaa6f8143c3cdcc47c85204b5c4c783a54b1e34":{"type":"File","value":"494187ea526824eb1db4cc72edaa6f8143c3cdcc47c85204b5c4c783a54b1e34","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 39 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:4b95167dedef0c431a779932783ecea7fcb0564b8488b53bd0a0cc031b410dc9":{"type":"File","value":"4b95167dedef0c431a779932783ecea7fcb0564b8488b53bd0a0cc031b410dc9","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 86 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc":{"type":"File","value":"4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc","filetype":"XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators","filetype_short":"XML","mime_type":"text/plain"},"File:4dd88369ebd9f1103f58b015414aa7ef2e3285b991b2ba570dfc5bb3ded03383":{"type":"File","value":"4dd88369ebd9f1103f58b015414aa7ef2e3285b991b2ba570dfc5bb3ded03383","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 13 x 18, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:4f6cb897cc1711191bec262db0433808e2d9ffc7d235a228b0d47ab8c4bb503a":{"type":"File","value":"4f6cb897cc1711191bec262db0433808e2d9ffc7d235a228b0d47ab8c4bb503a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"GIF image data, version 89a, 32 x 32","filetype_short":"GIF","mime_type":"image/gif"},"File:4fe85d21c78cb4353f5d8af5eb32b7c8c9be9adcf810cab481f3a9730c9649d5":{"type":"File","value":"4fe85d21c78cb4353f5d8af5eb32b7c8c9be9adcf810cab481f3a9730c9649d5","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 360 x 50, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f":{"type":"File","value":"50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:53b4ae417a53464808f95ec7902ec287af65ea529dbd96adc793ee8c9c05493f":{"type":"File","value":"53b4ae417a53464808f95ec7902ec287af65ea529dbd96adc793ee8c9c05493f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 13 x 13 x 8, image size 208, cbSize 1286, bits offset 1078","filetype_short":"BMP","mime_type":"image/bmp"},"File:5667b05787d159d9f5201f6fca43809696c75806ba0366b080cd9e8dd5de0e45":{"type":"File","value":"5667b05787d159d9f5201f6fca43809696c75806ba0366b080cd9e8dd5de0e45","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"GIF image data, version 89a, 7 x 48","filetype_short":"GIF","mime_type":"image/gif"},"File:585e7a117be3ef2e8649c30a8335a9fcf7bf1c4ad836e663b44e46ef99b317fb":{"type":"File","value":"585e7a117be3ef2e8649c30a8335a9fcf7bf1c4ad836e663b44e46ef99b317fb","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 188 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:5a5941b355ce4a168e033576804602b518889bc40cb0329533f532d580a5a5d0":{"type":"File","value":"5a5941b355ce4a168e033576804602b518889bc40cb0329533f532d580a5a5d0","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 82x24, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6":{"type":"File","value":"6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:6424fd8bd6af0716fdb09a168bcfd788aee778f16a6a1f8790fc252ba7c458fc":{"type":"File","value":"6424fd8bd6af0716fdb09a168bcfd788aee778f16a6a1f8790fc252ba7c458fc","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 6 x 26 x 24, image size 522, resolution 2834 x 2834 px/m, cbSize 576, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:6682679d4fe2d8f0d78244197408f44c210825766436504563f21c17bd458290":{"type":"File","value":"6682679d4fe2d8f0d78244197408f44c210825766436504563f21c17bd458290","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:6717e04b11e19d1e922a28430606d9aabd102054a93eef3bfa9333be5ae0d88a":{"type":"File","value":"6717e04b11e19d1e922a28430606d9aabd102054a93eef3bfa9333be5ae0d88a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 324 x 204, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5":{"type":"File","value":"68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:6ba6e90f34327a4d509dfbfda26589ec24512430c20c0fc2a02452e3c2693b06":{"type":"File","value":"6ba6e90f34327a4d509dfbfda26589ec24512430c20c0fc2a02452e3c2693b06","filetype":"zlib compressed data","filetype_short":"ZLIB","mime_type":"application/zlib"},"File:742834205c3ee8aa0c99488fdbdc57118bfb38be11de01526f05a368a83dc0ca":{"type":"File","value":"742834205c3ee8aa0c99488fdbdc57118bfb38be11de01526f05a368a83dc0ca","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 58 x 10, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:74ec7eb1ff6651745a0dadc8c9260c69156c636c07840a76067f2a088073a503":{"type":"File","value":"74ec7eb1ff6651745a0dadc8c9260c69156c636c07840a76067f2a088073a503","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 82x24, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530":{"type":"File","value":"78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530","filetype":"XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (634), with CRLF line terminators","filetype_short":"XML","mime_type":"text/plain"},"File:7d1bb2dd5c5edbe9798c2145b76d555348b5e3fa41a2ea2be4b4fdd254b1ef7f":{"type":"File","value":"7d1bb2dd5c5edbe9798c2145b76d555348b5e3fa41a2ea2be4b4fdd254b1ef7f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 199 x 61, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:7f5ba456d847537a2f3ec48fa75c40239f01b92d489075c4fc29259b3151a46b":{"type":"File","value":"7f5ba456d847537a2f3ec48fa75c40239f01b92d489075c4fc29259b3151a46b","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 8, image size 146, resolution 2834 x 2834 px/m, 49 important colors, cbSize 396, bits offset 250","filetype_short":"BMP","mime_type":"image/bmp"},"File:885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246":{"type":"File","value":"885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:89384aa838d6c91e79bafd57ce56481080168e813798770d8b85c3cd0567742e":{"type":"File","value":"89384aa838d6c91e79bafd57ce56481080168e813798770d8b85c3cd0567742e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 86 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:896fbb4c8ef2b2bdc13a918ae5d221041e562df8ceafa7ad06ee6fc024a547eb":{"type":"File","value":"896fbb4c8ef2b2bdc13a918ae5d221041e562df8ceafa7ad06ee6fc024a547eb","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 26 x 14, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:89be0c2206c9010349e0807ad7c2a624facfa3b3bad215b668be88e03a3022cb":{"type":"File","value":"89be0c2206c9010349e0807ad7c2a624facfa3b3bad215b668be88e03a3022cb","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 132 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070":{"type":"File","value":"89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:8d998ed14530e526cce0decc778e1c77dffc59bc0201479f1928884b81b42632":{"type":"File","value":"8d998ed14530e526cce0decc778e1c77dffc59bc0201479f1928884b81b42632","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 24, image size 432, cbSize 486, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:90d51d5cb1cb3dd887f03faff1b78d8a1b59b1302aa0645a96652a3853265bbb":{"type":"File","value":"90d51d5cb1cb3dd887f03faff1b78d8a1b59b1302aa0645a96652a3853265bbb","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 120x112, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:9181684c8e806f256937abfc7f82fe5d15b1fcd02fccf94bccd6412353f8bf3d":{"type":"File","value":"9181684c8e806f256937abfc7f82fe5d15b1fcd02fccf94bccd6412353f8bf3d","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 16 x 16, 8-bit colormap, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:93cc8cb25913f47640dd85eb7fabbded5b17d45ad16d0cac9c8c6e1eaf606b43":{"type":"File","value":"93cc8cb25913f47640dd85eb7fabbded5b17d45ad16d0cac9c8c6e1eaf606b43","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 20 x 19, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:95b98f6a3052238a8f8743e6d15aef25408c1e807596e1b07fe67d6ad95a90ab":{"type":"File","value":"95b98f6a3052238a8f8743e6d15aef25408c1e807596e1b07fe67d6ad95a90ab","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 280 x 28, 8-bit colormap, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:9890105890d38a0b1f1133fe4d2a58b5c5c47c814165b2289ecf73050d396c91":{"type":"File","value":"9890105890d38a0b1f1133fe4d2a58b5c5c47c814165b2289ecf73050d396c91","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 41 x 40, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:98fa5e443758712393cf7e99196561e0f2b714105ff9f1ff6869cdb45d4e9d39":{"type":"File","value":"98fa5e443758712393cf7e99196561e0f2b714105ff9f1ff6869cdb45d4e9d39","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:9cf59653b47a5b1d42158586a4ae05e369a204f046befee2d43199dcf7c6c31f":{"type":"File","value":"9cf59653b47a5b1d42158586a4ae05e369a204f046befee2d43199dcf7c6c31f","filetype":"zlib compressed data","filetype_short":"ZLIB","mime_type":"application/zlib"},"File:9e7b4540b9f5205456d67a5c9bef7238b4275ee450f61938d10e56179639c1e3":{"type":"File","value":"9e7b4540b9f5205456d67a5c9bef7238b4275ee450f61938d10e56179639c1e3","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 8, image size 146, resolution 2834 x 2834 px/m, 56 important colors, cbSize 424, bits offset 278","filetype_short":"BMP","mime_type":"image/bmp"},"File:a171392ab65e60383277be05ddf20761bb66a027937c5300f1f5f86e42b30eff":{"type":"File","value":"a171392ab65e60383277be05ddf20761bb66a027937c5300f1f5f86e42b30eff","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 1 x 114, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991":{"type":"File","value":"a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:a22443f6c30a4c35b2e42b2904b5766c2a58e6e47db26455b2e21abc885c4b85":{"type":"File","value":"a22443f6c30a4c35b2e42b2904b5766c2a58e6e47db26455b2e21abc885c4b85","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 15 x 15 x 24, image size 722, resolution 3779 x 3779 px/m, cbSize 776, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:a2e335fd339ad5f8bca6187ba2955b331600b161822da01ee69b7a10846f4120":{"type":"File","value":"a2e335fd339ad5f8bca6187ba2955b331600b161822da01ee69b7a10846f4120","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 120 x 15 x 32, image size 7202, resolution 2834 x 2834 px/m, cbSize 7256, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:a434515bb2066dad988363c92b60b5e293f490a290d5324dd6a7d1dc85a1f5b0":{"type":"File","value":"a434515bb2066dad988363c92b60b5e293f490a290d5324dd6a7d1dc85a1f5b0","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 120 x 150, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:a4b4cc444ad9dfb7856fd8a8a84395c3f16c20e4ca1e47ba605be608d5853f11":{"type":"File","value":"a4b4cc444ad9dfb7856fd8a8a84395c3f16c20e4ca1e47ba605be608d5853f11","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 51 x 17, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3":{"type":"File","value":"a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:a5a0b0d2cfbb06c84cbd0d1d556019f7ef3d0251ab01fd0b69e2d6187479a69e":{"type":"File","value":"a5a0b0d2cfbb06c84cbd0d1d556019f7ef3d0251ab01fd0b69e2d6187479a69e","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 132 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:ac40859c3ece9c3c144838031eb7d7d6011a47c713c50614f74a10fcbd3e6cb2":{"type":"File","value":"ac40859c3ece9c3c144838031eb7d7d6011a47c713c50614f74a10fcbd3e6cb2","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:ac469d05888c4f0ed07519edbcdef6b3f5251b72fd583b7d4852a815a3cf5f45":{"type":"File","value":"ac469d05888c4f0ed07519edbcdef6b3f5251b72fd583b7d4852a815a3cf5f45","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 41 x 40, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5":{"type":"File","value":"ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ad072a1c8579f3248bccf1977e80b48121ca2eefa545a2a51fffd722af35e285":{"type":"File","value":"ad072a1c8579f3248bccf1977e80b48121ca2eefa545a2a51fffd722af35e285","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 240 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:b091815a0c08792588efdf5be66ed961646f31bbab1482133bf6d12436b7779d":{"type":"File","value":"b091815a0c08792588efdf5be66ed961646f31bbab1482133bf6d12436b7779d","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 180 x 15 x 32, image size 10802, resolution 2834 x 2834 px/m, cbSize 10856, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:b5a1afdbc03de3ae51febe63bf762cc1a9fa14e996d694c55c8b31b00c7ade90":{"type":"File","value":"b5a1afdbc03de3ae51febe63bf762cc1a9fa14e996d694c55c8b31b00c7ade90","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"image/x-icns"},"File:b8776a761807843ec4e40b7b6f5c16522e1a5a30e307fddd72c6811902336a45":{"type":"File","value":"b8776a761807843ec4e40b7b6f5c16522e1a5a30e307fddd72c6811902336a45","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 41 x 40, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:ba58ebe631cc547f4e7ed9191b708c4a052ba87adf5e9e5a3f02062e17928beb":{"type":"File","value":"ba58ebe631cc547f4e7ed9191b708c4a052ba87adf5e9e5a3f02062e17928beb","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 240 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d":{"type":"File","value":"bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c":{"type":"File","value":"bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","filetype":"Zip archive data, at least v2.0 to extract, compression method=store","filetype_short":"ZIP","mime_type":"application/zip"},"File:bdbe8dfe138de6fc535b8f178963afd79d6b32402fd5732d60f60df83ecb646f":{"type":"File","value":"bdbe8dfe138de6fc535b8f178963afd79d6b32402fd5732d60f60df83ecb646f","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 58 x 59, 4-bit colormap, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:be2c92907c2604c1299af6cd7196dc52b8c32aae24377b07564124889c0d33b3":{"type":"File","value":"be2c92907c2604c1299af6cd7196dc52b8c32aae24377b07564124889c0d33b3","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PC bitmap, Windows 3.x format, 12 x 12 x 24, image size 434, resolution 2834 x 2834 px/m, cbSize 488, bits offset 54","filetype_short":"BMP","mime_type":"image/bmp"},"File:c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c":{"type":"File","value":"c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c","filetype":"ASCII text, with no line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338":{"type":"File","value":"c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 97x62, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9":{"type":"File","value":"c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:c5eae7a215cf7b50d0aaaef2f596ca9f953a3637e119a1eb0563a5e44ca0efb5":{"type":"File","value":"c5eae7a215cf7b50d0aaaef2f596ca9f953a3637e119a1eb0563a5e44ca0efb5","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 60x7, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281":{"type":"File","value":"c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6":{"type":"File","value":"c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ca5f4967981fdd172d30783a5648b50ca450b8c17baf3694bc9b3a61f6412e96":{"type":"File","value":"ca5f4967981fdd172d30783a5648b50ca450b8c17baf3694bc9b3a61f6412e96","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 12 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1":{"type":"File","value":"cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a":{"type":"File","value":"ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76":{"type":"File","value":"ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3":{"type":"File","value":"ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:cefaf1bcfefb2c0c221b881f8534291773448b562cb94fb24245abf6563906f7":{"type":"File","value":"cefaf1bcfefb2c0c221b881f8534291773448b562cb94fb24245abf6563906f7","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 120 x 150, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:d02b4eb596ae506223a0a8d56a10583528a14e225b6930475eb7704837fa012d":{"type":"File","value":"d02b4eb596ae506223a0a8d56a10583528a14e225b6930475eb7704837fa012d","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 13 x 92, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:d0c3b5ec5459897911744557cb6cd615bd0aaba253e494e6d0fec0e3d00cdf77":{"type":"File","value":"d0c3b5ec5459897911744557cb6cd615bd0aaba253e494e6d0fec0e3d00cdf77","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 132 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:d2dfae1a1d86a7e40083853ab14477e41fda6466269077e5e70837cf448d173a":{"type":"File","value":"d2dfae1a1d86a7e40083853ab14477e41fda6466269077e5e70837cf448d173a","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 796x114, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:d3e3944d4649450dee66a55c69eeced2d825b6ca1a349f72c75fd3780ae3f006":{"type":"File","value":"d3e3944d4649450dee66a55c69eeced2d825b6ca1a349f72c75fd3780ae3f006","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"GIF image data, version 89a, 16 x 16","filetype_short":"GIF","mime_type":"image/gif"},"File:d9435ff2d662ab30309654beb4ddcc474769fd943738d8779c74e30a3332163d":{"type":"File","value":"d9435ff2d662ab30309654beb4ddcc474769fd943738d8779c74e30a3332163d","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 69 x 23, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:db969d6ad488ea0d3a9079549fa725f1eecb6ac2a2467704f3debb1038cf9809":{"type":"File","value":"db969d6ad488ea0d3a9079549fa725f1eecb6ac2a2467704f3debb1038cf9809","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 82x24, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:dcb93c074a56e24a9dcc5c4a14f18e2d1126552eee531174b89ab2f2fa6d5b08":{"type":"File","value":"dcb93c074a56e24a9dcc5c4a14f18e2d1126552eee531174b89ab2f2fa6d5b08","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c":{"type":"File","value":"dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636":{"type":"File","value":"dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:df61da80f7df1a940b884638e41f7e1150d21337c5d0d9409b84515e303010da":{"type":"File","value":"df61da80f7df1a940b884638e41f7e1150d21337c5d0d9409b84515e303010da","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 188 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:e07de8ac8d8314f37665d518d6b611b63b9ec12a86c08f14376d72ce7ad37344":{"type":"File","value":"e07de8ac8d8314f37665d518d6b611b63b9ec12a86c08f14376d72ce7ad37344","filetype":"ISO-8859 text","filetype_short":"ISO8859TEXT","mime_type":"text/x-msdos-batch"},"File:e59a6726de15cf823a3c8062a0722131c4d9a298202ec88f9baef894cf9be437":{"type":"File","value":"e59a6726de15cf823a3c8062a0722131c4d9a298202ec88f9baef894cf9be437","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"data (from un7z)","filetype_short":"DATA","mime_type":"image/x-icns"},"File:e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5":{"type":"File","value":"e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:e74aea2dbd0114db5386fcaf2d4871d6a19b6c00be71a4ae2171b8160b87f07b":{"type":"File","value":"e74aea2dbd0114db5386fcaf2d4871d6a19b6c00be71a4ae2171b8160b87f07b","filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:e7a65c267e01e9cb85e92028bb24ca4f07202651f0e78bc92c353cb7414c0b06":{"type":"File","value":"e7a65c267e01e9cb85e92028bb24ca4f07202651f0e78bc92c353cb7414c0b06","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 9x32, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:e889a7772b77a8ac36f5716ebbca76ae70aa816e5a8f7bd36e34cc5345dc4167":{"type":"File","value":"e889a7772b77a8ac36f5716ebbca76ae70aa816e5a8f7bd36e34cc5345dc4167","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 66 x 18, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:e97613cf85350b6280b2152fb38c90c64a6cdbf4e5d9889fb8f094d1161acdb5":{"type":"File","value":"e97613cf85350b6280b2152fb38c90c64a6cdbf4e5d9889fb8f094d1161acdb5","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 583x601, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:e98b36614c219146777864312fc5a219169a0bf13175c4031e8f857d44c67395":{"type":"File","value":"e98b36614c219146777864312fc5a219169a0bf13175c4031e8f857d44c67395","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 74 x 82, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:ef1a97aec0959a93a9d232a622bc80bfc8bb0863a3787e1798bfe78d077ecfc7":{"type":"File","value":"ef1a97aec0959a93a9d232a622bc80bfc8bb0863a3787e1798bfe78d077ecfc7","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 82x24, components 3","filetype_short":"JPEG","mime_type":"image/jpeg"},"File:ef4a95988fdb78fbfb718c73d2759153503386f8557bf5b608f6b3be59fb7a34":{"type":"File","value":"ef4a95988fdb78fbfb718c73d2759153503386f8557bf5b608f6b3be59fb7a34","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 74 x 82, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:f12f6696af1131fee378a1c521a2acd192fb2f13f75974d961c3c980ac4eacf7":{"type":"File","value":"f12f6696af1131fee378a1c521a2acd192fb2f13f75974d961c3c980ac4eacf7","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 327 x 86, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:f401bc428db64b55025a3b5d26ae54910178c72f3ed92de0b1487e6754f368a1":{"type":"File","value":"f401bc428db64b55025a3b5d26ae54910178c72f3ed92de0b1487e6754f368a1","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 132 x 22, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:f4adbf9e33bac6b8e0dfab8a07b6b6d404eb5458c693b11d2469e18ae827b849":{"type":"File","value":"f4adbf9e33bac6b8e0dfab8a07b6b6d404eb5458c693b11d2469e18ae827b849","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 41 x 40, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c":{"type":"File","value":"f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09":{"type":"File","value":"f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:fcce0aac0c195dd1b08ec1c2ee7f04d99ebd1b354bbfe33f51f20994ca942420":{"type":"File","value":"fcce0aac0c195dd1b08ec1c2ee7f04d99ebd1b354bbfe33f51f20994ca942420","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 86 x 26, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6":{"type":"File","value":"fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","Match on yara rule CrowdStrike_NAPWHICH_Infected_XLSM","confirmed relationship with a Threat NAPWHICH","possibly malicious url"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a":{"type":"File","value":"ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a","filetype":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 7 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ffb7c5e11d7b7b20a14b110f9e1713bf61c34d4a9e62858ac60899edfbdcf150":{"type":"File","value":"ffb7c5e11d7b7b20a14b110f9e1713bf61c34d4a9e62858ac60899edfbdcf150","verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]},"filetype":"PNG image data, 218 x 86, 8-bit/color RGBA, non-interlaced","filetype_short":"PNG","mime_type":"image/png"},"Threat:b5cdb28ad5a9a3bdd8f8b744f7a73b92c1512c60752a6d44cd99cdd79c263161":{"type":"Threat","value":"NAPWHICH","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:548d0ca19336d289e61ff43b87330780234e8461151b88a4a6b34fc5ba721dfe":{"type":"Url","value":"https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat NAPWHICH","possibly malicious url"]}}},"chains":[{"id":"1543825680279443155","root":"Domain:451ebbe1c8f95384bd1b076cb98f737936946559303dabc6072e8518f6c18367","edges":[],"verdict":{"verdict":"clean","verdict_source":"domain reputation data","reasons":["reported clean domain"]}},{"id":"1543825655784832114","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as malware by ClamAV antivirus","Match on yara rule CrowdStrike_NAPWHICH_Infected_XLSM","confirmed relationship with a Threat NAPWHICH","possibly malicious url"]}},{"id":"1543825668090594548","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:3102da9330e700d895957cf4381a38fd17af3ed0275aa1119ae1da07dea4ea69"}],"verdict":{"verdict":"unknown"}},{"id":"1543825678089168067","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954769","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6ba6e90f34327a4d509dfbfda26589ec24512430c20c0fc2a02452e3c2693b06"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668124149085","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668103177489","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:9cf59653b47a5b1d42158586a4ae05e369a204f046befee2d43199dcf7c6c31f"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668094788862","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ac40859c3ece9c3c144838031eb7d7d6011a47c713c50614f74a10fcbd3e6cb2"}],"verdict":{"verdict":"unknown"}},{"id":"1543825671664141782","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:b5a1afdbc03de3ae51febe63bf762cc1a9fa14e996d694c55c8b31b00c7ade90"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671680918999","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825668115760451","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e07de8ac8d8314f37665d518d6b611b63b9ec12a86c08f14376d72ce7ad37344"}],"verdict":{"verdict":"unknown"}},{"id":"1543825671697696216","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e59a6726de15cf823a3c8062a0722131c4d9a298202ec88f9baef894cf9be437"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825668119954763","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e74aea2dbd0114db5386fcaf2d4871d6a19b6c00be71a4ae2171b8160b87f07b"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668103177496","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde"},{"edge_kind":"extracted_from_archive","from_key":"File:1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde","to_key":"File:a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668103177497","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6"},{"edge_kind":"extracted_from_archive","from_key":"File:214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6","to_key":"File:68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668111566118","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade"},{"edge_kind":"extracted_from_archive","from_key":"File:39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade","to_key":"File:dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668111566119","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5"},{"edge_kind":"extracted_from_archive","from_key":"File:401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5","to_key":"File:1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668124149089","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f"},{"edge_kind":"extracted_from_archive","from_key":"File:50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f","to_key":"File:1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668103177486","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246"},{"edge_kind":"extracted_from_archive","from_key":"File:885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246","to_key":"File:4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668107371806","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5"},{"edge_kind":"extracted_from_archive","from_key":"File:ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5","to_key":"File:1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668098983179","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d"},{"edge_kind":"extracted_from_archive","from_key":"File:bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d","to_key":"File:c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9"}],"verdict":{"verdict":"unknown"}},{"id":"1543825671714473433","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:08dc3437090874c9586587dc667be41c34d9250dc6fa19f77d701a5d850c282e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671731250650","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:0f83ad2bb1aa2b81f6eaab36293a84720235f80576f1d09fef168d4d2ba22f21"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671743833563","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:105c6d2f5daa488c3bb3ce563bd745414331b9c48ab9031b7c7a644716d3dbc9"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671760610780","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:140b6d96ee0bef6917ee2e2f04057426f62b7a750b480515b6e83a43cc347b13"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671781582301","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:1ab315c00c6d12c7bad2da843bde992d98dcabff8fb291491cb49da8df4068fa"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825668115760452","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:1b2217da42989d271a22ac4235de3ef33b53633e24a7466eaa975ed8d05ba6bd"}],"verdict":{"verdict":"unknown"}},{"id":"1543825671794165214","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:1df7ada2023179df21331b49955adcf4e716f59ea40cb855523459089b00516c"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671806748127","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:20a62c9d9199698ba316567c0f63d0d28a9a076bedb3eb5323d997e2eb5a3061"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671823525344","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:266b6d714ef60cfe2d740385c00cde52d7e563f92380f7ae9f203ad2a0014cf1"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671840302561","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:2b9c6ee9f967b6091c6ea786ab0146235c4c22fcc8d994f069a51f8d47430288"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671857079778","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:2c95f20bc44cd43d21670ecf55d763f0f8ae1a7f5124c3c42e36dd769a36351e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671878051299","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:2d7fcf748c620a92cecfa549205c821a9efb6a3959742766218f22eae5fede4d"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671894828516","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:3387ea79c3a7ae024f14dbce2dcbf1d1de349cbc53ef4059d38ddd311a05ec18"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671911605733","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:33b82c3fe72a34ee4677d14a06e18e966f867806195782253b337b177cb91c8e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671924188646","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:40c6dfc0d9ac853df3b4e210ae23046d40ba6162a56cc7d8550df2e265ccbaa8"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671936771559","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:43177d0ee2337b8984057e3889896cd92d6b57dab6c94c2ea8830607e8dfd947"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671949354472","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:4339e9046b1509a0c52a231b4acdf7e0facace915fe52924d3a63eec0cdf62d9"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671966131689","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:462be4956a37fd09d41574e407da47563a815220bee7da1b672f5e156c26fe94"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671978714602","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:494187ea526824eb1db4cc72edaa6f8143c3cdcc47c85204b5c4c783a54b1e34"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825671991297515","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:4b95167dedef0c431a779932783ecea7fcb0564b8488b53bd0a0cc031b410dc9"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672008074732","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:4dd88369ebd9f1103f58b015414aa7ef2e3285b991b2ba570dfc5bb3ded03383"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672033240557","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:4f6cb897cc1711191bec262db0433808e2d9ffc7d235a228b0d47ab8c4bb503a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672045823470","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:4fe85d21c78cb4353f5d8af5eb32b7c8c9be9adcf810cab481f3a9730c9649d5"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672062600687","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:53b4ae417a53464808f95ec7902ec287af65ea529dbd96adc793ee8c9c05493f"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672075183600","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:5667b05787d159d9f5201f6fca43809696c75806ba0366b080cd9e8dd5de0e45"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672087766513","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:585e7a117be3ef2e8649c30a8335a9fcf7bf1c4ad836e663b44e46ef99b317fb"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672104543730","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:5a5941b355ce4a168e033576804602b518889bc40cb0329533f532d580a5a5d0"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672121320947","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:6424fd8bd6af0716fdb09a168bcfd788aee778f16a6a1f8790fc252ba7c458fc"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672138098164","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:6682679d4fe2d8f0d78244197408f44c210825766436504563f21c17bd458290"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672159069685","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:6717e04b11e19d1e922a28430606d9aabd102054a93eef3bfa9333be5ae0d88a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672171652598","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:742834205c3ee8aa0c99488fdbdc57118bfb38be11de01526f05a368a83dc0ca"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672188429815","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:74ec7eb1ff6651745a0dadc8c9260c69156c636c07840a76067f2a088073a503"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672205207032","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:7d1bb2dd5c5edbe9798c2145b76d555348b5e3fa41a2ea2be4b4fdd254b1ef7f"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672217789945","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:7f5ba456d847537a2f3ec48fa75c40239f01b92d489075c4fc29259b3151a46b"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672230372858","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:89384aa838d6c91e79bafd57ce56481080168e813798770d8b85c3cd0567742e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672247150075","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:896fbb4c8ef2b2bdc13a918ae5d221041e562df8ceafa7ad06ee6fc024a547eb"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672263927292","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:89be0c2206c9010349e0807ad7c2a624facfa3b3bad215b668be88e03a3022cb"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672280704509","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:8d998ed14530e526cce0decc778e1c77dffc59bc0201479f1928884b81b42632"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672293287422","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:90d51d5cb1cb3dd887f03faff1b78d8a1b59b1302aa0645a96652a3853265bbb"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672310064639","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:9181684c8e806f256937abfc7f82fe5d15b1fcd02fccf94bccd6412353f8bf3d"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672326841856","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:93cc8cb25913f47640dd85eb7fabbded5b17d45ad16d0cac9c8c6e1eaf606b43"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672339424769","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:95b98f6a3052238a8f8743e6d15aef25408c1e807596e1b07fe67d6ad95a90ab"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672356201986","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:9890105890d38a0b1f1133fe4d2a58b5c5c47c814165b2289ecf73050d396c91"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672368784899","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:98fa5e443758712393cf7e99196561e0f2b714105ff9f1ff6869cdb45d4e9d39"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672385562116","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:9e7b4540b9f5205456d67a5c9bef7238b4275ee450f61938d10e56179639c1e3"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672398145029","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a171392ab65e60383277be05ddf20761bb66a027937c5300f1f5f86e42b30eff"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672410727942","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a22443f6c30a4c35b2e42b2904b5766c2a58e6e47db26455b2e21abc885c4b85"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672427505159","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a2e335fd339ad5f8bca6187ba2955b331600b161822da01ee69b7a10846f4120"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672452670984","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a434515bb2066dad988363c92b60b5e293f490a290d5324dd6a7d1dc85a1f5b0"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672469448201","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a4b4cc444ad9dfb7856fd8a8a84395c3f16c20e4ca1e47ba605be608d5853f11"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672486225418","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:a5a0b0d2cfbb06c84cbd0d1d556019f7ef3d0251ab01fd0b69e2d6187479a69e"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672498808331","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ac469d05888c4f0ed07519edbcdef6b3f5251b72fd583b7d4852a815a3cf5f45"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672511391244","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ad072a1c8579f3248bccf1977e80b48121ca2eefa545a2a51fffd722af35e285"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672528168461","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:b091815a0c08792588efdf5be66ed961646f31bbab1482133bf6d12436b7779d"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672540751374","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:b8776a761807843ec4e40b7b6f5c16522e1a5a30e307fddd72c6811902336a45"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672553334287","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ba58ebe631cc547f4e7ed9191b708c4a052ba87adf5e9e5a3f02062e17928beb"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672570111504","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:bdbe8dfe138de6fc535b8f178963afd79d6b32402fd5732d60f60df83ecb646f"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672582694417","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:be2c92907c2604c1299af6cd7196dc52b8c32aae24377b07564124889c0d33b3"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672595277330","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:c5eae7a215cf7b50d0aaaef2f596ca9f953a3637e119a1eb0563a5e44ca0efb5"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672612054547","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ca5f4967981fdd172d30783a5648b50ca450b8c17baf3694bc9b3a61f6412e96"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672628831764","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:cefaf1bcfefb2c0c221b881f8534291773448b562cb94fb24245abf6563906f7"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672645608981","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:d02b4eb596ae506223a0a8d56a10583528a14e225b6930475eb7704837fa012d"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672662386198","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:d0c3b5ec5459897911744557cb6cd615bd0aaba253e494e6d0fec0e3d00cdf77"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672674969111","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:d2dfae1a1d86a7e40083853ab14477e41fda6466269077e5e70837cf448d173a"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672691746328","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:d3e3944d4649450dee66a55c69eeced2d825b6ca1a349f72c75fd3780ae3f006"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672704329241","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:d9435ff2d662ab30309654beb4ddcc474769fd943738d8779c74e30a3332163d"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672716912154","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:db969d6ad488ea0d3a9079549fa725f1eecb6ac2a2467704f3debb1038cf9809"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672733689371","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:dcb93c074a56e24a9dcc5c4a14f18e2d1126552eee531174b89ab2f2fa6d5b08"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672750466588","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:df61da80f7df1a940b884638e41f7e1150d21337c5d0d9409b84515e303010da"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672767243805","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:e7a65c267e01e9cb85e92028bb24ca4f07202651f0e78bc92c353cb7414c0b06"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672779826718","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:e889a7772b77a8ac36f5716ebbca76ae70aa816e5a8f7bd36e34cc5345dc4167"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672792409631","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:e97613cf85350b6280b2152fb38c90c64a6cdbf4e5d9889fb8f094d1161acdb5"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672809186848","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:e98b36614c219146777864312fc5a219169a0bf13175c4031e8f857d44c67395"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672825964065","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ef1a97aec0959a93a9d232a622bc80bfc8bb0863a3787e1798bfe78d077ecfc7"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672838546978","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ef4a95988fdb78fbfb718c73d2759153503386f8557bf5b608f6b3be59fb7a34"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672855324195","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:f12f6696af1131fee378a1c521a2acd192fb2f13f75974d961c3c980ac4eacf7"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672867907108","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:f401bc428db64b55025a3b5d26ae54910178c72f3ed92de0b1487e6754f368a1"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672884684325","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:f4adbf9e33bac6b8e0dfab8a07b6b6d404eb5458c693b11d2469e18ae827b849"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672901461542","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:fcce0aac0c195dd1b08ec1c2ee7f04d99ebd1b354bbfe33f51f20994ca942420"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825672918238759","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted_from_archive","from_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","to_key":"File:ffb7c5e11d7b7b20a14b110f9e1713bf61c34d4a9e62858ac60899edfbdcf150"}],"verdict":{"verdict":"likely_benign","verdict_source":"static analysis","reasons":["image file without any suspicious embedded artifacts"]}},{"id":"1543825668115760442","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6"},{"edge_kind":"extracted_from_archive","from_key":"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6","to_key":"File:17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954759","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6"},{"edge_kind":"extracted_from_archive","from_key":"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6","to_key":"File:f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668107371802","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1"},{"edge_kind":"extracted_from_archive","from_key":"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1","to_key":"File:89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668111566117","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1"},{"edge_kind":"extracted_from_archive","from_key":"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1","to_key":"File:c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954760","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a"},{"edge_kind":"extracted_from_archive","from_key":"File:ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a","to_key":"File:6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954764","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76"},{"edge_kind":"extracted_from_archive","from_key":"File:ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76","to_key":"File:c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668098983176","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c"},{"edge_kind":"extracted_from_archive","from_key":"File:dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c","to_key":"File:3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954771","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5"},{"edge_kind":"extracted_from_archive","from_key":"File:e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5","to_key":"File:ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668094788858","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c"},{"edge_kind":"extracted_from_archive","from_key":"File:f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c","to_key":"File:02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b"}],"verdict":{"verdict":"unknown"}},{"id":"1543825668119954779","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a"},{"edge_kind":"extracted_from_archive","from_key":"File:ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a","to_key":"File:a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3"}],"verdict":{"verdict":"unknown"}},{"id":"1543825680617306402","root":"Url:548d0ca19336d289e61ff43b87330780234e8461151b88a4a6b34fc5ba721dfe","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed relationship with a Threat NAPWHICH","possibly malicious url"]}},{"id":"1543825680613112097","root":"Url:548d0ca19336d289e61ff43b87330780234e8461151b88a4a6b34fc5ba721dfe","edges":[{"edge_kind":"used_by","from_key":"Url:548d0ca19336d289e61ff43b87330780234e8461151b88a4a6b34fc5ba721dfe","to_key":"Threat:b5cdb28ad5a9a3bdd8f8b744f7a73b92c1512c60752a6d44cd99cdd79c263161"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_files","root":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","edges":[{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:9cf59653b47a5b1d42158586a4ae05e369a204f046befee2d43199dcf7c6c31f"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:40c6dfc0d9ac853df3b4e210ae23046d40ba6162a56cc7d8550df2e265ccbaa8"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ef1a97aec0959a93a9d232a622bc80bfc8bb0863a3787e1798bfe78d077ecfc7"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a171392ab65e60383277be05ddf20761bb66a027937c5300f1f5f86e42b30eff"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:105c6d2f5daa488c3bb3ce563bd745414331b9c48ab9031b7c7a644716d3dbc9"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:33b82c3fe72a34ee4677d14a06e18e966f867806195782253b337b177cb91c8e"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:5a5941b355ce4a168e033576804602b518889bc40cb0329533f532d580a5a5d0"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:d9435ff2d662ab30309654beb4ddcc474769fd943738d8779c74e30a3332163d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:89384aa838d6c91e79bafd57ce56481080168e813798770d8b85c3cd0567742e"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4f6cb897cc1711191bec262db0433808e2d9ffc7d235a228b0d47ab8c4bb503a"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:462be4956a37fd09d41574e407da47563a815220bee7da1b672f5e156c26fe94"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:7d1bb2dd5c5edbe9798c2145b76d555348b5e3fa41a2ea2be4b4fdd254b1ef7f"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:dcb93c074a56e24a9dcc5c4a14f18e2d1126552eee531174b89ab2f2fa6d5b08"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a22443f6c30a4c35b2e42b2904b5766c2a58e6e47db26455b2e21abc885c4b85"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:2d7fcf748c620a92cecfa549205c821a9efb6a3959742766218f22eae5fede4d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:d0c3b5ec5459897911744557cb6cd615bd0aaba253e494e6d0fec0e3d00cdf77"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1df7ada2023179df21331b49955adcf4e716f59ea40cb855523459089b00516c"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c5eae7a215cf7b50d0aaaef2f596ca9f953a3637e119a1eb0563a5e44ca0efb5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:3102da9330e700d895957cf4381a38fd17af3ed0275aa1119ae1da07dea4ea69"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e889a7772b77a8ac36f5716ebbca76ae70aa816e5a8f7bd36e34cc5345dc4167"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f4adbf9e33bac6b8e0dfab8a07b6b6d404eb5458c693b11d2469e18ae827b849"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f401bc428db64b55025a3b5d26ae54910178c72f3ed92de0b1487e6754f368a1"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a2e335fd339ad5f8bca6187ba2955b331600b161822da01ee69b7a10846f4120"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e97613cf85350b6280b2152fb38c90c64a6cdbf4e5d9889fb8f094d1161acdb5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:7f5ba456d847537a2f3ec48fa75c40239f01b92d489075c4fc29259b3151a46b"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:d2dfae1a1d86a7e40083853ab14477e41fda6466269077e5e70837cf448d173a"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:95b98f6a3052238a8f8743e6d15aef25408c1e807596e1b07fe67d6ad95a90ab"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:140b6d96ee0bef6917ee2e2f04057426f62b7a750b480515b6e83a43cc347b13"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:9890105890d38a0b1f1133fe4d2a58b5c5c47c814165b2289ecf73050d396c91"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4dd88369ebd9f1103f58b015414aa7ef2e3285b991b2ba570dfc5bb3ded03383"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6ba6e90f34327a4d509dfbfda26589ec24512430c20c0fc2a02452e3c2693b06"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:5667b05787d159d9f5201f6fca43809696c75806ba0366b080cd9e8dd5de0e45"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:b8776a761807843ec4e40b7b6f5c16522e1a5a30e307fddd72c6811902336a45"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:08dc3437090874c9586587dc667be41c34d9250dc6fa19f77d701a5d850c282e"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6424fd8bd6af0716fdb09a168bcfd788aee778f16a6a1f8790fc252ba7c458fc"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f12f6696af1131fee378a1c521a2acd192fb2f13f75974d961c3c980ac4eacf7"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:8d998ed14530e526cce0decc778e1c77dffc59bc0201479f1928884b81b42632"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a5a0b0d2cfbb06c84cbd0d1d556019f7ef3d0251ab01fd0b69e2d6187479a69e"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bdbe8dfe138de6fc535b8f178963afd79d6b32402fd5732d60f60df83ecb646f"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:53b4ae417a53464808f95ec7902ec287af65ea529dbd96adc793ee8c9c05493f"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e07de8ac8d8314f37665d518d6b611b63b9ec12a86c08f14376d72ce7ad37344"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:db969d6ad488ea0d3a9079549fa725f1eecb6ac2a2467704f3debb1038cf9809"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ef4a95988fdb78fbfb718c73d2759153503386f8557bf5b608f6b3be59fb7a34"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1ab315c00c6d12c7bad2da843bde992d98dcabff8fb291491cb49da8df4068fa"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:2c95f20bc44cd43d21670ecf55d763f0f8ae1a7f5124c3c42e36dd769a36351e"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:9181684c8e806f256937abfc7f82fe5d15b1fcd02fccf94bccd6412353f8bf3d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4339e9046b1509a0c52a231b4acdf7e0facace915fe52924d3a63eec0cdf62d9"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e59a6726de15cf823a3c8062a0722131c4d9a298202ec88f9baef894cf9be437"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:cefaf1bcfefb2c0c221b881f8534291773448b562cb94fb24245abf6563906f7"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:2b9c6ee9f967b6091c6ea786ab0146235c4c22fcc8d994f069a51f8d47430288"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:896fbb4c8ef2b2bdc13a918ae5d221041e562df8ceafa7ad06ee6fc024a547eb"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ffb7c5e11d7b7b20a14b110f9e1713bf61c34d4a9e62858ac60899edfbdcf150"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:266b6d714ef60cfe2d740385c00cde52d7e563f92380f7ae9f203ad2a0014cf1"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ba58ebe631cc547f4e7ed9191b708c4a052ba87adf5e9e5a3f02062e17928beb"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a434515bb2066dad988363c92b60b5e293f490a290d5324dd6a7d1dc85a1f5b0"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:3387ea79c3a7ae024f14dbce2dcbf1d1de349cbc53ef4059d38ddd311a05ec18"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:98fa5e443758712393cf7e99196561e0f2b714105ff9f1ff6869cdb45d4e9d39"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ca5f4967981fdd172d30783a5648b50ca450b8c17baf3694bc9b3a61f6412e96"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6682679d4fe2d8f0d78244197408f44c210825766436504563f21c17bd458290"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:90d51d5cb1cb3dd887f03faff1b78d8a1b59b1302aa0645a96652a3853265bbb"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:742834205c3ee8aa0c99488fdbdc57118bfb38be11de01526f05a368a83dc0ca"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:1b2217da42989d271a22ac4235de3ef33b53633e24a7466eaa975ed8d05ba6bd"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:b5a1afdbc03de3ae51febe63bf762cc1a9fa14e996d694c55c8b31b00c7ade90"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:d02b4eb596ae506223a0a8d56a10583528a14e225b6930475eb7704837fa012d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ac469d05888c4f0ed07519edbcdef6b3f5251b72fd583b7d4852a815a3cf5f45"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:494187ea526824eb1db4cc72edaa6f8143c3cdcc47c85204b5c4c783a54b1e34"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:6717e04b11e19d1e922a28430606d9aabd102054a93eef3bfa9333be5ae0d88a"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:df61da80f7df1a940b884638e41f7e1150d21337c5d0d9409b84515e303010da"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:0f83ad2bb1aa2b81f6eaab36293a84720235f80576f1d09fef168d4d2ba22f21"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:43177d0ee2337b8984057e3889896cd92d6b57dab6c94c2ea8830607e8dfd947"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:74ec7eb1ff6651745a0dadc8c9260c69156c636c07840a76067f2a088073a503"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:9e7b4540b9f5205456d67a5c9bef7238b4275ee450f61938d10e56179639c1e3"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:be2c92907c2604c1299af6cd7196dc52b8c32aae24377b07564124889c0d33b3"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:fcce0aac0c195dd1b08ec1c2ee7f04d99ebd1b354bbfe33f51f20994ca942420"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e7a65c267e01e9cb85e92028bb24ca4f07202651f0e78bc92c353cb7414c0b06"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4b95167dedef0c431a779932783ecea7fcb0564b8488b53bd0a0cc031b410dc9"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:93cc8cb25913f47640dd85eb7fabbded5b17d45ad16d0cac9c8c6e1eaf606b43"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ad072a1c8579f3248bccf1977e80b48121ca2eefa545a2a51fffd722af35e285"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:ac40859c3ece9c3c144838031eb7d7d6011a47c713c50614f74a10fcbd3e6cb2"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:a4b4cc444ad9dfb7856fd8a8a84395c3f16c20e4ca1e47ba605be608d5853f11"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:4fe85d21c78cb4353f5d8af5eb32b7c8c9be9adcf810cab481f3a9730c9649d5"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:89be0c2206c9010349e0807ad7c2a624facfa3b3bad215b668be88e03a3022cb"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:585e7a117be3ef2e8649c30a8335a9fcf7bf1c4ad836e663b44e46ef99b317fb"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:20a62c9d9199698ba316567c0f63d0d28a9a076bedb3eb5323d997e2eb5a3061"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:d3e3944d4649450dee66a55c69eeced2d825b6ca1a349f72c75fd3780ae3f006"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e98b36614c219146777864312fc5a219169a0bf13175c4031e8f857d44c67395"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:b091815a0c08792588efdf5be66ed961646f31bbab1482133bf6d12436b7779d"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:e74aea2dbd0114db5386fcaf2d4871d6a19b6c00be71a4ae2171b8160b87f07b"},{"edge_kind":"extracted","from_key":"File:fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6","to_key":"File:c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":126,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":1,"embedded_urls_count":1,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null,"embedded_domains":[{"value":"docs.google.com","sources":[{"report_type":"qsp","report_id":""}]}],"embedded_urls":[{"value":"https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"netmon/netspeedtipflag.dat","sha256":"9cf59653b47a5b1d42158586a4ae05e369a204f046befee2d43199dcf7c6c31f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/close.png","sha256":"40c6dfc0d9ac853df3b4e210ae23046d40ba6162a56cc7d8550df2e265ccbaa8","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Util.dll","sha256":"cb330b1befd0fbe89359dcd50d4a06f763537a7d217d75270f3c63a5ee6ce5a1","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/button_normal.jpg","sha256":"ef1a97aec0959a93a9d232a622bc80bfc8bb0863a3787e1798bfe78d077ecfc7","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Verify.dll","sha256":"ad06ba38f929be5d3527c2003f3fb44a457d77e4ad136c75b559f84d1d366ee5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/bkgnd-border.png","sha256":"a171392ab65e60383277be05ddf20761bb66a027937c5300f1f5f86e42b30eff","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"AdvTools/hor_line.png","sha256":"105c6d2f5daa488c3bb3ce563bd745414331b9c48ab9031b7c7a644716d3dbc9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360P2SP.dll","sha256":"39ba7e809c6fafe1187fb7b925d03b736975e35e5ae907adf3622ef467d7dade","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/netstateok2.png","sha256":"33b82c3fe72a34ee4677d14a06e18e966f867806195782253b337b177cb91c8e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/button_focus.jpg","sha256":"5a5941b355ce4a168e033576804602b518889bc40cb0329533f532d580a5a5d0","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/IconOK.png","sha256":"d9435ff2d662ab30309654beb4ddcc474769fd943738d8779c74e30a3332163d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tab_hover.PNG","sha256":"89384aa838d6c91e79bafd57ce56481080168e813798770d8b85c3cd0567742e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Conf.dll","sha256":"885aa4f58297382396717563137d212fbcb4299f95426c40c43abcdcecf54246","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/animation.gif","sha256":"4f6cb897cc1711191bec262db0433808e2d9ffc7d235a228b0d47ab8c4bb503a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"LSPFix/unknown.bmp","sha256":"462be4956a37fd09d41574e407da47563a815220bee7da1b672f5e156c26fe94","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40","sha256":"1ff744d6937342ff07eb12df075f310d13cc2435868bea49578b7efb4419db40","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/Tips.png","sha256":"7d1bb2dd5c5edbe9798c2145b76d555348b5e3fa41a2ea2be4b4fdd254b1ef7f","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/Safe_S.png","sha256":"dcb93c074a56e24a9dcc5c4a14f18e2d1126552eee531174b89ab2f2fa6d5b08","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/frame_border.bmp","sha256":"a22443f6c30a4c35b2e42b2904b5766c2a58e6e47db26455b2e21abc885c4b85","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/sys_dlg_close.png","sha256":"2d7fcf748c620a92cecfa549205c821a9efb6a3959742766218f22eae5fede4d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/sys_button_max.png","sha256":"d0c3b5ec5459897911744557cb6cd615bd0aaba253e494e6d0fec0e3d00cdf77","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/collapse.bmp","sha256":"1df7ada2023179df21331b49955adcf4e716f59ea40cb855523459089b00516c","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Unlock/Splitter.jpg","sha256":"c5eae7a215cf7b50d0aaaef2f596ca9f953a3637e119a1eb0563a5e44ca0efb5","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360netmon.ini","sha256":"3102da9330e700d895957cf4381a38fd17af3ed0275aa1119ae1da07dea4ea69","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/SkinButtom.png","sha256":"e889a7772b77a8ac36f5716ebbca76ae70aa816e5a8f7bd36e34cc5345dc4167","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/msg_icon_info.png","sha256":"f4adbf9e33bac6b8e0dfab8a07b6b6d404eb5458c693b11d2469e18ae827b849","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/title_bar_menu.png","sha256":"f401bc428db64b55025a3b5d26ae54910178c72f3ed92de0b1487e6754f368a1","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389","sha256":"3307a43cf21b77e060b5ac119f065762f1341a752ff930849ff438ff3a7e4389","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360SpeedTest.exe","sha256":"1f46e635f5bf22424bfbd06359e10ad16badd872d6b7d6d11809653315cb8dde","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/radiobutton.bmp","sha256":"a2e335fd339ad5f8bca6187ba2955b331600b161822da01ee69b7a10846f4120","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/frame.jpg","sha256":"e97613cf85350b6280b2152fb38c90c64a6cdbf4e5d9889fb8f094d1161acdb5","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3","sha256":"a55d3935a49f74fbd887ed4696e8d9a4d4df467de299ba3658bb86e055418cd3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/danger.bmp","sha256":"7f5ba456d847537a2f3ec48fa75c40239f01b92d489075c4fc29259b3151a46b","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/Foreground.jpg","sha256":"d2dfae1a1d86a7e40083853ab14477e41fda6466269077e5e70837cf448d173a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360ExaminUI/sec","sha256":"95b98f6a3052238a8f8743e6d15aef25408c1e807596e1b07fe67d6ad95a90ab","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/toolbar_hover.png","sha256":"140b6d96ee0bef6917ee2e2f04057426f62b7a750b480515b6e83a43cc347b13","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360NetBase.dll","sha256":"401d8529a84f1d80a439be8cd4e869202162458e5afb5e5bac97c4859bfe8eb5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/msg_icon_check.png","sha256":"9890105890d38a0b1f1133fe4d2a58b5c5c47c814165b2289ecf73050d396c91","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/Dragbar_HBar.png","sha256":"4dd88369ebd9f1103f58b015414aa7ef2e3285b991b2ba570dfc5bb3ded03383","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360SpeedTestWebList.dat","sha256":"6ba6e90f34327a4d509dfbfda26589ec24512430c20c0fc2a02452e3c2693b06","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/BanLeft.gif","sha256":"5667b05787d159d9f5201f6fca43809696c75806ba0366b080cd9e8dd5de0e45","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PDown.dll","sha256":"c7ac2ff0ac102f8ae1f43cc75db94edb20b2773416f5063ea8a32db503623ca6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/360Safe-16new.png","sha256":"b8776a761807843ec4e40b7b6f5c16522e1a5a30e307fddd72c6811902336a45","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636","sha256":"dd8b4949ee96b2164a661a2b6207d9401a9dde7b9821fc1f6e36c73ac988e636","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Config/defaultskin/MiniUI.xml","sha256":"78470a187bf698270269b556f9d2dd1b6def3b4803b78004c9a780f74809d530","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b","sha256":"4775a741f0ead97ec8a00ce31532b69f9c4f809709dbdb61f97a99e2e5dff25b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tips_D01.png","sha256":"08dc3437090874c9586587dc667be41c34d9250dc6fa19f77d701a5d850c282e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tab_background.bmp","sha256":"6424fd8bd6af0716fdb09a168bcfd788aee778f16a6a1f8790fc252ba7c458fc","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/Skin_Back2.png","sha256":"f12f6696af1131fee378a1c521a2acd192fb2f13f75974d961c3c980ac4eacf7","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/expand.bmp","sha256":"8d998ed14530e526cce0decc778e1c77dffc59bc0201479f1928884b81b42632","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"safemon/urlproc.dll","sha256":"ff8c3e0055c40f2f83f6d72c3563d3f6e00933200277de30cc905e0e0ce2700a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"LiveUpd360.dll","sha256":"dcda5db8e5d2b7b5664b7b315b147c347c55f13821c23dc1d20c93bf83112b6c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/sys_button_min.png","sha256":"a5a0b0d2cfbb06c84cbd0d1d556019f7ef3d0251ab01fd0b69e2d6187479a69e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"AdvTools/IconShadow.png","sha256":"bdbe8dfe138de6fc535b8f178963afd79d6b32402fd5732d60f60df83ecb646f","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5","sha256":"1975859cd2057ab1f40e632a2133ae8b2cb8c86f4fd70fac87c2a01bced6d3d5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"FileSmasher/UnCheckBox.bmp","sha256":"53b4ae417a53464808f95ec7902ec287af65ea529dbd96adc793ee8c9c05493f","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/netspeed.npl","sha256":"e07de8ac8d8314f37665d518d6b611b63b9ec12a86c08f14376d72ce7ad37344","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Base.dll","sha256":"50773f6c715015e63cbd17148477f1025a5972ceb80abfacae74fbd89b7de01f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"CrashReport.dll","sha256":"bb393ebae1fd656b019cd086c05fcece979405c4616989bfdde6d60044d08b8d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/button_disable.jpg","sha256":"db969d6ad488ea0d3a9079549fa725f1eecb6ac2a2467704f3debb1038cf9809","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09","sha256":"f8208cded1c0f48ed2a0061e41dd0d829cfe77cfd5d009000c8da5425d835c09","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Config/config.xml","sha256":"4d8ce759afa09ef93fbe42b3f27028572497f4b3a6de86aaa83d92eec0e3eccc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/toolbar_pushed.png","sha256":"ef4a95988fdb78fbfb718c73d2759153503386f8557bf5b608f6b3be59fb7a34","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Config/defaultskin/defaultskin.ui","sha256":"bc6d57fec95a3f217446559a8cb96745b71e78d56d15e497a11b138a9085652c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/netstateerror2.png","sha256":"1ab315c00c6d12c7bad2da843bde992d98dcabff8fb291491cb49da8df4068fa","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"LSPFix/safe.bmp","sha256":"2c95f20bc44cd43d21670ecf55d763f0f8ae1a7f5124c3c42e36dd769a36351e","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/360Safe-16new.png1","sha256":"9181684c8e806f256937abfc7f82fe5d15b1fcd02fccf94bccd6412353f8bf3d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9","sha256":"c457086456880353dd1009ccd772be7b424328e4f5f172a335f057cc15c52fa9","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Config/defaultskin/Skin.jpg","sha256":"c3283eaeba5db93fd5a4f6ef457080c86822bc7b51a85284f46c98e1e6c45338","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/scrollh","sha256":"4339e9046b1509a0c52a231b4acdf7e0facace915fe52924d3a63eec0cdf62d9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360NetSpd3.dat","sha256":"e59a6726de15cf823a3c8062a0722131c4d9a298202ec88f9baef894cf9be437","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3","sha256":"ce9e6e816923b1ea900ae1df4b294b9bb788ba9b8410ad75aae7f50f04a425b3","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991","sha256":"a1c8f36d0ce951e6acbef8ab14bfa3dce1a492e5622cb657abafdf188c9f3991","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/dlg_skin.png","sha256":"cefaf1bcfefb2c0c221b881f8534291773448b562cb94fb24245abf6563906f7","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c","sha256":"c2aee2770f457d45e9a0daeacba6bd3b5d04cf91e4da228a7802a71f6f1c369c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309","sha256":"1fe31ef770f7424b23bc9fad371b762e2369eb626344f2afd74a195c9f328309","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/360Safe.ico","sha256":"2b9c6ee9f967b6091c6ea786ab0146235c4c22fcc8d994f069a51f8d47430288","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/New2.png","sha256":"896fbb4c8ef2b2bdc13a918ae5d221041e562df8ceafa7ad06ee6fc024a547eb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/AddSkin.png","sha256":"ffb7c5e11d7b7b20a14b110f9e1713bf61c34d4a9e62858ac60899edfbdcf150","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/radiobutton.png","sha256":"266b6d714ef60cfe2d740385c00cde52d7e563f92380f7ae9f203ad2a0014cf1","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b","sha256":"02d1d73246b2e3d0c8e075731d6ef70001596364e810fda872ae80035c45f81b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070","sha256":"89cd61474e9f9172d98349fe9c2164fa573025404b4e700d442d5d89d95e9070","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/Button_Glass.png","sha256":"ba58ebe631cc547f4e7ed9191b708c4a052ba87adf5e9e5a3f02062e17928beb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5","sha256":"68f1a30acd43c4cfd087ff90953674ef58ef9c6e217e4847179932c601ceddd5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/cool_dlg_set.png","sha256":"a434515bb2066dad988363c92b60b5e293f490a290d5324dd6a7d1dc85a1f5b0","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"FileSmasher/CheckBox.bmp","sha256":"3387ea79c3a7ae024f14dbce2dcbf1d1de349cbc53ef4059d38ddd311a05ec18","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360NetUL.dll","sha256":"e692bb1cabb48bd7652f7fcc17c10f0c421304677128e199347ca54c75340ce5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/SearchR_InfoS.png","sha256":"98fa5e443758712393cf7e99196561e0f2b714105ff9f1ff6869cdb45d4e9d39","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tab_background.png","sha256":"ca5f4967981fdd172d30783a5648b50ca450b8c17baf3694bc9b3a61f6412e96","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/error_back.png","sha256":"6682679d4fe2d8f0d78244197408f44c210825766436504563f21c17bd458290","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360Netdr.dll","sha256":"ccf9b9c9002976b79c8fde1e77917d079be380bef296246db3db8619c319020a","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/DlgBackground.jpg","sha256":"90d51d5cb1cb3dd887f03faff1b78d8a1b59b1302aa0645a96652a3853265bbb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/RedStar.png","sha256":"742834205c3ee8aa0c99488fdbdc57118bfb38be11de01526f05a368a83dc0ca","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ver.txt","sha256":"1b2217da42989d271a22ac4235de3ef33b53633e24a7466eaa975ed8d05ba6bd","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/NetSpeed.dll","sha256":"ce874c4695f41c622b985d2add6b293bc87879370cdfbf7702cbed648860cf76","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360NetSpd2.dat","sha256":"b5a1afdbc03de3ae51febe63bf762cc1a9fa14e996d694c55c8b31b00c7ade90","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6","sha256":"6376e06c938123c8a6f7495044da3b24f9e9a08d2a3ec048b578e9afab709ba6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"realtimeprotect","sha256":"d02b4eb596ae506223a0a8d56a10583528a14e225b6930475eb7704837fa012d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/msg_icon_error.png","sha256":"ac469d05888c4f0ed07519edbcdef6b3f5251b72fd583b7d4852a815a3cf5f45","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/TitleBack.png","sha256":"494187ea526824eb1db4cc72edaa6f8143c3cdcc47c85204b5c4c783a54b1e34","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/framemod.png","sha256":"6717e04b11e19d1e922a28430606d9aabd102054a93eef3bfa9333be5ae0d88a","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/sysmenu_close2.png","sha256":"df61da80f7df1a940b884638e41f7e1150d21337c5d0d9409b84515e303010da","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"ipc/ipcservice.dll","sha256":"f525005d0697f68236bd1530242397a1fc364fb3f1018274b4e1163650db6a1c","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/warning.bmp","sha256":"0f83ad2bb1aa2b81f6eaab36293a84720235f80576f1d09fef168d4d2ba22f21","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/scrollv","sha256":"43177d0ee2337b8984057e3889896cd92d6b57dab6c94c2ea8830607e8dfd947","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360net.dll","sha256":"214a5e9aab33148866db82ab51c5bcce9e4240794c2c2850fa0f7b3bc3aa34e6","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/button_pushed.jpg","sha256":"74ec7eb1ff6651745a0dadc8c9260c69156c636c07840a76067f2a088073a503","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/suggest.bmp","sha256":"9e7b4540b9f5205456d67a5c9bef7238b4275ee450f61938d10e56179639c1e3","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/safe.bmp","sha256":"be2c92907c2604c1299af6cd7196dc52b8c32aae24377b07564124889c0d33b3","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tab_pushed.PNG","sha256":"fcce0aac0c195dd1b08ec1c2ee7f04d99ebd1b354bbfe33f51f20994ca942420","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"360Unlock/unlockbkg.jpg","sha256":"e7a65c267e01e9cb85e92028bb24ca4f07202651f0e78bc92c353cb7414c0b06","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/tab_normal.PNG","sha256":"4b95167dedef0c431a779932783ecea7fcb0564b8488b53bd0a0cc031b410dc9","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/Buttom_Hover.png","sha256":"93cc8cb25913f47640dd85eb7fabbded5b17d45ad16d0cac9c8c6e1eaf606b43","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/CoolUI","sha256":"ad072a1c8579f3248bccf1977e80b48121ca2eefa545a2a51fffd722af35e285","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360SpeedTest.his","sha256":"ac40859c3ece9c3c144838031eb7d7d6011a47c713c50614f74a10fcbd3e6cb2","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0","sha256":"17e16ccaa2730d4f56f655231b7ec1c6d1979e0fe0420adcd5c892eb061bbdb0","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/Skin_Del.png","sha256":"a4b4cc444ad9dfb7856fd8a8a84395c3f16c20e4ca1e47ba605be608d5853f11","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"MainFrame/historyitem.PNG","sha256":"4fe85d21c78cb4353f5d8af5eb32b7c8c9be9adcf810cab481f3a9730c9649d5","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/sys_button_min2.png","sha256":"89be0c2206c9010349e0807ad7c2a624facfa3b3bad215b668be88e03a3022cb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/old","sha256":"585e7a117be3ef2e8649c30a8335a9fcf7bf1c4ad836e663b44e46ef99b317fb","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/checkbox.png","sha256":"20a62c9d9199698ba316567c0f63d0d28a9a076bedb3eb5323d997e2eb5a3061","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"PluginCleaner/Scan.gif","sha256":"d3e3944d4649450dee66a55c69eeced2d825b6ca1a349f72c75fd3780ae3f006","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/toolbar_normal.png","sha256":"e98b36614c219146777864312fc5a219169a0bf13175c4031e8f857d44c67395","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Common/checkbox.bmp","sha256":"b091815a0c08792588efdf5be66ed961646f31bbab1482133bf6d12436b7779d","verdict":"likely_benign","sources":[{"report_type":"qsp","report_id":""}]},{"name":"netmon/360Speedr.ini","sha256":"e74aea2dbd0114db5386fcaf2d4871d6a19b6c00be71a4ae2171b8160b87f07b","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281","sha256":"c6dc70a6d7d60f59ed1f98759410c819297dc04293d20b70cf450ae412096281","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Comet.A Sample fe892c485599… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample fe892c485599…. Malware family: Comet.A. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6"}],["$","meta","4",{"property":"og:title","content":"Malicious Comet.A Sample fe892c485599… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample fe892c485599…. Malware family: Comet.A. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/fe892c48559945e7e707a5fed5324ad5c2588de0965152c0ecd8b6e6b07e56d6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Comet.A Sample fe892c485599… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample fe892c485599…. Malware family: Comet.A. Threat score 100/100. 21/27 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]