diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..6eca16b
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,25 @@
+name: sandboxapi
+
+on: [push]
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ python-version: ["3.7", "3.8", "3.9"]
+
+ steps:
+ - uses: actions/checkout@v3
+ - name: Set up Python ${{ matrix.python-version }}
+ uses: actions/setup-python@v4
+ with:
+ python-version: ${{ matrix.python-version }}
+ - name: Install dependencies
+ run: |
+ pip install -r requirements.txt
+ pip install pytest pytest-mock coverage requests-mock responses collective.checkdocs Pygments nose
+ - name: Test scripts
+ run: |
+ coverage run -m unittest discover
+ nosetests tests/*
diff --git a/.gitignore b/.gitignore
index 87d130b..da51d37 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,9 @@
build/
dist/
_build/
+/build_dist.sh
+.vscode/
+/.virtualenv/
+/.pytest_cache/
+Pipfile.lock
+.DS_Store
diff --git a/.travis.yml b/.travis.yml
index 1337354..eb22c8a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,21 +1,22 @@
language: python
-python:
-# - "2.6" # -- responses module requires 2.7+
- - "2.7"
- - "3.3"
- - "3.4"
- - "3.5"
-install:
- - "pip install -r requirements.txt"
- - "pip install nose"
- - "pip install responses"
- - "pip install coveralls"
- - "pip install codacy-coverage"
- - "pip install collective.checkdocs Pygments"
-script:
- - nosetests --with-coverage --cover-package=sandboxapi
- - python setup.py checkdocs
-after_success:
- - coveralls
- - coverage xml
- - python-codacy-coverage
+jobs:
+ include:
+ - name: "Python 3.9"
+ python: 3.9
+ install:
+ - "pip install -r requirements.txt"
+ - "pip install pytest pytest-mock coverage requests-mock responses collective.checkdocs Pygments"
+ script:
+ - coverage run -m pytest
+ - python setup.py checkdocs
+ after_success:
+ - coveralls
+ - coverage xml
+ - if [ "$TRAVIS_BRANCH" = "master" ]; then bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r coverage.xml; fi
+ - name: "Python 2.7"
+ python: 2.7
+ install:
+ - "pip install -r requirements.txt"
+ - "pip install nose mock requests-mock responses collective.checkdocs Pygments"
+ script:
+ - nosetests
diff --git a/Pipfile b/Pipfile
new file mode 100644
index 0000000..3a8c89a
--- /dev/null
+++ b/Pipfile
@@ -0,0 +1,19 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+requests = "*"
+jbxapi = "*"
+xmltodict = "*"
+
+[dev-packages]
+pytest = "*"
+coverage = "*"
+responses = "*"
+"collective.checkdocs" = "*"
+pygments = "*"
+
+[requires]
+python_version = "3.9"
diff --git a/README.rst b/README.rst
index dd86366..90a35b5 100644
--- a/README.rst
+++ b/README.rst
@@ -4,18 +4,12 @@ sandboxapi
.. image:: https://inquest.net/images/inquest-badge.svg
:target: https://inquest.net/
:alt: Developed by InQuest
-.. image:: https://travis-ci.org/InQuest/python-sandboxapi.svg?branch=master
- :target: https://travis-ci.org/InQuest/python-sandboxapi
- :alt: Build Status
+.. image:: https://github.com/InQuest/sandboxapi/workflows/sandboxapi/badge.svg?branch=master
+ :target: https://github.com/InQuest/sandboxapi/actions
+ :alt: Build Status (GitHub Workflow)
.. image:: https://readthedocs.org/projects/sandboxapi/badge/?version=latest
:target: https://inquest.readthedocs.io/projects/sandboxapi/en/latest/?badge=latest
:alt: Documentation Status
-.. image:: https://api.codacy.com/project/badge/Grade/7ddb5b4791404aa2a6a9670099fe53ad
- :target: https://www.codacy.com/app/rshipp/python-sandboxapi?utm_source=github.com&utm_medium=referral&utm_content=InQuest/python-sandboxapi&utm_campaign=Badge_Grade
- :alt: Code Health
-.. image:: https://api.codacy.com/project/badge/Coverage/7ddb5b4791404aa2a6a9670099fe53ad
- :target: https://www.codacy.com/app/rshipp/python-sandboxapi?utm_source=github.com&utm_medium=referral&utm_content=InQuest/python-sandboxapi&utm_campaign=Badge_Coverage
- :alt: Test Coverage
.. image:: http://img.shields.io/pypi/v/sandboxapi.svg
:target: https://pypi.python.org/pypi/sandboxapi
:alt: PyPi Version
@@ -25,10 +19,13 @@ A minimal, consistent API for building integrations with malware sandboxes.
This library currently supports the following sandbox systems:
* `Cuckoo Sandbox`_
+* `Falcon Sandbox`_ (Formerly VxStream)
* `FireEye AX Series`_
+* `Hatching Triage`_
* `Joe Sandbox`_
+* `MetaDefender Sandbox`_
* `VMRay Analyzer`_
-* `Falcon Sandbox`_ (Formerly VxStream)
+* `WildFire Sandbox`_
It provides at least the following methods for each sandbox:
@@ -219,6 +216,58 @@ supports the current and older versions of the Falcon API. Note that the
official library only supports Python 3.4+.
+WildFire Sandbox
+~~~~~~~~~~~~~~~~
+
+Constructor signature::
+
+ WildFireAPI(api_key, url='https://wildfire.paloaltonetworks.com/publicapi')
+
+Example::
+
+ WildFireAPI('mykey')
+
+Currently, only the WildFire cloud sandbox is supported and not the WildFire appliance.
+
+
+MetaDefender Sandbox
+~~~~~~~~~~~~~~~~~~~~
+
+Constructor signature::
+
+ MetaDefenderSandboxAPI(api_key, url=None, verify_ssl=True)
+
+Example::
+
+ MetaDefenderSandboxAPI('mykey')
+
+MetaDefender Sandbox (previously known as OPSWAT Filescan Sandbox). You can use the Activation Key that you received
+from your OPSWAT Sales Representative, and follow the instructions on the
+`OPSWAT Licence Activation`_ page or you can create an API key on the
+`MetaDefender Sandbox Community Site`_ under API Key tab.
+
+More details in the `MetaDefender Sandbox API documentation`_.
+
+
+Hatching Triage
+~~~~~~~~~~~~~~~~
+
+Constructor signature::
+
+ TriageAPI(api_key, url='https://api.tria.ge', api_path='/v0')
+
+Example::
+
+ TriageAPI("ApiKeyHere")
+
+You're able to use this class with both the `Triage public cloud`_ and the
+private Triage instances. Look up the documentation for the right host and
+api path for your specific instance.
+
+For more information on what is returned from the API you can look up the
+official `Triage API documentation`_.
+
+
Notes
-----
@@ -229,12 +278,20 @@ number of online analysis services.
.. _Cuckoo Sandbox: https://www.cuckoosandbox.org/
.. _Fireeye AX Series: https://www.fireeye.com/products/malware-analysis.html
.. _Joe Sandbox: https://www.joesecurity.org/
+.. _MetaDefender Sandbox: https://docs.opswat.com/filescan
.. _VMRay Analyzer: https://www.vmray.com/
.. _Falcon Sandbox: https://www.falcon-sandbox.com/
+.. _WildFire Sandbox: https://www.paloaltonetworks.com/products/secure-the-network/wildfire
+.. _Hatching Triage: https://tria.ge/
.. _unofficial Cuckoo library: https://github.com/keithjjones/cuckoo-api
.. _Cuckoo API documentation: https://cuckoo.sh/docs/usage/api.html
.. _FireEye API documentation: https://www.fireeye.com/blog/products-and-services/2015/12/restful_apis_thatdo.html
.. _AX Series product page: https://www.fireeye.com/products/malware-analysis.html
.. _official Joe Sandbox library: https://github.com/joesecurity/joesandboxcloudapi
.. _official Falcon library: https://github.com/PayloadSecurity/VxAPI
+.. _OPSWAT Licence Activation: https://docs.opswat.com/filescan/installation/license-activation
+.. _MetaDefender Sandbox Community Site: https://www.filescan.io/users/profile?active=apikeyinfo
+.. _MetaDefender Sandbox API documentation: https://docs.opswat.com/filescan/metadefender-sandbox-api-reference-v1
.. _malsub: https://github.com/diogo-fernan/malsub
+.. _Triage public cloud: https://tria.ge/
+.. _Triage API documentation: https://tria.ge/docs/
diff --git a/docs/_templates/links.html b/docs/_templates/links.html
index dafc268..cc504b0 100644
--- a/docs/_templates/links.html
+++ b/docs/_templates/links.html
@@ -37,10 +37,10 @@ Other Projects
Useful Links
Stay Informed
@@ -66,4 +66,4 @@ Stay Informed
GitHub
-
+
\ No newline at end of file
diff --git a/docs/conf.py b/docs/conf.py
index 58ac195..13eb27c 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -20,7 +20,7 @@
# -- Project information -----------------------------------------------------
project = u'sandboxapi'
-copyright = u'2018 InQuest, LLC'
+copyright = u'2019 InQuest, LLC'
author = u'InQuest Labs'
# The short X.Y version
@@ -90,7 +90,7 @@
'logo_name': 'true',
'description': 'Minimal, consistent Python API for building integrations with malware sandboxes.',
'github_user': 'InQuest',
- 'github_repo': 'python-sandboxapi',
+ 'github_repo': 'sandboxapi',
'github_type': 'star',
'show_powered_by': 'false',
'page_width': 'auto',
diff --git a/docs/index.rst b/docs/index.rst
index 4e30187..bbea6a3 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -66,6 +66,15 @@ VMRay Analyzer
:show-inheritance:
:member-order: bysource
+WildFire Sandbox
+~~~~~~~~~~~~~~~~
+
+.. automodule:: sandboxapi.wildfire
+ :members:
+ :undoc-members:
+ :show-inheritance:
+ :member-order: bysource
+
Indices and tables
==================
diff --git a/requirements.txt b/requirements.txt
index 2925e9a..270849c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,3 @@
requests
jbxapi
+xmltodict
diff --git a/sandboxapi/__init__.py b/sandboxapi/__init__.py
index a3cf201..2e5c309 100644
--- a/sandboxapi/__init__.py
+++ b/sandboxapi/__init__.py
@@ -7,8 +7,11 @@
'cuckoo',
'fireeye',
'joe',
+ 'triage',
+ 'opswat',
'vmray',
'falcon',
+ 'wildfire',
'SandboxAPI',
'SandboxError',
]
diff --git a/sandboxapi/cuckoo.py b/sandboxapi/cuckoo.py
index 085542f..50767c0 100644
--- a/sandboxapi/cuckoo.py
+++ b/sandboxapi/cuckoo.py
@@ -198,6 +198,8 @@ def score(self, report):
except KeyError:
# cuckoo-2.0 format
score = report.get('info', {}).get('score', 0)
+ except TypeError as e:
+ raise sandboxapi.SandboxError(e)
return score
diff --git a/sandboxapi/falcon.py b/sandboxapi/falcon.py
index 9f572a1..b6f36dc 100644
--- a/sandboxapi/falcon.py
+++ b/sandboxapi/falcon.py
@@ -114,12 +114,19 @@ def is_available(self):
else:
try:
+ # Try the on-prem endpoint.
response = self._request("/system/heartbeat")
# we've got falcon.
if response.status_code == 200:
self.server_available = True
return True
+ elif response.status_code == 403:
+ # Try the public sandbox endpoint.
+ response = self._request("/system/version")
+ if response.status_code == 200:
+ self.server_available = True
+ return True
except sandboxapi.SandboxError:
pass
diff --git a/sandboxapi/fireeye.py b/sandboxapi/fireeye.py
index d80b691..befeef4 100644
--- a/sandboxapi/fireeye.py
+++ b/sandboxapi/fireeye.py
@@ -144,25 +144,21 @@ def is_available(self):
:rtype: bool
:return: True if service is available, False otherwise.
"""
- # if the availability flag is raised, return True immediately.
- # NOTE: subsequent API failures will lower this flag. we do this here
- # to ensure we don't keep hitting FireEye with requests while
- # availability is there.
- if self.server_available:
- return True
-
- # otherwise, we have to check with the cloud.
- else:
- try:
- response = self._request("/config")
- # we've got fireeye.
- if response.status_code == 200:
- self.server_available = True
- return True
+ try:
+ response = self._request("/config")
- except sandboxapi.SandboxError:
- pass
+ # Successfully connected to FireEye
+ if response.status_code == 200:
+ self.server_available = True
+ return True
+
+ # Unable to connect to FireEye
+ if response.status_code >= 500:
+ self.server_available = False
+ return False
+ except sandboxapi.SandboxError:
+ pass
self.server_available = False
return False
@@ -196,7 +192,6 @@ def report(self, item_id, report_format="json"):
# otherwise, return the raw content.
return response.content
-
def score(self, report):
"""Pass in the report from self.report(), get back an int."""
score = 0
@@ -205,6 +200,11 @@ def score(self, report):
return score
+ def logout(self):
+ """The FireEye AX has a limit of 100 concurrent sessions, so be sure to logout"""
+ if self.api_token:
+ self._request("/auth/logout")
+
def fireeye_loop(fireeye, filename):
# test run
@@ -272,3 +272,5 @@ def usage():
else:
usage()
+
+ fireeye.logout()
diff --git a/sandboxapi/joe.py b/sandboxapi/joe.py
index 759db52..a769e32 100644
--- a/sandboxapi/joe.py
+++ b/sandboxapi/joe.py
@@ -1,7 +1,5 @@
import json
-
import jbxapi
-
import sandboxapi
class JoeAPI(sandboxapi.SandboxAPI):
@@ -10,10 +8,12 @@ class JoeAPI(sandboxapi.SandboxAPI):
This class is actually just a convenience wrapper around jbxapi.JoeSandbox.
"""
- def __init__(self, apikey, apiurl, accept_tac, timeout=None, verify_ssl=True, retries=3, **kwargs):
+ def __init__(self, apikey, apiurl, accept_tac, timeout=None, verify_ssl=True, retries=3, chunked=False, **kwargs):
"""Initialize the interface to Joe Sandbox API."""
sandboxapi.SandboxAPI.__init__(self)
- self.jbx = jbxapi.JoeSandbox(apikey, apiurl or jbxapi.API_URL, accept_tac, timeout, verify_ssl, retries, **kwargs)
+ if not jbxapi.__version__.startswith("2"):
+ self._chunked = chunked
+ self.jbx = jbxapi.JoeSandbox(apikey, apiurl or jbxapi.API_URL, accept_tac, timeout, bool(int(verify_ssl)), retries, **kwargs)
def analyze(self, handle, filename):
"""Submit a file for analysis.
@@ -29,8 +29,13 @@ def analyze(self, handle, filename):
# ensure the handle is at offset 0.
handle.seek(0)
+ file_data = (filename, handle)
+
try:
- return self.jbx.submit_sample(handle)['webids'][0]
+ if not jbxapi.__version__.startswith("2"):
+ return self.jbx.submit_sample(file_data, _chunked_upload=self._chunked)['submission_id']
+ else:
+ return self.jbx.submit_sample(file_data)['webids'][0]
except (jbxapi.JoeException, KeyError, IndexError) as e:
raise sandboxapi.SandboxError("error in analyze: {e}".format(e=e))
@@ -44,12 +49,13 @@ def check(self, item_id):
:return: Boolean indicating if a report is done or not.
"""
try:
- return self.jbx.info(item_id).get('status').lower() == 'finished'
+ if not jbxapi.__version__.startswith("2"):
+ return self.jbx.analysis_info(item_id).get('status').lower() == 'finished'
+ else:
+ return self.jbx.info(item_id).get('status').lower() == 'finished'
except jbxapi.JoeException:
return False
- return False
-
def is_available(self):
"""Determine if the Joe Sandbox API server is alive.
@@ -93,7 +99,10 @@ def report(self, item_id, report_format="json"):
report_format = "jsonfixed"
try:
- return json.loads(self.jbx.download(item_id, report_format)[1].decode('utf-8'))
+ if not jbxapi.__version__.startswith("2"):
+ return json.loads(self.jbx.analysis_download(item_id, report_format)[1].decode('utf-8'))
+ else:
+ return json.loads(self.jbx.download(item_id, report_format)[1].decode('utf-8'))
except (jbxapi.JoeException, ValueError, IndexError) as e:
raise sandboxapi.SandboxError("error in report fetch: {e}".format(e=e))
diff --git a/sandboxapi/opswat.py b/sandboxapi/opswat.py
new file mode 100644
index 0000000..4282070
--- /dev/null
+++ b/sandboxapi/opswat.py
@@ -0,0 +1,257 @@
+from __future__ import print_function
+
+import sandboxapi
+import sys
+import time
+
+
+class MetaDefenderSandboxAPI(sandboxapi.SandboxAPI):
+ """MetaDefender Sandbox API wrapper."""
+
+ def __init__(
+ self, api_key, url="https://www.filescan.io", verify_ssl=True, **kwargs
+ ):
+ """Initialize the interface to MetaDefender Sandbox API.
+ :type api_key: str
+ :param api_key: MetaDefender Sandbox API key
+
+ :type url str
+ :param url The url (including the port) of the MetaDefender Sandbox
+ instance defaults to https://www.filescan.io
+ """
+ sandboxapi.SandboxAPI.__init__(self, **kwargs)
+ self.api_key = api_key
+ self.api_url = url
+ self.headers = {"X-Api-Key": self.api_key}
+ self.verify_ssl = verify_ssl
+
+ def analyze(self, handle, filename, password=None, is_private=False):
+ """Submit a file for analysis.
+
+ :type handle: File handle
+ :param handle: Handle to file to upload for analysis.
+ :type filename: str
+ :param filename: File name.
+ :type password: str
+ :param password: Custom password, in case uploaded archive is protected.
+ :type is_private: boolean
+ :param is_private: If file should not be available for download by other users.
+
+ :rtype: str
+ :return: flow_id as a string
+ """
+
+ if not self.api_key:
+ raise sandboxapi.SandboxError("Missing API key")
+
+ # multipart post files.
+ files = {"file": (filename, handle)}
+
+ # ensure the handle is at offset 0.
+ handle.seek(0)
+
+ try:
+ params = {"password": password, "is_private": is_private}
+
+ response = self._request(
+ "/api/scan/file",
+ method="POST",
+ params=params,
+ headers=self.headers,
+ files=files,
+ )
+
+ if response.status_code == 200 and response and response.json():
+ # send file, get flow_id
+ if "flow_id" in response.json():
+ return response.json()["flow_id"]
+
+ raise sandboxapi.SandboxError(
+ "api error in analyze ({u}): {r}".format(
+ u=response.url, r=response.content
+ )
+ )
+ except (ValueError, KeyError) as e:
+ raise sandboxapi.SandboxError("error in analyze: {e}".format(e=e))
+
+ def check(self, item_id):
+ """Check if an analysis is complete.
+
+ :type item_id: str
+ :param item_id: flow_id to check.
+
+ :rtype: bool
+ :return: Boolean indicating if a report is done or not.
+ """
+ response = self._request(
+ "/api/scan/{flow_id}/report".format(flow_id=item_id), headers=self.headers
+ )
+
+ if response.status_code == 404:
+ # unknown id
+ return False
+
+ try:
+ if "allFinished" in response.json() and response.json()["allFinished"]:
+ return True
+ elif "allFinished" not in response.json():
+ raise sandboxapi.SandboxError(
+ "api error in check ({u}): {r}".format(
+ u=response.url, r=response.content
+ )
+ )
+
+ except ValueError as e:
+ raise sandboxapi.SandboxError(e)
+
+ return False
+
+ def is_available(self):
+ """Determine if the MetaDefender Sandbox API server is alive.
+
+ :rtype: bool
+ :return: True if service is available, False otherwise.
+ """
+ # if the availability flag is raised, return True immediately.
+ # NOTE: subsequent API failures will lower this flag. we do this here
+ # to ensure we don't keep hitting Opswat with requests while
+ # availability is there.
+ if self.server_available:
+ return True
+
+ # otherwise, we have to check with the cloud.
+ else:
+ try:
+ response = self._request("/api/users/me", headers=self.headers)
+
+ # we've got opswat.
+ if response.status_code == 200 and "accountId" in response.json():
+ self.server_available = True
+ return True
+ except sandboxapi.SandboxError:
+ pass
+
+ self.server_available = False
+ return False
+
+ def report(self, item_id, report_format="json"):
+ """Retrieves the specified report for the analyzed item, referenced by item_id.
+
+ Available formats include: json.
+
+ :type item_id: str
+ :param item_id: flow_id number
+ :type report_format: str
+ :param report_format: Return format
+
+ :rtype: dict
+ :return: Dictionary representing the JSON parsed data or raw, for other
+ formats / JSON parsing failure.
+ """
+ if report_format == "html":
+ return "Report Unavailable"
+
+ filters = [
+ "filter=general",
+ "filter=finalVerdict",
+ "filter=allTags",
+ "filter=overallState",
+ "filter=taskReference",
+ "filter=subtaskReferences",
+ "filter=allSignalGroups",
+ "filter=iocs",
+ ]
+
+ postfix = "&".join(filters)
+ url_suffix = "/api/scan/{flow_id}/report?{postfix}".format(
+ flow_id=item_id, postfix=postfix
+ )
+
+ response = self._request(url_suffix, headers=self.headers)
+
+ try:
+ return response.json()
+ except ValueError:
+ pass
+
+ # otherwise, return the raw content.
+ return response.content.decode("utf-8")
+
+ def score(self, report):
+ """Pass in the report from self.report(), get back an int."""
+ report_scores = [0]
+ reports = report.get("reports", {})
+ for report_value in reports.values():
+ score = 0
+ threat_level = report_value.get("finalVerdict", {}).get("threatLevel", 0)
+ report_scores.append(max(0, threat_level) * 100)
+
+ score = max(report_scores)
+ return score
+
+
+def md_sandbox_loop(md_sandbox, filename):
+ # test run
+ with open(arg, "rb") as handle:
+ flow_id = md_sandbox.analyze(handle, filename)
+ print("file {f} submitted for analysis, id {i}".format(f=filename, i=flow_id))
+
+ while not md_sandbox.check(flow_id):
+ print("not done yet, sleeping 10 seconds...")
+ time.sleep(10)
+
+ print("Analysis complete. fetching report...")
+ print(md_sandbox.report(flow_id))
+
+
+if __name__ == "__main__":
+
+ def usage():
+ msg = "%s: | available | report | score | analyze "
+ print(msg % sys.argv[0])
+ sys.exit(1)
+
+ cmd = None
+ api_key = None
+ url = None
+
+ if len(sys.argv) == 4:
+ cmd = sys.argv.pop().lower()
+ api_key = sys.argv.pop()
+ url = sys.argv.pop()
+ arg = None
+
+ elif len(sys.argv) == 5:
+ arg = sys.argv.pop()
+ cmd = sys.argv.pop().lower()
+ api_key = sys.argv.pop()
+ url = sys.argv.pop()
+
+ else:
+ usage()
+
+ md_sandbox = MetaDefenderSandboxAPI(api_key, url)
+
+ if arg is None and "available" not in cmd:
+ usage()
+
+ # process command line arguments.
+ if "submit" in cmd:
+ with open(arg, "rb") as handle:
+ print(md_sandbox.analyze(handle, arg))
+
+ elif "available" in cmd:
+ print(md_sandbox.is_available())
+
+ elif "report" in cmd:
+ print(md_sandbox.report(arg))
+
+ elif "analyze" in cmd:
+ md_sandbox_loop(md_sandbox, arg)
+
+ elif "score" in cmd:
+ score = md_sandbox.score(arg)
+ print(score)
+
+ else:
+ usage()
diff --git a/sandboxapi/triage.py b/sandboxapi/triage.py
new file mode 100644
index 0000000..6a4eb0d
--- /dev/null
+++ b/sandboxapi/triage.py
@@ -0,0 +1,234 @@
+from __future__ import print_function
+
+import os
+import sys
+import json
+
+import sandboxapi
+
+class TriageAPI(sandboxapi.SandboxAPI):
+
+ def __init__(self, api_key, url=None, api_path=None, verify_ssl=True,
+ **kwargs):
+ """
+ :type api_key: str
+ :param api_key: The API key which can be found on the /account page
+ on the Triage web interface
+
+ :type url str
+ :param url The url (including the port) of the Triage instance
+ defaults to https://api.tria.ge
+
+ :type api_path str
+ :param api_path The path to the API on the Triage instance
+ defaults to /v0
+ """
+ sandboxapi.SandboxAPI.__init__(self, **kwargs)
+
+ self.api_key = api_key
+ self.base_url = url or "https://api.tria.ge"
+
+ self.api_url = self.base_url + (api_path or "/v0")
+
+ self.headers = {'Authorization': 'Bearer {:s}'.format(api_key)}
+
+ self.verify_ssl = verify_ssl
+
+ def request(self, uri, method='GET', params=None, files=None, auth=None):
+
+ response = self._request(
+ uri, method, params, files, self.headers, auth)
+
+ # Try parsing the response as JSON to see if we got a valid object
+ try:
+ data = response.json()
+ except ValueError as e:
+ raise sandboxapi.SandboxError(
+ "Triage returned a non JSON response {:s}", e)
+
+ # If we got a normal object check whether we didn't receive an error
+ # object
+ if "error" in data.keys():
+ raise sandboxapi.SandboxError(
+ "Triage raised an error: {:s} - {:s}".format(
+ data["error"], data["message"]))
+
+ # Everything is good to go
+ return data
+
+ def analyze(self, handle, filename):
+ """Submit a file for analysis.
+
+ :type handle: File handle
+ :param handle: Handle to file to upload for analysis.
+ :type filename: str
+ :param filename: File name.
+
+ :rtype: str
+ :return: File ID as a string
+ """
+ files = {"file": (filename, handle)}
+ params = {"_json": json.dumps({
+ "kind": "file",
+ "interactive": False
+ })}
+
+ # Ensure the handle is at offset 0.
+ handle.seek(0)
+
+ # Make the request to Triage
+ data = self.request("/samples", method='POST', files=files,
+ params=params)
+
+ if "id" in data.keys():
+ return data["id"]
+ else:
+ raise sandboxapi.SandboxError("Triage returned no ID")
+
+ def check(self, item_id):
+ """Check if an analysis is complete.
+
+ :type item_id: str
+ :param item_id: Analysis ID to check.
+
+ :rtype: bool
+ :return: Boolean indicating if a report is done or not.
+ """
+
+ data = self.request("/samples/{:s}/status".format(item_id))
+
+ if "status" in data.keys():
+ return data["status"] == "reported"
+ else:
+ raise sandboxapi.SandboxError("Triage didn't return a status")
+
+ def is_available(self):
+ """Determine if the Triage server is alive.
+
+ :rtype: bool
+ :return: True if service is available, False otherwise.
+ """
+
+ try:
+ self.request("/samples")
+ except sandboxapi.SandboxError:
+ return False
+
+ return True
+
+ def report(self, item_id, report_format="json"):
+ """Retrieves the specified report for the analyzed item,
+ referenced by item_id. Note that the summary is returned and more
+ detailed information is available.
+
+ :param str item_id: The id of the submitted file.
+ :param str report_format: In here for compatibility though Triage
+ only supports the JSON format
+
+ :rtype: dic
+ :return: Dictionary representing the JSON parsed data.
+ """
+
+ if report_format != "json":
+ raise sandboxapi.SandboxError(
+ "Triage api only supports the json report format")
+
+ data = self.request("/samples/{:s}/summary".format(item_id))
+
+ return data
+
+ def score(self, item_id):
+ """Gives back the highest score choosing from all the analyses
+
+ :param str item_id: The id of the submitted file.
+
+ :rtype: int
+ :return: int on a scale from 1 til 10
+ """
+ report = self.report(item_id)
+ # 1 Is the Triage base score
+ score = 1
+
+ # Loop over the available reports to pick the highest score
+ for task_id, task in report["tasks"].items():
+ if "score" in task:
+ if task["score"] > score:
+ score = task["score"]
+
+ return score
+
+ def full_report(self, item_id):
+ """Retrieves the summary report and the full report of each task for
+ the analyzed item, referenced by item_id.
+
+ :param str item_id: The id of the submitted file.
+
+ :rtype: dic
+ :return: Dictionary representing the JSON parsed data.
+ """
+ report = self.report(item_id)
+ full_report = {
+ 'summary': report,
+ 'tasks': {}
+ }
+
+ # Loop over all the tasks in the summary
+ for task_id in report["tasks"]:
+ # Remove the sample ID to get the task names
+ task_name = task_id.replace("{:s}-".format(item_id), "")
+
+ try:
+ # Try to retrieve each full report
+ triage_report = self.request(
+ "/samples/{:s}/{:s}/report_triage.json".format(
+ item_id, task_name))
+ full_report["tasks"][task_name] = triage_report
+ except sandboxapi.SandboxError:
+ continue
+
+ return full_report
+
+
+if __name__ == "__main__":
+
+ def usage():
+ msg = "%s: | | | "
+ print(msg % sys.argv[0])
+ sys.exit(1)
+
+ if len(sys.argv) == 4:
+ arg = sys.argv.pop()
+ cmd = sys.argv.pop().lower()
+ api_key = sys.argv.pop()
+
+ else:
+ usage()
+
+ triage = TriageAPI(api_key)
+
+ try:
+ if "submit" in cmd:
+ with open(arg, "r") as f:
+ sample_id = triage.analyze(f, os.path.basename(f.name))
+ print("Sample ID: {:s}".format(sample_id))
+
+ elif "check" in cmd:
+ if triage.check(arg):
+ print("Report done")
+ else:
+ print("Report is not done yet")
+
+ elif "full_report" in cmd:
+ sample = triage.full_report(arg)
+ print(sample)
+
+ elif "report" in cmd:
+ sample = triage.report(arg)
+ print(sample)
+
+ elif "score" in cmd:
+ score = triage.score(arg)
+ print(score)
+
+ except sandboxapi.SandboxError as e:
+ print("Unable to complete the action: {:s}".format(str(e)))
diff --git a/sandboxapi/wildfire.py b/sandboxapi/wildfire.py
new file mode 100644
index 0000000..c189f7d
--- /dev/null
+++ b/sandboxapi/wildfire.py
@@ -0,0 +1,200 @@
+from __future__ import print_function
+
+import json
+import sys
+
+import xmltodict
+
+import sandboxapi
+
+
+BENIGN = 0
+MALWARE = 1
+GRAYWARE = 2
+PHISHING = 4
+
+
+class WildFireAPI(sandboxapi.SandboxAPI):
+ """WildFire Sandbox API wrapper."""
+
+ def __init__(self, api_key='', url='', verify_ssl=True, **kwargs):
+ """Initialize the interface to the WildFire Sandbox API.
+
+ :param str api_key: The customer API key.
+ :param str url: The WildFire API URL.
+ """
+ super(WildFireAPI, self).__init__(**kwargs)
+ self.base_url = url or 'https://wildfire.paloaltonetworks.com'
+ self.api_url = self.base_url + '/publicapi'
+ self._api_key = api_key
+ self._score = BENIGN
+ self.verify_ssl = verify_ssl
+
+ def analyze(self, handle, filename):
+ """Submit a file for analysis.
+
+ :param BytesIO handle: File handle
+ :param str filename: File name
+ :rtype: str
+ :return: File ID as a string
+ """
+ # multipart post files.
+ files = {"file": (filename, handle)}
+
+ # ensure the handle is at offset 0.
+ handle.seek(0)
+
+ data = {'apikey': self._api_key}
+
+ response = self._request('/submit/file', method='POST', files=files, params=data)
+
+ try:
+ if response.status_code == 200:
+ output = self.decode(response)
+ return output['wildfire']['upload-file-info']['sha256']
+ else:
+ raise sandboxapi.SandboxError("api error in analyze ({}): {}".format(response.url, response.content))
+ except (ValueError, KeyError, IndexError) as e:
+ raise sandboxapi.SandboxError("error in analyze {}".format(e))
+
+ def decode(self, response):
+ """Convert a xml response to a python dictionary.
+
+ :param requests.Response response: A Response object with xml content.
+ :rtype: dict
+ :return: The xml content converted to a dictionary.
+ """
+ # This weird conversion to and from JSON is because the XML is being parsed as an Ordereddict.
+ # TODO: See if there's a better way to do this without having to convert to JSON.
+ output = json.loads(json.dumps(xmltodict.parse(response.content.decode('utf-8'))))
+ if 'error' in output:
+ raise sandboxapi.SandboxError(output['error']['error-message'])
+ return output
+
+ def check(self, item_id):
+ """Check if an analysis is complete.
+
+ :param str item_id: The hash of the file to check.
+ :rtype: bool
+ :return: True if the report is ready, otherwise False.
+ """
+ data = {
+ 'apikey': self._api_key,
+ 'hash': item_id,
+ }
+ response = self._request('/get/verdict', method='POST', params=data)
+
+ if not response.ok:
+ raise sandboxapi.SandboxError("{}: {}".format(response.status_code, response.content))
+
+ output = self.decode(response)
+ try:
+ status = int(output['wildfire']['get-verdict-info']['verdict'])
+ if status >= 0:
+ self._score = status
+ return True
+ elif status == -100:
+ return False
+ elif status == -101:
+ raise sandboxapi.SandboxError('An error occurred while processing the sample.')
+ elif status == -102:
+ raise sandboxapi.SandboxError('Unknown sample in the Wildfire database.')
+ elif status == -103:
+ raise sandboxapi.SandboxError('Invalid hash value.')
+ else:
+ raise sandboxapi.SandboxError('Unknown status.')
+ except (ValueError, IndexError) as e:
+ raise sandboxapi.SandboxError(e)
+
+ def is_available(self):
+ """Checks to see if the WildFire sandbox is up and running.
+
+ :rtype: bool
+ :return: True if the WildFire sandbox is responding, otherwise False.
+
+ WildFire doesn't have an explicit endpoint for checking the sandbox status, so this is kind of a hack.
+ """
+ try:
+ # Making a GET request to the API should always give a code 405 if the service is running.
+ # Relying on this fact to get a reliable 405 if the service is up.
+ response = self._request('/get/sample', params={'apikey': self._api_key})
+ if response.status_code == 405:
+ return True
+ else:
+ return False
+ except sandboxapi.SandboxError:
+ return False
+
+ def report(self, item_id, report_format='json'):
+ """Retrieves the specified report for the analyzed item, referenced by item_id.
+
+ :param str item_id: The hash of the file.
+ :param str report_format: Return format.
+ :rtype: dic
+ :return: Dictionary representing the JSON parsed data.
+ """
+ data = {
+ 'apikey': self._api_key,
+ 'hash': item_id,
+ 'format': 'xml',
+ }
+ response = self._request('/get/report', method='POST', params=data)
+ if not response.ok:
+ raise sandboxapi.SandboxError("{}: {}".format(response.status_code, response.content))
+ return self.decode(response)
+
+ def score(self):
+ """Get the threat score for the submitted sample.
+
+ :rtype: int
+ :return: The assigned threat score.
+ """
+ if self._score == MALWARE:
+ return 8
+ elif self._score == GRAYWARE:
+ return 2
+ elif self._score == PHISHING:
+ return 5
+ else:
+ return self._score
+
+
+if __name__ == "__main__":
+
+ def usage():
+ msg = "{}: available | submit | report | check ".format(sys.argv[0])
+ print(msg)
+ sys.exit(1)
+
+ api_key_ = ''
+ url_ = ''
+ arg = ''
+ cmd = ''
+ if len(sys.argv) == 5:
+ arg = sys.argv.pop()
+ cmd = sys.argv.pop().lower()
+ api_key_ = sys.argv.pop()
+ url_ = sys.argv.pop()
+ elif len(sys.argv) == 4:
+ arg = sys.argv.pop()
+ cmd = sys.argv.pop().lower()
+ api_key_ = sys.argv.pop()
+ elif len(sys.argv) == 3:
+ cmd = sys.argv.pop().lower()
+ api_key_ = sys.argv.pop()
+ else:
+ usage()
+
+ wildfire = WildFireAPI(api_key=api_key_, url=url_) if url_ else WildFireAPI(api_key_)
+
+ if cmd == 'available':
+ print(wildfire.is_available())
+ elif cmd == 'submit':
+ with open(arg, "rb") as handle:
+ print(wildfire.analyze(handle, arg))
+ elif cmd == "report":
+ print(wildfire.report(arg))
+ elif cmd == "check":
+ print(wildfire.check(arg))
+ else:
+ usage()
diff --git a/setup.py b/setup.py
index 7d983f8..e07ca3c 100644
--- a/setup.py
+++ b/setup.py
@@ -12,7 +12,7 @@
setup(
name='sandboxapi',
- version='1.4.3',
+ version='1.8.0',
include_package_data=True,
packages=[
'sandboxapi',
@@ -21,7 +21,7 @@
license='GPL',
description='Minimal, consistent API for building integrations with malware sandboxes.',
long_description=README,
- url='https://github.com/InQuest/python-sandboxapi',
+ url='https://github.com/InQuest/sandboxapi',
author='InQuest Labs',
author_email='labs@inquest.net',
classifiers=[
diff --git a/tests/__init__.py b/tests/__init__.py
new file mode 100644
index 0000000..fe9bf3b
--- /dev/null
+++ b/tests/__init__.py
@@ -0,0 +1,6 @@
+import os
+import json
+
+def read_resource(resource):
+ with open(os.path.join('tests', 'resources', '{r}.json'.format(r=resource)), 'r') as f:
+ return json.loads(f.read())
diff --git a/tests/resources/joe_submission_new.json b/tests/resources/joe_submission_new.json
new file mode 100644
index 0000000..be119b6
--- /dev/null
+++ b/tests/resources/joe_submission_new.json
@@ -0,0 +1,5 @@
+{
+ "data": {
+ "submission_id": "100001"
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/opswat_submissions_result_benign.json b/tests/resources/opswat_submissions_result_benign.json
new file mode 100644
index 0000000..f8855a2
--- /dev/null
+++ b/tests/resources/opswat_submissions_result_benign.json
@@ -0,0 +1,5578 @@
+{
+ "flowId": "6514d18233582f234e05276a",
+ "allFinished": true,
+ "allFilesDownloadFinished": true,
+ "allAdditionalStepsDone": true,
+ "reportsAmount": 1,
+ "priority": "least",
+ "pollPause": 12,
+ "fileSize": 1294917,
+ "sourceArchive": {
+ "scan_task_id": "8ac9f737-4e98-4793-8ba6-d63cd7696f6a",
+ "name": "sample.zip",
+ "mimeType": "application/zip",
+ "sha256": "d4990c542c0d2e55656a08ae4946f9b533444142bf2a5557d3a7e738af284d9f",
+ "private": false,
+ "is_link_upload": false,
+ "sha1": "2b8db2731fc7ff0b7a99c7b2c7d46dc5d675a919",
+ "sha512": "dad76250e7a02abed37ed0b590b559136a051212aa1db20e4a7558ae4e6587ef1f9fbea5903c451a86140c479b4f810ed6eefdcff9dba7781cd16a3b6ea85488",
+ "md5": "a9aec4126aa6b0c5ff85bbf4ffb8b9a9",
+ "tags": [
+ {
+ "source": "MEDIA_TYPE",
+ "tag": {
+ "name": "zip"
+ }
+ }
+ ],
+ "verdict": "benign"
+ },
+ "reports": {
+ "c57ac83f-6019-4947-9f1a-35c77aac2a96": {
+ "finalVerdict": {
+ "verdict": "BENIGN",
+ "threatLevel": -1,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": true,
+ "tag": {
+ "name": "peexe",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": true,
+ "tag": {
+ "name": "html",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": true,
+ "tag": {
+ "name": "xml",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "overallState": "success",
+ "taskReference": {
+ "name": "transform-file",
+ "additionalInfo": {
+ "submitName": "pingometer1_5.bin",
+ "submitTime": 1695864087816,
+ "digests": {
+ "SHA-256": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ "context": {
+ "contextData": "eJwBAAT/+1BLAwQUAwEACADRfjtXryi4Rp3BEwBI+BQAEQAAAHBpbmdvbWV0ZXIxXzUuYmlu4O3kAV2RCdqHjJNffBB/JwbHnBQYcaqNpovhcEoguwfmUYGXimplCcjyNTIhubIT3VTJ4VYTK6yzWto7SH9W4VLMuN6ytQ0a75ukew/MDFtDolQfkHL/O5fdsdvVRSGlK1AiNcxnRrvP0LlwM+84EyVIgcUqTJI8KU1Wj5cqZMV5sd/jS/qcjSu7Kiig29q++oyhDS6I32W0tsIBrC2qu2h8ExTKGEOvmaLwk7ThUMu3upm4reG/ijx7KTBbkycBa/ES5ftyJV+lKCpmIc8mV/37B13+ppmgP1SYXv1rPEoNCe1u029O7lNA8KvHzLovIeCA/SmEClNzP+kUIAR+HAv8xVKU312HsaLoz3/G4UU4FIJuqYHZ9vVOiPNtOAkzsng3mooGQU8Zl/VOZ5P9eHbZuR/QCVj+pW5lVAudmTg+VIhMhx1qzvo0zpMyttTBhzf+4ZM1hoJM/k6aEHFfhDjZF/jIEvq7JHLExlC9RIG9J0SNxiMoXDcL7LHBNMKY5v3qnOWamvojfih0jmGE5iiMoesCuZsErGRkdYrryG0E/S8i0LOmpKrOGyzKeW37+9GVTKs/xhROjr/j5noAxC0CNL5Bgb5wxEV6vTEV66VG4ROoASS/K6idjbsVrEArWOsd0NU5pyA0JTBkjtLGG3DDYRR16KlBQ/7wr59uZhEHl6epX3k4Vu4K+MtEmjh4fgyhHwL1ne7VoeFibySUoxria3flvzu35zcFkGu4TFist/TwQ+327mNAqsT6QPSlFIAVM382nRi0avGjOtERa3rEesYsMrfhq1pbc1r+RkbxFffkeO3dNxiJuq3oPycrUoSTZDeUCHcrCP6WWHb59kJjsaj2cFYINP3zurd7n+XYJTQj4rATy8eq6QqAo8kot+snzvj6WSYnj6A104utxYoYnjYMF2W5mOTcRfou2Hr78gzdrh78AG0NlAz6FIYsX3ylwI8n9Sse9Zc/Y2Px6hE7aq/Y85VpJKr1Zl5p/AXbl9RC+8ysXqeC3OyvGo6JeFUi2KpKDh7YEfsgePNT+x56hxz6OMIB8iofPDBfMy3OIb8tbSmY8JE4CXXIZOBHOpLgBXPiXsSg8Z6en/hrGYOv4M35ecRzKt48+p9xrDyc63Y2mSXabMaMSwzF42BBa167nLKdbb8GFReCck2ibp0ACg4GowfHz0a+2GKnE8Hj/fdb+tcpb768Isn1GiPb0EouIjXPZd7SEXC10J3gK7ibjcVA9h4VzrlwIZejpEmetz9II2DZCnmU2rsV9YEbRInuOGAnPw1bS6fbWi9xylFSAPsY",
+ "contextDataIsPartial": true,
+ "contextOriginalSize": 1374280,
+ "contextIdentifier": "d4990c542c0d2e55656a08ae4946f9b533444142bf2a5557d3a7e738af284d9f",
+ "contextType": "PARENT_FILE",
+ "metaData": {
+ "additionalHashes": {
+ "MD5": "a9aec4126aa6b0c5ff85bbf4ffb8b9a9",
+ "SHA-1": "2b8db2731fc7ff0b7a99c7b2c7d46dc5d675a919",
+ "SHA-512": "dad76250e7a02abed37ed0b590b559136a051212aa1db20e4a7558ae4e6587ef1f9fbea5903c451a86140c479b4f810ed6eefdcff9dba7781cd16a3b6ea85488"
+ },
+ "totalArchiveFiles": 1,
+ "name": "sample.zip",
+ "additionalInfo": "MEDIA_TYPE:zip"
+ }
+ }
+ },
+ "ID": "bc9b2fda-6223-49c7-a367-bcec38aaf3a4",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "TRANSFORM_FILE",
+ "name": "file",
+ "ID": "d90d2e92-5b3b-4128-93d7-0ab5c01e5b23"
+ },
+ "opcount": 1,
+ "processTime": 25098
+ },
+ "subtaskReferences": [
+ {
+ "name": "visualization",
+ "additionalInfo": "6310dbe6-639b-4d62-b129-d34b2478f946",
+ "ID": "aed65a42-c7ed-442e-8af4-b136a5d39637",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "VISUALIZATION",
+ "name": "visualization",
+ "ID": "6310dbe6-639b-4d62-b129-d34b2478f946"
+ },
+ "opcount": 1,
+ "processTime": 320
+ },
+ {
+ "name": "osint",
+ "additionalInfo": "d90d2e92-5b3b-4128-93d7-0ab5c01e5b23",
+ "ID": "56b5d5ec-c164-425a-a69f-31d0956cf387",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "91b76bd0-abe3-4961-b9c4-e18d29dbbd75"
+ },
+ "opcount": 4,
+ "processTime": 1013
+ },
+ {
+ "name": "domain-resolve",
+ "additionalInfo": 3,
+ "ID": "f2699e18-be73-44d7-9897-7fdc6f336627",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "DOMAIN_RESOLVE",
+ "name": "domain-resolve",
+ "ID": "d459645a-27c5-4791-8199-8fab1e61a64b"
+ },
+ "opcount": 2,
+ "processTime": 1131
+ },
+ {
+ "name": "file-download",
+ "additionalInfo": 8,
+ "ID": "2a8b9977-3992-4597-8975-bfdd7b572c45",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "FILE_DOWNLOAD",
+ "name": "file-download",
+ "ID": "9234a34f-65aa-44e3-bd82-87cd1ce337be"
+ },
+ "opcount": 8,
+ "processTime": 7295
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "FILE_HASH_SHA256",
+ "ID": "50e812b1-39d6-46b2-b4c2-d733601c6194",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "188b01f3-b0fb-4bb8-acec-8082b8fab76a"
+ },
+ "opcount": 52,
+ "processTime": 4067
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "URL",
+ "ID": "5320b667-974a-47e7-905b-9733b807d200",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "4c5c419c-d495-480a-8fa2-ccb409564703"
+ },
+ "opcount": 4,
+ "processTime": 1051
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "DOMAIN",
+ "ID": "ee25c617-2aa7-41d9-9f8c-e2019ed4b44a",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "ee64450e-be0b-4df2-8273-11a363f84537"
+ },
+ "opcount": 0,
+ "processTime": 6
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "EMAIL",
+ "ID": "2b447481-8b53-484f-926f-d8c837487200",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "d1faa0c7-d84d-4589-85a3-e14e05753482"
+ },
+ "opcount": 2,
+ "processTime": 25
+ },
+ {
+ "name": "osint-fuzzyhash",
+ "additionalInfo": "d90d2e92-5b3b-4128-93d7-0ab5c01e5b23",
+ "ID": "c0c18356-a80b-4409-8b94-4283d3f2b127",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "e2f65b0c-8e1b-419f-a398-9ac5b03e80e6"
+ },
+ "opcount": 2,
+ "processTime": 1007
+ }
+ ],
+ "allSignalGroups": [
+ {
+ "identifier": "SIGG017",
+ "description": "Executable may be carrying a suspicious packed payload",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "signalReadable": "A non-installer executable is not digitally signed and contains high-entropy (packed) data likely to be executed",
+ "additionalInfo": "",
+ "originPath": "signalSummary.allTags",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "dataUUID": "d90d2e92-5b3b-4128-93d7-0ab5c01e5b23"
+ }
+ ]
+ },
+ {
+ "identifier": "S007",
+ "description": "Found a Windows desktop utility string artifact",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"where\"",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"where\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ },
+ {
+ "identifier": "H060",
+ "description": "PE has icon",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.2,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"0a1aaeecc53ede5cdbaf1f5cbd0c83421a2d0902424b955cc2aea98c5d785ef6\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"fa0dfa9c55080ae3b2b836954fd2885f404844881c23d8a20fa4f6245c207e48\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"55d1e60e7e11924da2896e53051bd8966205a208a9a0aa06a4b6157b09bd0cce\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"0a1aaeecc53ede5cdbaf1f5cbd0c83421a2d0902424b955cc2aea98c5d785ef6\")",
+ "originPath": "file.extractedFiles.extendedData.resources.resources",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"fa0dfa9c55080ae3b2b836954fd2885f404844881c23d8a20fa4f6245c207e48\")",
+ "originPath": "file.extractedFiles.extendedData.resources.resources",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"55d1e60e7e11924da2896e53051bd8966205a208a9a0aa06a4b6157b09bd0cce\")",
+ "originPath": "file.extractedFiles.extendedData.resources.resources",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda\")",
+ "originPath": "file.extractedFiles.extendedData.resources.resources",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf\")",
+ "originPath": "file.extractedFiles.extendedData.resources.resources",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H041",
+ "description": "PE imports APIs often used by malware",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetFileType@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"GetFileType@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H062",
+ "description": "PE takes commandline arguments",
+ "allMitreTechniques": [
+ {
+ "ID": "T1059",
+ "relatedTactic": {
+ "ID": "TA0002",
+ "name": "Execution"
+ },
+ "name": "Command and Scripting Interpreter"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.2,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetCommandLineA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ },
+ {
+ "identifier": "H032",
+ "description": "PE imports APIs used to access or modify the registry",
+ "allMitreTechniques": [
+ {
+ "ID": "T1012",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "Query Registry"
+ }
+ ],
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegOpenKeyExA@ADVAPI32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegQueryValueExA@ADVAPI32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegCloseKey@ADVAPI32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"RegOpenKeyExA@ADVAPI32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"RegQueryValueExA@ADVAPI32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"RegCloseKey@ADVAPI32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "PE005",
+ "description": "PE contains an untrusted digital certificate",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7\" contains a \"self-signed\" digital signature from \"OU=\\\"NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.\\\", OU=VeriSign Time Stamping Service Root, OU=\\\"VeriSign, Inc.\\\", O=VeriSign Trust Network\" (Serial: 1389b4d18ae8a7c4bd35c79b8d88ca1fca535691)",
+ "additionalInfo": "1389b4d18ae8a7c4bd35c79b8d88ca1fca535691",
+ "originPath": "file.certInfos",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ },
+ {
+ "identifier": "H000",
+ "description": "Executable section has an unusual entropy",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "\".data\" has an unusual entropy \"0.884210288525\"",
+ "originPath": "file.extractedFiles.extendedData.sections.entropy",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H036",
+ "description": "PE imports APIs used to create temporary files",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetTempPathA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"CreateFileA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"GetTempPathA@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"CreateFileA@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H016",
+ "description": "PE imports APIs used to hide other imports",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetProcAddress@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"GetProcAddress@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"LoadLibraryA@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H004",
+ "description": "PE imports suspicious APIs",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.2,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WriteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetFileAttributes@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetFileTime@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"DeleteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetTempFileName@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LockResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LoadResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"CreateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RemoveDirectory@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"FindNextFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WritePrivateProfileSection@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WritePrivateProfileString@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"MoveFileEx@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetFileSize@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"MapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"UnmapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetDiskFreeSpace@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"FindFirstFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetFileType@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetEnvironmentStrings@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"TerminateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetWindowText@user32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SystemParametersInfo@user32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SHBrowseForFolder@shell32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SHGetPathFromIDList@shell32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LZCopy@lz32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LZClose@lz32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"WriteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"SetFileAttributes@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"SetFileTime@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"DeleteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetTempFileName@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"LockResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"LoadResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"CreateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"RemoveDirectory@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"FindNextFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"WritePrivateProfileSection@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"WritePrivateProfileString@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"MoveFileEx@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetFileSize@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"MapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"UnmapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetDiskFreeSpace@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"FindFirstFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetFileType@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetEnvironmentStrings@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"TerminateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"GetWindowText@user32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"SystemParametersInfo@user32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"SHBrowseForFolder@shell32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"SHGetPathFromIDList@shell32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"LZCopy@lz32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Import \"LZClose@lz32.dll\" is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H007",
+ "description": "PE imports suspicious modules",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Imported module \"lz32.dll\" (related to \"compression\" activity) is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.module",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Imported module \"lz32.dll\" (related to \"compression\" activity) is marked as suspicious",
+ "originPath": "file.extractedFiles.extendedData.importsEx.module",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "H028",
+ "description": "PE imports APIs used to launch other processes",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"CreateProcessA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"ShellExecuteA@SHELL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"CreateProcessA@KERNEL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found API reference \"ShellExecuteA@SHELL32.dll\"",
+ "originPath": "file.extractedFiles.extendedData.imports.imports",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ]
+ },
+ {
+ "identifier": "PE004",
+ "description": "PE header references a certificate",
+ "averageSignalStrength": 0,
+ "peakSignalStrength": 0,
+ "finalSignalStrength": 0,
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7\" contains header field related to digital certificate.",
+ "additionalInfo": "",
+ "originPath": "file.extendedData",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ },
+ {
+ "identifier": "EF001",
+ "description": "Contains an overlay",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Input file has a \"1244232\" byte overlay at offset \"130048\"",
+ "additionalInfo": "7bef3c3bd1935fe9e0be1dc835acc7cb5e027d16351bc9c3583d3782d1bc25a4",
+ "originPath": "file.extractedFiles",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "EF002",
+ "description": "Contains an overlay with an unusually high entropy",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Input file has a \"1244232\" byte overlay at offset \"130048\" with an entropy of \"7.99913454056\"",
+ "additionalInfo": "7bef3c3bd1935fe9e0be1dc835acc7cb5e027d16351bc9c3583d3782d1bc25a4",
+ "originPath": "file.extractedFiles",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "S051",
+ "description": "Found a living off the land (LotL) string artifact",
+ "allMitreTechniques": [
+ {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"shell32.dll\" (Execute)",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"shell32.dll\" (Execute)",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ }
+ ]
+ },
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf\" as \"INFORMATIONAL\"",
+ "additionalInfo": "a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "f33a89eb6f51f70b4862cba1662937cc376a4432906d5f4b0483e4b01dda52fa"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda\" as \"INFORMATIONAL\"",
+ "additionalInfo": "e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344\" as \"INFORMATIONAL\"",
+ "additionalInfo": "11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d\" as \"INFORMATIONAL\"",
+ "additionalInfo": "f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ },
+ {
+ "identifier": "D001",
+ "description": "Found a domain referencing a social media service",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"instagram.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"linkedin.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"twitter.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ]
+ },
+ {
+ "identifier": "S007",
+ "description": "Found a Windows desktop utility string artifact",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"where\"",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"convert\"",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ]
+ },
+ {
+ "identifier": "HTML000",
+ "description": "Embedded script size is high in proportion to the whole file",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.2,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Script to the whole file ratio is: \"97.60%\", which is remarkably high",
+ "originPath": "file.extendedData",
+ "originType": "DOWNLOADED_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ }
+ ],
+ "resources": {
+ "188b01f3-b0fb-4bb8-acec-8082b8fab76a": {
+ "results": [
+ {
+ "resource": "a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "f33a89eb6f51f70b4862cba1662937cc376a4432906d5f4b0483e4b01dda52fa"
+ },
+ "type": "FILE_HASH_SHA256",
+ "osintProvider": "OPSWAT_REPUTATION",
+ "data": {
+ "scan_result_history_length": 47,
+ "sandbox": false,
+ "file_id": "bzIzMDUyMjlFdFktTUlDTQ",
+ "data_id": "YnpJek1EVXlNamxGZEZrdFRVbERUUTdNUEJ5SXM5OFM",
+ "process_info": {
+ "progress_percentage": 100,
+ "profile": "multiscan_unarchive",
+ "result": "Allowed",
+ "blocked_reason": "",
+ "file_type_skipped_scan": false,
+ "post_processing": {
+ "actions_failed": "",
+ "actions_ran": "",
+ "converted_destination": "",
+ "converted_to": "",
+ "copy_move_destination": ""
+ },
+ "verdicts": [
+ "No Threat Detected"
+ ],
+ "blocked_reasons": []
+ },
+ "parent_data_id": "YnpJek1EVXlNamxGZEZrdFRVbERUUU5XWFdOWkJvWmY",
+ "scan_results": {
+ "scan_details": {
+ "AegisLab": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T07:51:19.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "AhnLab": {
+ "scan_time": 1,
+ "def_time": "2023-05-23T00:00:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Antiy": {
+ "scan_time": 0,
+ "def_time": "2023-05-23T03:01:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Avira": {
+ "scan_time": 2,
+ "def_time": "2023-05-22T17:24:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Bitdefender": {
+ "scan_time": 28,
+ "def_time": "2023-05-22T19:57:22.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "ClamAV": {
+ "scan_time": 100,
+ "def_time": "2023-05-22T07:23:18.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Comodo": {
+ "scan_time": 25,
+ "def_time": "2023-05-22T12:54:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "CrowdStrike Falcon ML": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T00:00:00.000Z",
+ "scan_result_i": 23,
+ "threat_found": ""
+ },
+ "Cyren": {
+ "scan_time": 24,
+ "def_time": "2023-05-22T19:27:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "ESET": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T17:48:20.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Emsisoft": {
+ "scan_time": 10,
+ "def_time": "2023-05-22T16:03:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Filseclab": {
+ "scan_time": 962,
+ "def_time": "2023-05-17T22:53:50.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Huorong": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T10:35:52.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "IKARUS": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T18:14:11.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "K7": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T16:08:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Kaspersky": {
+ "scan_time": 3,
+ "def_time": "2023-05-22T18:19:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "McAfee": {
+ "scan_time": 11,
+ "def_time": "2023-05-22T00:00:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "NANOAV": {
+ "scan_time": 1,
+ "def_time": "2023-05-22T16:26:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Quick Heal": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T17:17:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "RocketCyber": {
+ "scan_time": 2,
+ "def_time": "2023-05-22T00:00:00.000Z",
+ "scan_result_i": 23,
+ "threat_found": ""
+ },
+ "Scrutiny": {
+ "scan_time": 3270,
+ "def_time": "2023-05-22T00:00:00.000Z",
+ "scan_result_i": 23,
+ "threat_found": ""
+ },
+ "Sophos": {
+ "scan_time": 985,
+ "def_time": "2023-05-22T00:38:21.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "TACHYON": {
+ "scan_time": 27,
+ "def_time": "2023-05-22T00:00:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Trend Micro": {
+ "scan_time": 1651,
+ "def_time": "2023-05-21T20:22:07.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Trend Micro HouseCall": {
+ "scan_time": 2014,
+ "def_time": "2023-05-21T20:33:36.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "VirusBlokAda": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T15:55:57.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Webroot SMD": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T08:11:18.000Z",
+ "scan_result_i": 23,
+ "threat_found": ""
+ },
+ "Microsoft Defender": {
+ "scan_time": 0,
+ "def_time": "2023-05-22T13:15:10.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Xvirus Anti-Malware": {
+ "scan_time": 3,
+ "def_time": "2023-05-21T19:43:12.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Zillya!": {
+ "scan_time": 2,
+ "def_time": "2023-05-22T18:19:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Vir__IT eXplorer": {
+ "scan_time": 152,
+ "def_time": "2023-05-22T12:35:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ },
+ "Vir__IT ML": {
+ "scan_time": 403,
+ "def_time": "2023-05-22T12:35:00.000Z",
+ "scan_result_i": 0,
+ "threat_found": ""
+ }
+ },
+ "scan_all_result_i": 0,
+ "current_av_result_i": 0,
+ "start_time": "2023-05-22T21:16:09.378Z",
+ "total_time": 3981,
+ "total_avs": 32,
+ "total_detected_avs": 0,
+ "progress_percentage": 100,
+ "scan_all_result_a": "No Threat Detected",
+ "current_av_result_a": "No Threat Detected"
+ },
+ "file_info": {
+ "file_size": 20,
+ "upload_timestamp": "2023-05-22T21:16:03.491Z",
+ "md5": "42CF62B780813706E75FB9F2B2E8C258",
+ "sha1": "A022D5C1CFDD8AACE0089F3E72F2EEDD41BDA464",
+ "sha256": "A0C9D012E2BF6B2FE05C2D97CB5594D97CF2F539E97935C12ABD7A3562F4D9BF",
+ "file_type_category": "O",
+ "file_type_description": "data",
+ "file_type_extension": "dat",
+ "display_name": ""
+ },
+ "share_file": 1,
+ "private_processing": 0,
+ "rest_version": "4",
+ "additional_info": [
+ "vulnerability"
+ ],
+ "votes": {
+ "up": 0,
+ "down": 0
+ },
+ "stored": false
+ },
+ "verdict": "INFORMATIONAL",
+ "tags": [],
+ "lookupTime": 154,
+ "isCachedResult": true
+ },
+ {
+ "resource": "e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd"
+ },
+ "type": "FILE_HASH_SHA256",
+ "osintProvider": "OPSWAT_REPUTATION",
+ "data": {
+ "scan_result_history_length": 2,
+ "sandbox": false,
+ "file_id": "bzIwMDkyMnhzYmJHR18xWA",
+ "data_id": "YnpJd01Ea3lNbmh6WW1KSFIxOHhXQXY4UE1tV1VSR0t1",
+ "process_info": {
+ "post_processing": {
+ "copy_move_destination": "",
+ "converted_to": "",
+ "converted_destination": "",
+ "actions_ran": "",
+ "actions_failed": ""
+ },
+ "result": "Allowed",
+ "progress_percentage": 100,
+ "profile": "multiscan_unarchive",
+ "file_type_skipped_scan": false,
+ "blocked_reason": "",
+ "verdicts": [
+ "No Threat Detected"
+ ],
+ "blocked_reasons": []
+ },
+ "parent_data_id": "YnpJd01Ea3lNbmh6WW1KSFIxOHhXQW9lSFdjUy1fRQ",
+ "scan_results": {
+ "scan_details": {
+ "AegisLab": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T05:22:00.000Z"
+ },
+ "Ahnlab": {
+ "threat_found": "",
+ "scan_time": 1,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T00:00:00.000Z"
+ },
+ "Antiy": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T03:47:00.000Z"
+ },
+ "Avira": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T00:00:00.000Z"
+ },
+ "BitDefender": {
+ "threat_found": "",
+ "scan_time": 82,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T01:45:00.000Z"
+ },
+ "ByteHero": {
+ "threat_found": "",
+ "scan_time": 2554,
+ "scan_result_i": 0,
+ "def_time": "2020-09-20T00:00:00.000Z"
+ },
+ "ClamAV": {
+ "threat_found": "",
+ "scan_time": 6604,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T13:52:00.000Z"
+ },
+ "Comodo": {
+ "threat_found": "",
+ "scan_time": 2784,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T19:05:45.000Z"
+ },
+ "CrowdStrike Falcon ML": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 23,
+ "def_time": "2020-09-22T00:00:00.000Z"
+ },
+ "Cyren": {
+ "threat_found": "",
+ "scan_time": 10,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T03:10:00.000Z"
+ },
+ "ESET": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T00:00:00.000Z"
+ },
+ "Emsisoft": {
+ "threat_found": "",
+ "scan_time": 21,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T14:24:00.000Z"
+ },
+ "F-prot": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T02:00:00.000Z"
+ },
+ "Filseclab": {
+ "threat_found": "",
+ "scan_time": 3670,
+ "scan_result_i": 0,
+ "def_time": "2020-09-20T22:50:00.000Z"
+ },
+ "Fortinet": {
+ "threat_found": "",
+ "scan_time": 811,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T00:00:00.000Z"
+ },
+ "Hauri": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T00:00:00.000Z"
+ },
+ "Huorong": {
+ "threat_found": "",
+ "scan_time": 230,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T09:32:00.000Z"
+ },
+ "Ikarus": {
+ "threat_found": "",
+ "scan_time": 1,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T18:14:18.000Z"
+ },
+ "Jiangmin": {
+ "threat_found": "",
+ "scan_time": 8637,
+ "scan_result_i": 0,
+ "def_time": "2020-09-19T19:22:00.000Z"
+ },
+ "K7": {
+ "threat_found": "",
+ "scan_time": 1,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T11:23:00.000Z"
+ },
+ "Kaspersky": {
+ "threat_found": "",
+ "scan_time": 26,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T01:27:00.000Z"
+ },
+ "McAfee": {
+ "threat_found": "",
+ "scan_time": 137,
+ "scan_result_i": 0,
+ "def_time": "2020-09-20T00:00:00.000Z"
+ },
+ "NANOAV": {
+ "threat_found": "",
+ "scan_time": 1,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T22:13:00.000Z"
+ },
+ "Preventon": {
+ "threat_found": "",
+ "scan_time": 11549,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T22:29:00.000Z"
+ },
+ "Quick Heal": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T06:09:00.000Z"
+ },
+ "RocketCyber": {
+ "threat_found": "",
+ "scan_time": 2,
+ "scan_result_i": 23,
+ "def_time": "2020-09-22T00:00:00.000Z"
+ },
+ "Sophos": {
+ "threat_found": "",
+ "scan_time": 917,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T02:58:00.000Z"
+ },
+ "SUPERAntiSpyware": {
+ "threat_found": "",
+ "scan_time": 9355,
+ "scan_result_i": 0,
+ "def_time": "2020-09-17T20:23:00.000Z"
+ },
+ "TACHYON": {
+ "threat_found": "",
+ "scan_time": 188,
+ "scan_result_i": 0,
+ "def_time": "2020-09-22T05:00:00.000Z"
+ },
+ "TrendMicro": {
+ "threat_found": "",
+ "scan_time": 7094,
+ "scan_result_i": 0,
+ "def_time": "2020-09-20T20:22:00.000Z"
+ },
+ "TrendMicro House Call": {
+ "threat_found": "",
+ "scan_time": 6499,
+ "scan_result_i": 0,
+ "def_time": "2020-09-20T20:37:00.000Z"
+ },
+ "VirusBlokAda": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T08:23:00.000Z"
+ },
+ "Webroot SMD": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 23,
+ "def_time": "2020-09-21T09:00:14.000Z"
+ },
+ "Windows Defender": {
+ "threat_found": "",
+ "scan_time": 308,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T23:53:26.000Z"
+ },
+ "Xvirus Personal Guard": {
+ "threat_found": "",
+ "scan_time": 46,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T03:35:00.000Z"
+ },
+ "Zillya!": {
+ "threat_found": "",
+ "scan_time": 2,
+ "scan_result_i": 0,
+ "def_time": "2020-09-19T13:57:00.000Z"
+ },
+ "Vir__IT eXplorer": {
+ "threat_found": "",
+ "scan_time": 1,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T11:40:00.000Z"
+ },
+ "Vir__IT ML": {
+ "threat_found": "",
+ "scan_time": 0,
+ "scan_result_i": 0,
+ "def_time": "2020-09-21T14:46:00.000Z"
+ }
+ },
+ "scan_all_result_i": 0,
+ "current_av_result_i": 0,
+ "start_time": "2020-09-22T05:56:06.949Z",
+ "total_time": 69903,
+ "total_avs": 38,
+ "total_detected_avs": 0,
+ "progress_percentage": 100,
+ "scan_all_result_a": "No Threat Detected",
+ "current_av_result_a": "No Threat Detected"
+ },
+ "file_info": {
+ "file_size": 34,
+ "upload_timestamp": "2020-09-22T05:56:05.431Z",
+ "md5": "29A1F473B6FC0B877CE30BE83212F25A",
+ "sha1": "A66309103E9F7FF118FD964F2CD5AE04BBD4A322",
+ "sha256": "E5D571D7F26FA57C7E00290D0FA8AEF8C1D519983E0AA5ECD75F5D4B41FA4CDA",
+ "file_type_category": "O",
+ "file_type_description": "data",
+ "file_type_extension": "dat",
+ "display_name": "DRPSuPacker\\drp\\.rsrc\\GROUP_ICON\\128"
+ },
+ "share_file": 0,
+ "rest_version": "4",
+ "additional_info": [],
+ "votes": {
+ "up": 0,
+ "down": 0
+ },
+ "stored": false
+ },
+ "verdict": "INFORMATIONAL",
+ "tags": [],
+ "lookupTime": 253,
+ "isCachedResult": true
+ },
+ {
+ "resource": "11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ "type": "FILE_HASH_SHA256",
+ "osintProvider": "OPSWAT_REPUTATION",
+ "data": {
+ "file_info": {
+ "sha256": "11BD13D42F1F62FDD4BB646455842B5B55B564A7D1C40D4BBB567FB7DB437344"
+ },
+ "scan_results": {
+ "scan_details": {
+ "Kaspersky": {
+ "scan_result_i": 0,
+ "threat_found": "",
+ "def_time": "2011-02-08T04:03:00"
+ }
+ },
+ "scan_all_result_i": 0,
+ "scan_all_result_a": "No threat detected",
+ "total_detected_avs": 0,
+ "total_avs": 1
+ },
+ "malware_type": []
+ },
+ "verdict": "INFORMATIONAL",
+ "tags": [],
+ "lookupTime": 268
+ },
+ {
+ "resource": "f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ "type": "FILE_HASH_SHA256",
+ "osintProvider": "OPSWAT_REPUTATION",
+ "data": {
+ "file_info": {
+ "sha256": "F929A23B7992AEC06C2D4BC29E4E595E5C1CEC1215C0CC00488EF649D266279D"
+ },
+ "scan_results": {
+ "scan_details": {
+ "Avira": {
+ "scan_result_i": 0,
+ "threat_found": "",
+ "def_time": "2023-06-08T12:03:35.455Z"
+ }
+ },
+ "scan_all_result_i": 0,
+ "scan_all_result_a": "No threat detected",
+ "total_detected_avs": 0,
+ "total_avs": 1
+ },
+ "malware_type": []
+ },
+ "verdict": "INFORMATIONAL",
+ "tags": [],
+ "lookupTime": 262
+ }
+ ],
+ "relatedTaskType": "OSINT_EXTENDED",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "188b01f3-b0fb-4bb8-acec-8082b8fab76a"
+ },
+ "mediaType": {
+ "string": "application/octet-stream",
+ "slash": 11,
+ "semicolon": 24,
+ "parameters": {}
+ },
+ "signalGroupsByID": {
+ "I001": {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf\" as \"INFORMATIONAL\"",
+ "additionalInfo": "a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "f33a89eb6f51f70b4862cba1662937cc376a4432906d5f4b0483e4b01dda52fa"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda\" as \"INFORMATIONAL\"",
+ "additionalInfo": "e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344\" as \"INFORMATIONAL\"",
+ "additionalInfo": "11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d\" as \"INFORMATIONAL\"",
+ "additionalInfo": "f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ }
+ },
+ "signalGroups": [
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf\" as \"INFORMATIONAL\"",
+ "additionalInfo": "a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "f33a89eb6f51f70b4862cba1662937cc376a4432906d5f4b0483e4b01dda52fa"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda\" as \"INFORMATIONAL\"",
+ "additionalInfo": "e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344\" as \"INFORMATIONAL\"",
+ "additionalInfo": "11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d\" as \"INFORMATIONAL\"",
+ "additionalInfo": "f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ]
+ }
+ ],
+ "allTags": [],
+ "originVerdicts": [
+ {
+ "identifier": "8110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd",
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ },
+ {
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ },
+ {
+ "identifier": "f33a89eb6f51f70b4862cba1662937cc376a4432906d5f4b0483e4b01dda52fa",
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ ],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "notifications": []
+ }
+ },
+ "iocs": {
+ "sha1": [
+ {
+ "data": "902a9485936d9b2c1bed6b747b2ca97119cfdb26",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "44fdf6020192914cfc94eb7760d16f1258519575",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ff11c246651fe9afa146f6622fe596be981f49ea",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ae7a0af8ba1e8d4d3531fec6e5a7e9616956957d",
+ "origins": [
+ {
+ "type": "PE_UNPACKING",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "cd18c97ae994e236bc01570e3cdede45f6199102",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "93090678ff9deff6f209b896fbb05dfe12e3bfe2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2b8db2731fc7ff0b7a99c7b2c7d46dc5d675a919",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "705ba1ee45e1cf79fdaf41a33e8e93975b686297",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a022d5c1cfdd8aace0089f3e72f2eedd41bda464",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e9571ec226340800aab97a131d456cf876e5a1ae",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e90b1c7b09a298a238ddf2754ff9ceabbc9e28ec",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a66309103e9f7ff118fd964f2cd5ae04bbd4a322",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "5eb1bde42c1372a9fe67313316b9f3e4aca6b7b9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "47d815eb50ad5faec66d647449b3b8e3cab109e9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c11928a25124cbf7d34a1edcbcf9c4a9f2464016",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "da3d5452660de0b2a0ae97d076bd3688d3494edf",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3ef317d9a236fc5df74d492bc2cbca4f0343e7fc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "6964af963a08ff554afb05c9ab8fae2e66e53695",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "dc774c41b0bc451a9bb2c680eaca0a28cc0c4904",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a962b2b3b3c06093c05c05ba0c6785b4847ea457",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "44835120d21db96bbccce3ca1c84680de0f60cc3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "fab6212e32934430f2b207bdcb7fc02a940a274e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "fed036c74fe423f2cca81ec5a69aa58f7f0d0453",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "24d8724ab4a303a4eea3790245f985950ab8950f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0208453db06207b18a77a4b3e4eeb8ec50a29120",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "70fd58e7c7be659a038e09e1bc800e78806f4073",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha256": [
+ {
+ "data": "69c6ad296384fe515d9587d9328b2e47e3a12d0c5d54607468ef3802898ea3c4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "fa0dfa9c55080ae3b2b836954fd2885f404844881c23d8a20fa4f6245c207e48",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0a1aaeecc53ede5cdbaf1f5cbd0c83421a2d0902424b955cc2aea98c5d785ef6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "68a0db9341fac879faa81750ee349edb083d9d19e1df88f190c2f81bb6730de9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ccfc798618c7494bb2c2140eb28e1f472578def8e314ff8b1dfb59f9c9bab925",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "930c2fc4582877b1ae749a7f6875348c69d0455f8bd3d2d0a9c6e82f9524d0c9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "70e1d752dc3268aa93aa7166dbf3c09eed9758cf1614e85375d39a660447486e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0944189f0eed816c99c4781b374567f891a71bd37322eb5ddd589415e91e87fb",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b4344daca5ab07f837312b6e6a3df9c9e42713d9415a9828e3760dd6f29d32b3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ccdee7ec322dc4f6802d6d58b737ca5f32bd27e5d351ead3c0d7d93b8441a45a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "11bd13d42f1f62fdd4bb646455842b5b55b564a7d1c40d4bbb567fb7db437344",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "98a9b93ecf50ef3be8568126be5de227a76dff99852ab3f36908b31db059dad1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "79bcf084108ca762180ca100e4489e0e3e3821e7e8dbc067e3a5d84b38936fd9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e5d571d7f26fa57c7e00290d0fa8aef8c1d519983e0aa5ecd75f5d4b41fa4cda",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f28eadb3a8e22725fad15076bc31147f5d034295a4364a47504d4b48768226cf",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a0c9d012e2bf6b2fe05c2d97cb5594d97cf2f539e97935c12abd7a3562f4d9bf",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13",
+ "origins": [
+ {
+ "type": "PE_UNPACKING",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "f929a23b7992aec06c2d4bc29e4e595e5c1cec1215c0cc00488ef649d266279d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7e842f29c490c85109c4bf48ea0397be08815253a47c0898ee00a3869307cb7b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7bef3c3bd1935fe9e0be1dc835acc7cb5e027d16351bc9c3583d3782d1bc25a4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "55d1e60e7e11924da2896e53051bd8966205a208a9a0aa06a4b6157b09bd0cce",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "5f6499cf069d0a1ecc7fc190d51628328363609ed758f836995b698ef36cf1e0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a6a7ccde005eab6c4465302fee48ff722573af7c0474fa964f1643b2d658630a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a79c88d9b18c019b0803c1ffdc79100737da8d8c49cebcbd9f84b6878e5c9e84",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d4990c542c0d2e55656a08ae4946f9b533444142bf2a5557d3a7e738af284d9f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "cab09855dabf71ef8dbff402f2f8cdda3b994288457691b7f5d441e9254dcc00",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "domain": [
+ {
+ "data": "kqzyfj.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "jdoqocy.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "path.revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "verisign.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "youtube.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "info.revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "Flexera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "pagead2.googlesyndication.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "twitter.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "enduser.id",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "linkedin.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "obesearmadillo.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "use.typekit.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "schema.org",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "revenera.de",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "store.revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "googletagmanager.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "js-agent.newrelic.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "instagram.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "awltovhc.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "bam.nr-data.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "flexera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ogp.me",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "drupal.org",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "lduhtrp.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "installshield.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e.params.cat",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "community.flexera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "w3.org",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "NREUM.info",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "ip": [
+ {
+ "data": "75.2.65.169",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "74.208.236.156",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha512": [
+ {
+ "data": "9cec6a5ff2ab3b1a9dd27771a78a9d8b3c13f844fd06439e4b4d9b691ed066ca3d8735246f79e7fe03f5c05c9c9c0f2bfd89542f2aa9776f1df2269bfe4e434c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "76dc5c48066fe39ec5cdf9e23425b154cf62955222eaf20a8750feaa8c9fdf35fc83faa459d0de849daa87979f25659bfd95dee97ea171dab8aa64629175edfd",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "1f6b383d6dd4cc71d3bbb52cb4fc96c5ed5fb44b99555910630a46c4c58bc2891c2588c8c7258972f81f34e529abf2f6c69c5912d049aad4914af7744bbc9888",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "dad76250e7a02abed37ed0b590b559136a051212aa1db20e4a7558ae4e6587ef1f9fbea5903c451a86140c479b4f810ed6eefdcff9dba7781cd16a3b6ea85488",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "52f992cea604ac404a6bb4b668ca62b9006735ff27708c7bf2c7b09fd86b3514865d5de59ebaac9dfcd2ef198ee386411b5d5cd9f03181f3f325bf447b979147",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ddb3fb48cea4d7609c057c2e47a55980c0853b93c290a5394618af144b0c2003b85dc57ce2dcdbe63f1d4284bc10ce3f61a298ad83c65e889ddb3dd9efbb7407",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0f9f15eea818569916e99dd9cd55898d61e8f0dafd660ea21fa8f89a1613527cb2d025049d50975beba6087a13ee304a23998dd9c9812c29ce688174a4052121",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e5500a05c35364e5d5e803818fc9050164efc669d3bcd33f22eaf556fb84c733daab4c8a1b9f07663af8fc77e3afb711c43c87a8083a20d1bd0e57ed55b4d61a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "21785416613242c5054499b5283127186553a2b78e140351fed5a4d7c582338848cc1cda257a859de36e18f2a38c31409cf11962afaf7e2543b1d06b454f65a4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "1553bd60eb32ca18d4e33c945f41b323e7eb410d7ab18d620ef081291afe123172a496afe4f8e225b2e67d6006f49949f601b49697e5ad9dd75487ef169b883b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0802769db00f1b9f83d42e6133b74d02455b1994f0b0866b2133b21498e35a90d3c38ff822f891597102dbabad488431d7b348ea4e57921729f341fc5a54aaf2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "00a99b5f6419692dbbf238b2f3b138fdd831bf854f3a26bf9f50d3ae10fc0548bf381cd8255a0026c9b69d9118891d81abf8309435392b93f14fb8d73d2685a3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d628d2343d2c5e000e3681c0ecc136d71be38e966fb2973acafb5a5197f036f5b8162690235226c0ba8c3fcadd5afa63da99a9bb49c5faab4600b25b9c2ad5b6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d40b87a1aa5d176e00d756ec29466707a344e49ed8f3d3bc01e74edfef42627b7c2699f6b2e053d163d7e3859a4be58591129287e494dcfeb6f13e637bee2254",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "396933c261c1a1bebc662b93e4af016e97df52f63421a065809ff42d40b5412dfa99cf46e043797ac3cd4e96ea7a387ad6ee2b7c92f7345f7c88e89a1e42fc25",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "1639fc29db22cba1324e7ea533ae9e827a1e21e224ba89c85abd14b8b139832c4b3ac37cbcbbe6060192c7634143702259e43b483579b2b6848415ffa06f2798",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e6738e71d15df0ee34370dfd1094ff460472b09d7e7178dd56509924740aa1e21913224e26b3cacb43fde202538b9fe84701c4f20a3ac489a8f15abdb8f604d1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8504f15138010c915159172a0561b2744c25d30e5fb50cb04e8250d48e16cb8e94ec934c831ae392c9ea3fe378047d3281198f22786d35e671871cdda8b18494",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c9142cdfb7ea01ab6c59ffcb7db24779f8a89ec5a703fc5025e3e805d5d2d5fe7a22af592ca71194a1d81577b86e224fd2b8f16efbe7e4e0229f2e80e7a4b383",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ef1d03764f62f64021d1dfabc9ab3ddec22572f28c72fb437d89b74c0eb3790a772f301fa869a0b792426485a51e90d000cca3186e41f8f0c70ce094c0a7b616",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "defc495a1f45d748e4f0ddfe6f3c7573aec8dda71bb1b4c93cadf2eeb60b49bf5e1f3b763ca03abcecdb0738a53723fac7691740f2d8236bc2e3ddc91ecad3a1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "12a4739217a3691d42dedde4a8608f95fd238e68db883d4c7a960a3e62efa00ff6cc6c91dbab77c3c468d4fe1cb296b72f7c501822ea69d75ed535bac05dfc1a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "07dc048d64a030a72169db8b504e187a1c250b2a20d10b101f26c0976a0c4e9c7cece413a463133dff66d2ac6183b72ea0e4f0ba213f8b8c1fa44316aa87453a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c2d32f5048b1e84e85f4a07a26301a1c6f60fa4f486e5c8703703cff8cb485d75df937fbecfd552b35e2de7d7594b2850a039fe20ed181403b04ac26d499746c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7d28ebd45019c9ef2cb140a14a810de5bebc0bb817ef1da713ce081669130cc27a51e99c653d958cba64ef47f6647c1658b939ac1f2606e292ae409342af7809",
+ "origins": [
+ {
+ "type": "PE_UNPACKING",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "c50bf28135f4e5a0d07ef5cf584e9d717d4d817c12acf5a2e04afc0d406f3edc443e0e603e3eb936bf7f364570b615ef154942ced8f8f504d786f43bc42833ae",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "email": [
+ {
+ "data": "CPS-requests@verisign.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "url": [
+ {
+ "data": "https://www.youtube.com/embed/046Qm_fEe2Y",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://schema.org/BreadcrumbList",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwhite-paper-industry-report%5D=white-paper-industry-report&category%5Binstallation%5D=installation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwebinar-event%5D=webinar-event&category%5Bsoftware%20composition%20analysis%5D=software%20composition%20analysis",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/2021-11/5-3fifty-fifty-hi-res_0010_istock-626999150-hires.jpeg",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/services-and-training/installation-design-and-development",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://pagead2.googlesyndication.com/pagead/show_ads.js",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwebinar-event%5D=webinar-event&category%5Binstallation%5D=installation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://use.typekit.net/fqx4jiy.css",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.installshield.com/pftw",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/industries/networking",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bdemo-trial%5D=demo-trial",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bcase-study%5D=case-study&category%5Bsoftware%20monetization%5D=software%20monetization",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.verisign.com/repository/verisignlogo.gif0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/IS-EVNT-Unpacking-MSIX-2022",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.obesearmadillo.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.drupal.org",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/services-and-training/installation-training",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/diversity",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/business-solutions/open-source-vulnerability-management",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/IS-WBNR-TechTalk-Suite-Secrets?lead_source=Website%20Visitor&id=Revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.verisign.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training/implementation-services",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.googletagmanager.com/ns.html?id=GTM-P9Z3WSV",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/usage-intelligence",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwebinar-event%5D=webinar-event&category%5Bsoftware%20monetization%5D=software%20monetization",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/press-center",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/monetizing-saas-applications",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bcase-study%5D=case-study",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.obesearmadillo.com/music.html",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/datasheet-is.pdf",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/is-eval-installshield-premier?lead_source=Website%20Visitor&id=Revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwebinar-event%5D=webinar-event",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?category%5Binstallation%5D=installation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://path.revenera.com/c/everything-your-busi?x=Vuj5OO&PFOVERLAY=TRUE",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.obesearmadillo.com/email.html",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/contact-us",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://store.revenera.com/shop/s/category/installshield/0ZG1M000000GmaTWAS",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield/installshield-requirements",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installanywhere",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield",
+ "origins": [
+ {
+ "type": "DOWNLOADED_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "https://info.revenera.com/IS-WBNR-Developer-MSIX-eBook?lead_source=Website%20Visitor",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training/training",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/iot-manage-and-protect-devices",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/software-licensing",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/industries/software-saas",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/products/sbom-insights",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/flexible-monetization-models",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/audits-and-services/open-source-audits",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/services-and-training/installshield-microconsulting",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://verisign.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://path.revenera.com/getting-started-software-monetization?PFOVERLAY=TRUE",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/monetize-iot",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.w3.org/2000/svg",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.verisign.com/repository/RPA",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.w3.org/1999/xhtml",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?category%5Bsoftware%20monetization%5D=software%20monetization",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/software-delivery-and-updates",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/blog",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.awltovhc.com/image-2250652-54376",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/entitlement-management",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://enduser.id",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/renewals-and-customer-growth",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/2021-11/5-3fifty-fifty-hi-res_0013_istock-623192890-hires_0.jpg",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.obesearmadillo.com/recording.html",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/industries/manufacturing-and-industrial-automation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training/revenue-recovery-services",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.flexera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://bam.nr-data.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.lduhtrp.net/image-2250652-10441635",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bvideo%5D=video&category%5Bsoftware%20composition%20analysis%5D=software%20composition%20analysis",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/better-products-with-software-usage-analytics",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/datasheet_IS_CloudLicensServer.pdf",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training/cloud-transformation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?category%5Bsoftware%20composition%20analysis%5D=software%20composition%20analysis",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/industries",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://twitter.com/getrevenera",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/careers",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.kqzyfj.com/click-2250652-54376",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/products/compliance-intelligence",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/IS-EVAL-InstallShield-Professional?lead_source=Website%20Visitor&id=Revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield/installshield-compare-versions",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield/installshield-tips-tricks",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield/cloud-license-server",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/glossary",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/business-solutions/open-source-license-compliance",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/2022-08/917_IS_OpenGraph_BnrFINL1_01.png",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.verisign.com/repository/CPS",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://community.flexera.com/t5/Revenera-Community/ct-p/Revenera_Community",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.jdoqocy.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwhite-paper-industry-report%5D=white-paper-industry-report&category%5Bsoftware%20composition%20analysis%5D=software%20composition%20analysis",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/audits-and-services/m-a-support",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwhite-paper-industry-report%5D=white-paper-industry-report",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bcase-study%5D=case-study&category%5Binstallation%5D=installation",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/contact-us?C_Interest1=sales&C_SolutionInterest=IS",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/partners",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://Flexera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/services-and-training",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.instagram.com/weareflexera",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/industries/medical-devices",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://schema.org/ListItem",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.de/install/products/installshield",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/install/products/installshield/installshield-compare-editions",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/products/flexnet-code-insight",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.linkedin.com/company/revenera",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/is-eval-installshield-professional?lead_source=Website%20Visitor&id=Revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bvideo%5D=video",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/services-and-training/monetization-advisory-services",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/leadership",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.obesearmadillo.com/logic.html",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "080a5e3758a430def394ab12d3489d1044cd67775e92cc0bacc4ab0091eb1bc8"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/business-solutions/bill-of-materials",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-monetization/business-solutions/turn-software-piracy-into-revenue",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://ogp.me/ns",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources/podcasts",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/business-solutions",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/products",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/legal",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/legal/privacy-policy",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://js-agent.newrelic.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/about-us/environmental-social-governance",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://e.params.cat",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bwhite-paper-industry-report%5D=white-paper-industry-report&category%5Bsoftware%20monetization%5D=software%20monetization",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/resources?type%5Bdatasheet%5D=datasheet",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.verisign.com/CPS0b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://community.flexera.com/t5/InstallShield/ct-p/InstallShield",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.youtube.com/GetRevenera",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/sites/default/files/2021-11/10-9fifty-fifty-solutions-hi-res_0004_istock-810529310-hires.jpg",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://info.revenera.com/IS-WP-MSIX-Windows-Installer?lead_source=Website%20Visitor&id=Revenera.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://NREUM.info",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.revenera.com/software-composition-analysis/business-solutions/shift-left-automate-compliance-checks",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "8fd2ea50f96bddc896ef37d1c15a84bf1798e015f9e70c0a11fef0d5f58113e7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "registry_path": [
+ {
+ "data": "Software\\Microsoft\\Windows\\CurrentVersion",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ },
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1d80f93292de4935e866d44b8366ddd98500209338964edadd1164318a6b3f13"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "md5": [
+ {
+ "data": "03b5ede2f69ab4c38248c23343fb0bc4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "51a889d3bec719183631726b8df3d2c7",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d6cbb03947ae3b6caee4f40a31a6efc3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f510cb89c20fee01ba052c6d44e8ead5",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "42cf62b780813706e75fb9f2b2e8c258",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "423993cf66da42d2b756bcc626aac542",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2e7d1006ec3984179e5e99ce2329ab46",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f4d8081a150928db0756e919c4b6a907",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "aab9278fcdfa9354405e0acb1dbaa1a9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a9aec4126aa6b0c5ff85bbf4ffb8b9a9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8dd2374df1b5d36a8b3db3180059ea4f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7fbca12bf4a8557ded3c655c92230883",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d4390738ff142458cea229b978c42b0a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b500c994052c64fe569336cf1efccafe",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "06d8ecb1f74dbc4a646301f72ce5883d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7d12602ac2a4709d6bca0727525e6db4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9b1fd2b7fe08d5e8afaea871011719df",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "878fed088d9a469820e44ff299827376",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "86323b8824ba4a53994dc60d55883c99",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a7a888b36e14f0628a4148a3393a919a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "75516b6fbb5af18f119e1d7f86136e2f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e434a9ad2c00a441d62b114f62b1c19a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "29a1f473b6fc0b877ce30be83212f25a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "03e5557d79d33dd4723e61265a3f8f3d",
+ "origins": [
+ {
+ "type": "PE_UNPACKING",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "dfa2655bab51cec01e102903d2504538",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "366371343360dec3c4268042a88b8714",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7"
+ }
+ ],
+ "isInteresting": false
+ }
+ ]
+ },
+ "file": {
+ "name": "pingometer1_5.bin",
+ "hash": "d70867d9597a6a6014637bca4fcccd93e595fb80d55bbf1ddeb82a5b5e97c3f7",
+ "type": "pe"
+ },
+ "filesDownloadFinished": true,
+ "additionalStepsRunning": [],
+ "additionalStepsDone": true,
+ "created_date": "09/28/2023, 01:22:09",
+ "defaultOptionsUsed": false,
+ "scanOptions": {
+ "rapid_mode": null,
+ "osint": true,
+ "extended_osint": true,
+ "extracted_files_osint": true,
+ "visualization": true,
+ "files_download": true,
+ "resolve_domains": true,
+ "input_file_yara": true,
+ "extracted_files_yara": true,
+ "whois": true,
+ "ips_meta": true,
+ "images_ocr": true
+ }
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/opswat_submissions_result_likely_malicious.json b/tests/resources/opswat_submissions_result_likely_malicious.json
new file mode 100644
index 0000000..8dd72df
--- /dev/null
+++ b/tests/resources/opswat_submissions_result_likely_malicious.json
@@ -0,0 +1,2378 @@
+{
+ "flowId": "65315c2cafc17c7912f9006e",
+ "allFinished": true,
+ "allFilesDownloadFinished": true,
+ "allAdditionalStepsDone": true,
+ "reportsAmount": 1,
+ "priority": "least",
+ "pollPause": 12,
+ "fileSize": 12070912,
+ "fileReadProgressBytes": 12070912,
+ "reports": {
+ "421652fc-a024-4dbb-b852-3b84407937ba": {
+ "finalVerdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": true,
+ "tag": {
+ "name": "peexe",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": true,
+ "tag": {
+ "name": "html",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "fingerprint",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "overallState": "success",
+ "taskReference": {
+ "name": "transform-file",
+ "additionalInfo": {
+ "submitName": "systeminformer-3.0.5553-setup.exe",
+ "submitTime": 1697733679187,
+ "digests": {
+ "SHA-256": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ },
+ "ID": "a25e8011-ab7c-4d93-94fa-b6ebfeb272e6",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "TRANSFORM_FILE",
+ "name": "file",
+ "ID": "beb23f7c-c655-4290-b4aa-da6c1914dbfc"
+ },
+ "opcount": 1,
+ "processTime": 66898
+ },
+ "subtaskReferences": [
+ {
+ "name": "visualization",
+ "additionalInfo": "28d7efdf-08d7-448f-9d17-ba83d0bfd071",
+ "ID": "97606424-8f9e-4f04-8f58-34533461cf12",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "VISUALIZATION",
+ "name": "visualization",
+ "ID": "28d7efdf-08d7-448f-9d17-ba83d0bfd071"
+ },
+ "opcount": 1,
+ "processTime": 294
+ },
+ {
+ "name": "osint",
+ "additionalInfo": "beb23f7c-c655-4290-b4aa-da6c1914dbfc",
+ "ID": "64e04459-6cf6-4d32-95ee-892489e6531c",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "eb7c53ed-bfa0-48e3-97e7-ca46687a6b48"
+ },
+ "opcount": 4,
+ "processTime": 1007
+ },
+ {
+ "name": "domain-resolve",
+ "additionalInfo": 1,
+ "ID": "9d2eaf8d-e165-4c83-95c4-304e3b4f2638",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "DOMAIN_RESOLVE",
+ "name": "domain-resolve",
+ "ID": "41d8fb26-f631-47a9-a982-2caa2791cdb0"
+ },
+ "opcount": 1,
+ "processTime": 426
+ },
+ {
+ "name": "file-download",
+ "additionalInfo": 1,
+ "ID": "9c14324d-084d-46da-aaa6-0a435e6b66aa",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "FILE_DOWNLOAD",
+ "name": "file-download",
+ "ID": "1dec5858-b897-47f0-b923-e4306ddf2963"
+ },
+ "opcount": 1,
+ "processTime": 1754
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "FILE_HASH_SHA256",
+ "ID": "586f9dd3-63dd-4366-9c58-38cb90050341",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "cc624907-425b-432e-8e3e-4278fe7d9023"
+ },
+ "opcount": 24,
+ "processTime": 3109
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "URL",
+ "ID": "f18d1b50-d1d7-4aae-9ae4-afcc7a4ef8a2",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "1979551d-35ef-4adc-adc1-e92fc446f619"
+ },
+ "opcount": 2,
+ "processTime": 1007
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "DOMAIN",
+ "ID": "25e57d3d-94d0-412c-8a58-e5573f585790",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "aab79d7b-84c2-4cc1-8f3e-9154f2540580"
+ },
+ "opcount": 0,
+ "processTime": 5
+ },
+ {
+ "name": "osint-fuzzyhash",
+ "additionalInfo": "beb23f7c-c655-4290-b4aa-da6c1914dbfc",
+ "ID": "2c2fe0c9-76bf-4f4e-97b9-dfb0aa1817e6",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "a30c02d0-c3f7-42ed-9baf-7ba5eb1f313c"
+ },
+ "opcount": 2,
+ "processTime": 1006
+ }
+ ],
+ "allSignalGroups": [
+ {
+ "identifier": "H060",
+ "description": "PE has icon",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"f76d855baf101f0209ada77d5578f1262d4f66f3ed7d0840ea4424b67c384975\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"121e1ff6d1b35eaa61e6d0f749987bf5ad132f766cb3a854f7e67acba6c43905\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"6ded0c0f1078b5df222013d6338949f386a1cd74f765e9f89f936cd009368654\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"730b2f7d80a32012e260dde85efe6ba1fc69e76924e6f1f4dc07ac12af2eeed5\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"06e3f70e22e78a3d3455b69dff64a940e72c30f71b1d61dc8e3f1311c1bd8b55\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"7cafb9063223ed7d1ebbc3f2e42a81f4af5d6c7269d64920d353b4e29068ab5f\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"b179c7f33e2f9bdc69c79cb290c721b8130ebb9e64513785a3e226dd3e0e65ee\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"32f916805dfff7388c3643d49af8ec8b56f06a38e1c28660877a5d25747dccb1\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"d2950f6e1affbc5d2856b68ea54a36165271766c12b37d53d6c94da79fc386d4\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "R007",
+ "description": "Found a registry reference often used for system fingerprinting",
+ "allMitreTechniques": [
+ {
+ "ID": "T1012",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "Query Registry"
+ },
+ {
+ "ID": "T1082",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "System Information Discovery"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "fingerprint",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found registry artifact \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SystemInformer\"",
+ "originPath": "file.extractedRegistryPathways.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "fingerprint",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H041",
+ "description": "PE imports APIs often used by malware",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetFileType@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "greyware",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H030",
+ "description": "PE imports APIs used to manipulate/query other processes",
+ "allMitreTechniques": [
+ {
+ "ID": "T1518",
+ "name": "Software Discovery"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtOpenProcess@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtOpenProcessToken@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H062",
+ "description": "PE takes commandline arguments",
+ "allMitreTechniques": [
+ {
+ "ID": "T1059",
+ "relatedTactic": {
+ "ID": "TA0002",
+ "name": "Execution"
+ },
+ "name": "Command and Scripting Interpreter"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetCommandLineW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetCommandLineA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "R016",
+ "description": "Found a system services related registry reference",
+ "allMitreTechniques": [
+ {
+ "ID": "T1007",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "System Service Discovery"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found registry artifact \"System\\CurrentControlSet\\Services\\\"",
+ "originPath": "file.extractedRegistryPathways.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "S028",
+ "description": "Found a suspicious native API string artifact",
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntwritefile\" in string \"NtWriteFile\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntreadfile\" in string \"NtReadFile\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntqueryinformationprocess\" in string \"NtQueryInformationProcess\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntdelayexecution\" in string \"NtDelayExecution\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntopenprocess\" in string \"NtOpenProcessToken\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntquerysysteminformation\" in string \"NtQuerySystemInformation\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntquerysysteminformation\" in string \"NtQuerySystemInformationEx\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntopenprocess\" in string \"NtOpenProcess\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntsetinformationfile\" in string \"NtSetInformationFile\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntsetinformationthread\" in string \"NtSetInformationThread\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"rtlcreateuserthread\" in string \"RtlCreateUserThread\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found artifact \"ntcreatefile\" in string \"NtCreateFile\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H032",
+ "description": "PE imports APIs used to access or modify the registry",
+ "allMitreTechniques": [
+ {
+ "ID": "T1012",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "Query Registry"
+ }
+ ],
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtCreateKey@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtCreateKeyedEvent@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtOpenKey@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtDeleteKey@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H011",
+ "description": "PE imports APIs used for anti-debugging purposes",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtQuerySystemInformationEx@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtQuerySystemInformation@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NtQueryInformationProcess@ntdll.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H044",
+ "description": "PE resources amount to more than 75% of the total file size",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "PE resources amount to 96.26% of the total file size",
+ "originPath": "file.extendedData.stats.totalResourceAmountFromFileRatio",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H016",
+ "description": "PE imports APIs used to hide other imports",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryExW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryExA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetProcAddress@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H005",
+ "description": "PE header timestamp is implausible",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "PE header timestamp (2100-06-16T11:03:12Z) is in the future",
+ "originPath": "file.extendedData.dates.dateUnix",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H038",
+ "description": "PE has an uncommon section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section \".didat\" is unusual",
+ "originPath": "file.extendedData.sections.sectionName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "H004",
+ "description": "PE imports suspicious APIs",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlCreateUserThread@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtCreateKey@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtCreateFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQueryDirectoryFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtSetValueKey@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtSetEvent@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtSetInformationThread@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtSetInformationFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtOpenProcess@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQuerySymbolicLinkObject@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQuerySystemInformation@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQueryVirtualMemory@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtOpenSymbolicLinkObject@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtOpenProcessToken@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LdrAccessResource@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlCreateSecurityDescriptor@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlCreateAcl@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlAddAccessAllowedAce@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtDelayExecution@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LdrFindResource_U@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQueryInformationProcess@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlRandomEx@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RtlSetDaclSecurityDescriptor@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtQueryInformationFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtDeleteKey@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtTerminateProcess@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtReadFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NtWriteFile@ntdll.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetProcessHeap@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetEnvironmentVariable@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetEnvironmentStrings@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"FindNextFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetNativeSystemInfo@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"MoveFileEx@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"FindFirstFileEx@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetTimeZoneInformation@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"EnumSystemLocales@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetUserDefaultLCID@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetModuleHandleEx@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WriteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetFileType@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentThreadId@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentProcessId@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"TerminateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetUnhandledExceptionFilter@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"VirtualProtect@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RaiseException@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "Y001",
+ "description": "Detected cryptographic algorithms",
+ "allMitreTechniques": [
+ {
+ "ID": "T1573",
+ "name": "Encrypted Channel"
+ }
+ ],
+ "averageSignalStrength": 0,
+ "peakSignalStrength": 0,
+ "finalSignalStrength": 0,
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Detected constants related to \"MD5\"",
+ "additionalInfo": "MD5",
+ "originPath": "file.yaraMatches",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Detected constants related to \"SHA256\"",
+ "additionalInfo": "SHA256",
+ "originPath": "file.yaraMatches",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "R000",
+ "description": "Found an autostart registry reference",
+ "allMitreTechniques": [
+ {
+ "ID": "T1547.001",
+ "name": "Registry Run Keys / Startup Folder"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found registry artifact \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskmgr.exe\"",
+ "originPath": "file.extractedRegistryPathways.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found registry artifact \"System\\CurrentControlSet\\Control\\NetworkProvider\\Order\"",
+ "originPath": "file.extractedRegistryPathways.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found registry artifact \"System\\CurrentControlSet\\Services\\\"",
+ "originPath": "file.extractedRegistryPathways.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "Y000",
+ "description": "Matched a suspicious YARA rule",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Matched YARA rule \"BitcoinAddress\" with strength \"0.25\" (Contains a valid Bitcoin address)",
+ "additionalInfo": "BitcoinAddress",
+ "originPath": "file.extractedFiles.yaraMatches",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ]
+ },
+ {
+ "identifier": "S051",
+ "description": "Found a living off the land (LotL) string artifact",
+ "allMitreTechniques": [
+ {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"shell32.dll\" (Execute)",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ }
+ ]
+ },
+ {
+ "identifier": "S007",
+ "description": "Found a Windows desktop utility string artifact",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"control\"",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ]
+ },
+ {
+ "identifier": "D001",
+ "description": "Found a domain referencing a social media service",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"reddit.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"twitter.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ]
+ },
+ {
+ "identifier": "D000",
+ "description": "Found a domain referencing an instant messenger service",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"discord.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ]
+ }
+ ],
+ "resources": {
+ "cc624907-425b-432e-8e3e-4278fe7d9023": {
+ "results": [],
+ "relatedTaskType": "OSINT_EXTENDED",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ },
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "cc624907-425b-432e-8e3e-4278fe7d9023"
+ },
+ "mediaType": {
+ "string": "application/octet-stream",
+ "slash": 11,
+ "semicolon": 24,
+ "parameters": {}
+ },
+ "signalGroupsByID": {},
+ "signalGroups": [],
+ "allTags": [],
+ "originVerdicts": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "notifications": []
+ }
+ },
+ "iocs": {
+ "sha1": [
+ {
+ "data": "2140f095997ecb5e2fa04eac2a03798aa91ca77c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "037cbe3ee4c5031c7bbaf636c06fcd0ceca3163f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0fd905120f9f0d4a3bf25a5d38c5c5c1b002b575",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "70a4185df036794ccdf08dc4954a5377d69dfbc1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ca03c2465e151ef087c5283451d8226c51b4e73e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7a23b580b683db93f72057624e37aecebbad4d7b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "eff53825b4fc73371fc4ed72d3fd989792a9d999",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8640fe52c6865c26d3b693a37cc6a69a027a8b31",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "687c72f045dd1d36923aad3b2c8368cd7f5af146",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8ca7a8fcabb0f89b86c2c4d598ba9e7fbae9dd39",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3c5dc98ae914ba035a0b450b03f7c08722330047",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "4b94dadea78c0c2fb93181742ee3b6701cd068c8",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha256": [
+ {
+ "data": "996fc6d8dced765db9c3b8667c6a0026f4f4e9927c655808509999bc9f6db8e9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "6ded0c0f1078b5df222013d6338949f386a1cd74f765e9f89f936cd009368654",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f76d855baf101f0209ada77d5578f1262d4f66f3ed7d0840ea4424b67c384975",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "730b2f7d80a32012e260dde85efe6ba1fc69e76924e6f1f4dc07ac12af2eeed5",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a56af09b5340fb9a631e34f40f3e67878fb2c843c65e0f928c149c51c5ad139d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "32f916805dfff7388c3643d49af8ec8b56f06a38e1c28660877a5d25747dccb1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b179c7f33e2f9bdc69c79cb290c721b8130ebb9e64513785a3e226dd3e0e65ee",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7cafb9063223ed7d1ebbc3f2e42a81f4af5d6c7269d64920d353b4e29068ab5f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d2950f6e1affbc5d2856b68ea54a36165271766c12b37d53d6c94da79fc386d4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9aec4d0f387168db648f16ee0e8e6e65d75703ecde1cd6f75ab32b92ce3f3b55",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "06e3f70e22e78a3d3455b69dff64a940e72c30f71b1d61dc8e3f1311c1bd8b55",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "121e1ff6d1b35eaa61e6d0f749987bf5ad132f766cb3a854f7e67acba6c43905",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "ip": [
+ {
+ "data": "172.64.148.49",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "domain": [
+ {
+ "data": "systeminformer.sourceforge.io",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "github.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "windows-internals.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "twitter.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "discord.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "reddit.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "googletagmanager.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "cdnjs.cloudflare.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "sourceforge.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha512": [
+ {
+ "data": "79c46463b4e3a867bf227c02e31bb65a9a7b92660027398b310d19e87cc5309f4841f906ca92d4854bbe00f8b9b3ec8fa547fe6465dcefbd7aa50f70ec95a6ed",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2f09f1074cf73da51ffcbb67ad0f06374c5c07cd3edad45257403b0361470b31f0ab34b8bf0559a717461ea42a857d82b434988a35d57c45d9799f5178666af8",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "bde04cba879d41636177bc740e338f3e13094f2a1f9ee15a88e95492161436e258465956624253b796cd4411bbdd861a144388c97d893fa169822058b0b1ad52",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b913afd6e140dbd6b5a4c02250f23c046a7c0ae59bd31d08655982bdfe91d7cb5007923d3189cc03bd2390f69b0578500b170a0b35361e8dd7c3a3426fd09731",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7869401945de9204de6534a501847b88855a2d2d520ecd1639c6d7ba40129f10ea69cad9a4d41b114838499035aa7b64c4d7b288e2c66da2a65f0a4a3903ca2c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e0476a561576a9444b06a13337f345ef816f44acdd7c440adb8854f4ba8697f169e34f42ba050d089a1ffab939f09345ac0dbcdba9bd24070c0fa929d37f5b9c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8da9d234d9e776ea3499be7be733cb7601c061e8a796d649ba28665c549a73fa3baf41354052704f9327e0236d616fcbd489cd58e011d1a1ab5723d915a4578b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9e39dfcec4e0a5e458167588837bfa356d9bf879864feef90640114ed6b4d13ae7c3619e7f66599bec192152a0e6fc7f81931ad6883bc07dea346c7385d45135",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ba1512d2701d6a4c74fe5da651f7aa25f47864055c532f662737628f01593e5aa720a73a0501ae75455933dff48540b10115433a89f33d45870421f3b36609b9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f92f3918f23f31ec9e1bf459bfe7b952f01c1e918db02440d90ea51e1777709af438d008a524e09e7ae99225234c175b98872b70c699cbfc6c13cc5900251633",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a676c87bcab9ceb501090a4b45b50be9692c66aac559a33aaf4b4a04d346a9245f8cd76c4a0fe2f7b32787a1d3eab2b3ebdd3b15757a7c7f7d1084a2878df3a4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b9b204c184aa0e3f2d2ef76e496a1fb87693b9101354c540d0c53faa0e34e5eb1fade0ace31c0cd509d9fdf0d95e10070715410863e375c7008f17517cd70c34",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "url": [
+ {
+ "data": "https://twitter.com/SystemInformer",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.reddit.com/r/SystemInformer",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://windows-internals.com",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://sourceforge.net",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://discord.com/invite/k2MQd2DzC2",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://sourceforge.net/projects/systeminformer",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://github.com/winsiderss/systeminformer/issues/new",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://systeminformer.sourceforge.io/",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://www.googletagmanager.com/gtag/js?id=G-K180CJH0WK",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://sourceforge.net/sflogo.php?type=17&group_id=3524562",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://github.com/winsiderss/systeminformer",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "07f9bb751d6f0044e7b8d244d1f4ca3853b851a27ae76de4bfbb05518722de95"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "registry_path": [
+ {
+ "data": "System\\CurrentControlSet\\Control\\NetworkProvider\\Order",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\taskmgr.exe",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "System\\CurrentControlSet\\Services\\",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": true
+ },
+ {
+ "data": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SystemInformer",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": true
+ }
+ ],
+ "md5": [
+ {
+ "data": "386460497d26e02cff34cb07ec23fce9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "74f09ee788a104a25844d80efb8731f3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "fff6f4aad64c0db2db24ec3d82061e33",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c261a766c438189a9eb27647b3e03a17",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "582bba0fca976d644b77906186438624",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "afc224eac3afeb1ff06dbaf38ce5a98e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e1d9b2657d73c9615f768bd31ef34029",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ff538281ae9b1e9a0b27eeba23ee1a31",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "bae548ab480fa0fe4b77999a13affb67",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "26894c87fe4b48d66eedb1142aaec2d6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "6db71fd254da17eba1a8800b06d97dec",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "047592239e8fc159740cf91535c04828",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572"
+ }
+ ],
+ "isInteresting": false
+ }
+ ]
+ },
+ "file": {
+ "name": "systeminformer-3.0.5553-setup.exe",
+ "hash": "7b8117a93e65e797483799caa742829dc6d816c7118b363ab4fdb4b575351572",
+ "type": "pe"
+ },
+ "filesDownloadFinished": true,
+ "additionalStepsRunning": [],
+ "additionalStepsDone": true,
+ "created_date": "10/19/2023, 16:41:18",
+ "defaultOptionsUsed": true,
+ "scanOptions": {
+ "rapid_mode": false,
+ "osint": true,
+ "extended_osint": true,
+ "extracted_files_osint": true,
+ "visualization": true,
+ "files_download": true,
+ "resolve_domains": true,
+ "input_file_yara": true,
+ "extracted_files_yara": true,
+ "whois": true,
+ "ips_meta": true,
+ "images_ocr": true
+ },
+ "estimatedTime": "9",
+ "estimated_progress": 1.0
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/opswat_submissions_result_malicious.json b/tests/resources/opswat_submissions_result_malicious.json
new file mode 100644
index 0000000..5d776d6
--- /dev/null
+++ b/tests/resources/opswat_submissions_result_malicious.json
@@ -0,0 +1,1421 @@
+{
+ "flowId": "6531567f966b1cca70e9fce5",
+ "allFinished": true,
+ "allFilesDownloadFinished": false,
+ "allAdditionalStepsDone": false,
+ "reportsAmount": 1,
+ "priority": "max",
+ "pollPause": 5,
+ "fileSize": 13370880,
+ "fileReadProgressBytes": 13370880,
+ "reports": {
+ "f7977db1-6a99-46c3-8567-de1c88c93aa4": {
+ "finalVerdict": {
+ "verdict": "MALICIOUS",
+ "threatLevel": 1,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": true,
+ "tag": {
+ "name": "peexe",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": true,
+ "tag": {
+ "name": "html",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "OSINT_LOOKUP",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "tag": {
+ "name": "emotet",
+ "synonyms": [
+ "geodo"
+ ],
+ "descriptions": [
+ {
+ "description": "While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.\r\nIt is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.\r\nEmotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.",
+ "cluster": {
+ "type": "malpedia",
+ "authors": [
+ "Davide Arcuri",
+ "Alexandre Dulaunoy",
+ "Steffen Enders",
+ "Andrea Garavaglia",
+ "Andras Iklody",
+ "Daniel Plohmann",
+ "Christophe Vandeplas"
+ ]
+ }
+ }
+ ],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "YARA_RULE",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "pup",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "overallState": "success",
+ "taskReference": {
+ "name": "transform-file",
+ "additionalInfo": {
+ "submitName": "bad_file.exe",
+ "submitTime": 1697732225977,
+ "digests": {
+ "SHA-256": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ },
+ "ID": "71bc4e97-1768-4fff-bb0b-01e74a753d06",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "TRANSFORM_FILE",
+ "name": "file",
+ "ID": "fea87ff0-c606-42eb-9429-4704574ed797"
+ },
+ "opcount": 1,
+ "processTime": 11035
+ },
+ "subtaskReferences": [
+ {
+ "name": "visualization",
+ "additionalInfo": "64b0c8a4-6058-4ba9-9d8b-876e0f7ac9fa",
+ "ID": "07783248-137d-4cb6-a079-b0a6e7006845",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "VISUALIZATION",
+ "name": "visualization",
+ "ID": "64b0c8a4-6058-4ba9-9d8b-876e0f7ac9fa"
+ },
+ "opcount": 1,
+ "processTime": 305
+ },
+ {
+ "name": "osint",
+ "additionalInfo": "fea87ff0-c606-42eb-9429-4704574ed797",
+ "ID": "c2aaf769-9b14-48d4-8516-b67b5bff26f8",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "e85b9142-5983-4a8a-82c0-125a87d6b436"
+ },
+ "opcount": 4,
+ "processTime": 1015
+ },
+ {
+ "name": "domain-resolve",
+ "additionalInfo": 1,
+ "ID": "128e1b65-9909-40f0-8a0c-41f8c42ca11b",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "DOMAIN_RESOLVE",
+ "name": "domain-resolve",
+ "ID": "e9e8e019-4717-466b-afd2-e49ed363a684"
+ },
+ "opcount": 1,
+ "processTime": 752
+ },
+ {
+ "name": "file-download",
+ "additionalInfo": 2,
+ "ID": "4ae14441-4b4a-4666-864f-29ee07cc29e5",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "FILE_DOWNLOAD",
+ "name": "file-download",
+ "ID": "259f6636-7e10-4cb3-9f89-592369c01788"
+ },
+ "opcount": 2,
+ "processTime": 5655
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "FILE_HASH_SHA256",
+ "ID": "be4c98f2-3bd3-401f-8a04-9c44d039f021",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "d4cd5114-f261-48c1-95e7-b50b679576e1"
+ },
+ "opcount": 12,
+ "processTime": 2019
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "URL",
+ "ID": "6a64c06f-17ea-4ddf-8147-581d328a5556",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "216aabd6-003b-42bb-b852-79a8551c93f2"
+ },
+ "opcount": 4,
+ "processTime": 1011
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "DOMAIN",
+ "ID": "f73a6e81-4b86-4723-af13-60c8d9300186",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "941717de-22de-464d-90b8-3de583a03aeb"
+ },
+ "opcount": 0,
+ "processTime": 7
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "EMAIL",
+ "ID": "93b0c704-2acc-43bd-b5dd-475828872e3d",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "c95ff990-3b3f-4249-8a83-f55407840fd5"
+ },
+ "opcount": 2,
+ "processTime": 1007
+ },
+ {
+ "name": "osint-fuzzyhash",
+ "additionalInfo": "fea87ff0-c606-42eb-9429-4704574ed797",
+ "ID": "1638f9ab-53ee-4d2d-a755-3dbf288b3317",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "4440be5b-7e89-4f25-a798-2d07e0f387df"
+ },
+ "opcount": 2,
+ "processTime": 1006
+ }
+ ],
+ "allSignalGroups": [
+ {
+ "identifier": "BIN001",
+ "description": "The executable is using a known installer framework",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The analysis found the signature of a known installer framework (\"Installer: Tarma InstallMate(9.0)[-]\")",
+ "originPath": "file.dieInfo",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H060",
+ "description": "PE has icon",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"ca8fc96218d0a7e691dd7b95da05a27246439822d09b829af240523b28fd5bb3\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"2bffe07ec828bac7464ce2fe9ac531135758bd2f3a826a4ab3d54514e1a7f37f\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"91df84124d31708df229fad93c421b7fc6f02060f571f028d33d3ed3f6cc0db0\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"d1e1a7d27e0fc5855a5fc12f5a47f67edee075f769133b855d864b153a981e5a\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H062",
+ "description": "PE takes commandline arguments",
+ "allMitreTechniques": [
+ {
+ "ID": "T1059",
+ "relatedTactic": {
+ "ID": "TA0002",
+ "name": "Execution"
+ },
+ "name": "Command and Scripting Interpreter"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetCommandLineW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "I000",
+ "description": "OSINT source detected malicious resource",
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc\" as \"LIKELY_MALICIOUS\"",
+ "additionalInfo": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "originPath": "file.inputSampleOSINT.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H043",
+ "description": "PE has a known suspicious section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".tsustub\" is suspicious (probably \"TSULoader\")",
+ "originPath": "file.extendedData.sections.name",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".tsuarch\" is suspicious (probably \"TSULoader\")",
+ "originPath": "file.extendedData.sections.name",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H001",
+ "description": "PE section size is empty",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".data\" is empty",
+ "originPath": "file.extendedData.sections.sizeOfRawData",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H011",
+ "description": "PE imports APIs used for anti-debugging purposes",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"OutputDebugStringA@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H000",
+ "description": "Executable section has an unusual entropy",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "\".tsustub\" has an unusual entropy \"7.99748325348\"",
+ "originPath": "file.extendedData.sections.entropy",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "\".tsuarch\" has an unusual entropy \"7.9999871254\"",
+ "originPath": "file.extendedData.sections.entropy",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H036",
+ "description": "PE imports APIs used to create temporary files",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"CreateFileW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetTempPathW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H016",
+ "description": "PE imports APIs used to hide other imports",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetProcAddress@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryW@KERNEL32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H038",
+ "description": "PE has an uncommon section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section \".tsustub\" is unusual",
+ "originPath": "file.extendedData.sections.sectionName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section \".tsuarch\" is unusual",
+ "originPath": "file.extendedData.sections.sectionName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "H004",
+ "description": "PE imports suspicious APIs",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"OutputDebugString@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"UnmapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"MapViewOfFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetFileSize@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"DeleteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetFileAttributes@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentThreadId@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentProcessId@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetProcessHeap@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WriteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetFileTime@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "Y002",
+ "description": "Matched a malicious YARA rule",
+ "averageSignalStrength": 1,
+ "peakSignalStrength": 1,
+ "finalSignalStrength": 1,
+ "verdict": {
+ "verdict": "MALICIOUS",
+ "threatLevel": 1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Matched YARA rule \"PUP_InstallRex_AntiFWb\" with strength \"0.75\" (Malware InstallRex / AntiFW)",
+ "additionalInfo": "PUP_InstallRex_AntiFWb",
+ "originPath": "file.yaraMatches",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "SIGG016",
+ "description": "Executable is a digitally not signed installer",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "signalReadable": "Found an installer which is not digitally signed",
+ "additionalInfo": "",
+ "originPath": "signalSummary.allTags",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "dataUUID": "fea87ff0-c606-42eb-9429-4704574ed797"
+ }
+ ]
+ },
+ {
+ "identifier": "I000",
+ "description": "OSINT source detected malicious resource",
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc\" as \"LIKELY_MALICIOUS\"",
+ "additionalInfo": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ },
+ {
+ "identifier": "S007",
+ "description": "Found a Windows desktop utility string artifact",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found string artifact \"help\"",
+ "originPath": "file.strings.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "d096388a950b7215c86890ac3fbac62ff84db8c628a4fbf47dc03bf9b4d78ff2"
+ }
+ ]
+ },
+ {
+ "identifier": "D001",
+ "description": "Found a domain referencing a social media service",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"facebook.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "d096388a950b7215c86890ac3fbac62ff84db8c628a4fbf47dc03bf9b4d78ff2"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain \"twitter.com\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "d096388a950b7215c86890ac3fbac62ff84db8c628a4fbf47dc03bf9b4d78ff2"
+ }
+ ]
+ },
+ {
+ "identifier": "D006",
+ "description": "Found an unusual long domain part",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "Found domain part \"has-custom-content-position\" in \"has-custom-content-position.is\"",
+ "originPath": "file.extractedDomains.references",
+ "originType": "EXTRACTED_FILE",
+ "originIdentifier": "d096388a950b7215c86890ac3fbac62ff84db8c628a4fbf47dc03bf9b4d78ff2"
+ }
+ ]
+ },
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"ca8fc96218d0a7e691dd7b95da05a27246439822d09b829af240523b28fd5bb3\" as \"INFORMATIONAL\"",
+ "additionalInfo": "ca8fc96218d0a7e691dd7b95da05a27246439822d09b829af240523b28fd5bb3",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"d1e1a7d27e0fc5855a5fc12f5a47f67edee075f769133b855d864b153a981e5a\" as \"INFORMATIONAL\"",
+ "additionalInfo": "d1e1a7d27e0fc5855a5fc12f5a47f67edee075f769133b855d864b153a981e5a",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ]
+ }
+ ],
+ "resources": {
+ "c95ff990-3b3f-4249-8a83-f55407840fd5": {
+ "results": [],
+ "relatedTaskType": "OSINT_EXTENDED",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "c95ff990-3b3f-4249-8a83-f55407840fd5"
+ },
+ "mediaType": {
+ "string": "application/octet-stream",
+ "slash": 11,
+ "semicolon": 24,
+ "parameters": {}
+ },
+ "signalGroupsByID": {},
+ "signalGroups": [],
+ "allTags": [],
+ "originVerdicts": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "notifications": []
+ }
+ },
+ "iocs": {
+ "sha1": [
+ {
+ "data": "1ddcdefd05be844fd865b15b1588fd7fbec9aa74",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b849a2b9901473810b5d74e6703be78c3a7e64e3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3f9366c8f1a24eb83bdf4c0ba4c80a970a2b90bc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f6f373c1c445fadfe8958d565cfa9ec9b24140ab",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e1cb5ee6aa2351da09955cfdd0f756b14fb0eb1a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "5cf9385fa3a8947ea28567893aed9557fdb874dc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha256": [
+ {
+ "data": "2bffe07ec828bac7464ce2fe9ac531135758bd2f3a826a4ab3d54514e1a7f37f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "91df84124d31708df229fad93c421b7fc6f02060f571f028d33d3ed3f6cc0db0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ca8fc96218d0a7e691dd7b95da05a27246439822d09b829af240523b28fd5bb3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d1e1a7d27e0fc5855a5fc12f5a47f67edee075f769133b855d864b153a981e5a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "efb1f8561b8b28326bbec0c12f7e4d0c47d56e155d5a7d3f4e8282280a24a9be",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "38cd7b61b24fa1124f13365d74e45f05ac8f1cf99119a3efaaf861e8d935e695",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "ip": [
+ {
+ "data": "209.182.199.110",
+ "origins": [
+ {
+ "type": "EXTERNAL_PARSER",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "domain": [
+ {
+ "data": "FedRetireSoftware.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "type": "EXTERNAL_PARSER",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha512": [
+ {
+ "data": "a6e0eca813f5ad7fabfac8f85de76023ce337bdd5e502090a3a495d4af78644b944afccb74e70fc5142ad7b5406aa05170dc4fcce72a724227aaf3c0ecf55e93",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a07da0e625df1a8af7bbab1c2961a135aecfc0d6629c83f7766151fa72a26dfcc4a652eada53b0c7e66c4e78cb83cf1481477636d47e6a51e49895493f84193f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "cd6bb61df6bee35b264235c5bafb5200ef6fa52a0624667b883226133bae16238c1109e668cb6350ba22df6123207c34efbb68ea0a44859022bc836dad630ac5",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8ce46109dd556b464a8a699aa71351e0dfb3b1d13572636d87686e27a006b808016e2dbf095dd7a48489a03994909ed889cd1a583c3a68de799c41b3e303e805",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "60bc847291ac08d46a16473387c2fd29694fbf5ef04e5072a2398ae8240677c9d251b46f6b3ed33b97ab3dec67969dfeab860a51f21d7914801f35c10634aa1e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "682739bb0877e7de479096ba3505c0a387e85ca74e49cae0d37b14ab84aa5d6bdf179af69d6bde961e8fde43caa7c34fdc2c80950466441badc18880ab96715a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "uuid": [
+ {
+ "data": "1E453EA8-BB42-419D-8067-D2477A36B761",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "D449BC32-6D28-4AF0-BB00-AB3391EF0F9A",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "email": [
+ {
+ "data": "ActivationDepartment@FedRetireSoftware.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "url": [
+ {
+ "data": "http://www.FedRetireSoftware.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "type": "EXTERNAL_PARSER",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://FedRetireSoftware.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ },
+ {
+ "type": "EXTERNAL_PARSER",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "md5": [
+ {
+ "data": "d691b46d83322997a7a692858dc82f32",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b9a036cce166cbf677a9c237e916f05d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "90ed3aac2a942e3067e6471b32860e77",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "55d84fb3a4ae16307380358dbdfa6fda",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3105f8c4fb192d2b45b6d06902c54b32",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "290e99c8e500bd3ef4cabe3f970fa01e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ ],
+ "isInteresting": false
+ }
+ ]
+ },
+ "file": {
+ "name": "bad_file.exe",
+ "hash": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "type": "pe"
+ },
+ "filesDownloadFinished": false,
+ "additionalStepsRunning": [
+ "similarity_search"
+ ],
+ "additionalStepsDone": false,
+ "created_date": "10/19/2023, 16:17:05",
+ "defaultOptionsUsed": false,
+ "scanOptions": {
+ "rapid_mode": null,
+ "osint": true,
+ "extended_osint": true,
+ "extracted_files_osint": true,
+ "visualization": true,
+ "files_download": true,
+ "resolve_domains": true,
+ "input_file_yara": true,
+ "extracted_files_yara": true,
+ "whois": true,
+ "ips_meta": true,
+ "images_ocr": true
+ },
+ "estimatedTime": "9",
+ "estimated_progress": 1.0,
+ "allOsintTags": [
+ {
+ "source": "OSINT_LOOKUP",
+ "sourceIdentifier": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "tag": {
+ "name": "emotet",
+ "synonyms": [
+ "geodo"
+ ],
+ "descriptions": [
+ {
+ "description": "While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.\r\nIt is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.\r\nEmotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.",
+ "cluster": {
+ "type": "malpedia",
+ "authors": [
+ "Davide Arcuri",
+ "Alexandre Dulaunoy",
+ "Steffen Enders",
+ "Andrea Garavaglia",
+ "Andras Iklody",
+ "Daniel Plohmann",
+ "Christophe Vandeplas"
+ ]
+ }
+ }
+ ],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/opswat_submissions_result_not_finished.json b/tests/resources/opswat_submissions_result_not_finished.json
new file mode 100644
index 0000000..65d3f41
--- /dev/null
+++ b/tests/resources/opswat_submissions_result_not_finished.json
@@ -0,0 +1,70 @@
+{
+ "flowId": "65316f10ba877ae559118c99",
+ "allFinished": false,
+ "allFilesDownloadFinished": false,
+ "allAdditionalStepsDone": false,
+ "reportsAmount": 1,
+ "priority": "max",
+ "pollPause": 5,
+ "fileSize": 13370880,
+ "fileReadProgressBytes": 13370880,
+ "reports": {
+ "761590d3-9fec-4ab9-846f-12db39b156b2": {
+ "finalVerdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "allTags": [],
+ "overallState": "in_progress",
+ "taskReference": {
+ "name": "transform-file",
+ "additionalInfo": {
+ "submitName": "bad_file.exe",
+ "submitTime": 1697738514610,
+ "digests": {
+ "SHA-256": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc"
+ }
+ },
+ "ID": "84e354e5-4d3c-4790-b6be-6b75c9fa9160",
+ "state": "IN_PROGRESS",
+ "opcount": 0,
+ "processTime": 0
+ },
+ "subtaskReferences": [],
+ "allSignalGroups": [],
+ "iocs": {},
+ "filter_errors": [
+ "Resource not found: ['osint', 'file']"
+ ],
+ "file": {
+ "name": "bad_file.exe",
+ "hash": "834d1dbfab8330ea5f1844f6e905ed0ac19d1033ee9a9f1122ad2051c56783dc",
+ "type": null
+ },
+ "filesDownloadFinished": false,
+ "additionalStepsRunning": [
+ "similarity_search"
+ ],
+ "additionalStepsDone": false,
+ "created_date": "10/19/2023, 18:01:53",
+ "defaultOptionsUsed": false,
+ "scanOptions": {
+ "rapid_mode": null,
+ "osint": true,
+ "extended_osint": true,
+ "extracted_files_osint": true,
+ "visualization": true,
+ "files_download": true,
+ "resolve_domains": true,
+ "input_file_yara": true,
+ "extracted_files_yara": true,
+ "whois": true,
+ "ips_meta": true,
+ "images_ocr": true
+ },
+ "estimatedTime": "8",
+ "estimated_progress": 0.40424999594688416
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/opswat_submissions_result_suspicious.json b/tests/resources/opswat_submissions_result_suspicious.json
new file mode 100644
index 0000000..a7d4097
--- /dev/null
+++ b/tests/resources/opswat_submissions_result_suspicious.json
@@ -0,0 +1,3069 @@
+{
+ "flowId": "65315865368548c1702f2f29",
+ "allFinished": true,
+ "allFilesDownloadFinished": true,
+ "allAdditionalStepsDone": true,
+ "reportsAmount": 1,
+ "priority": "max",
+ "pollPause": 5,
+ "fileSize": 53610896,
+ "fileReadProgressBytes": 53610896,
+ "reports": {
+ "d3312ff7-aa7d-4a75-b8ba-a21dbc3a05e1": {
+ "finalVerdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": true,
+ "tag": {
+ "name": "peexe",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": true,
+ "tag": {
+ "name": "html",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "MEDIA_TYPE",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": true,
+ "tag": {
+ "name": "xml",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "setupapi",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "control",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "overallState": "success",
+ "taskReference": {
+ "name": "transform-file",
+ "additionalInfo": {
+ "submitName": "assinador-serpro-4-2-0.exe",
+ "submitTime": 1697732715243,
+ "digests": {
+ "SHA-256": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ },
+ "ID": "0c188503-8d09-4436-bebe-94724420a9f7",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "TRANSFORM_FILE",
+ "name": "file",
+ "ID": "a174480a-b1ec-4c3d-aed2-7f15b206c692"
+ },
+ "opcount": 1,
+ "processTime": 36245
+ },
+ "subtaskReferences": [
+ {
+ "name": "visualization",
+ "additionalInfo": "1010fb26-e2b1-47a4-96f2-9a248ed7861e",
+ "ID": "b49a8e83-dd52-4445-b4ac-b1c3c8e77d43",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "VISUALIZATION",
+ "name": "visualization",
+ "ID": "1010fb26-e2b1-47a4-96f2-9a248ed7861e"
+ },
+ "opcount": 1,
+ "processTime": 315
+ },
+ {
+ "name": "osint",
+ "additionalInfo": "a174480a-b1ec-4c3d-aed2-7f15b206c692",
+ "ID": "346905ea-3ad9-4cde-a787-8276fec39a19",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "8e1a4862-5338-4310-abd5-6940125d1e08"
+ },
+ "opcount": 4,
+ "processTime": 2009
+ },
+ {
+ "name": "domain-resolve",
+ "additionalInfo": 2,
+ "ID": "f1aaa67d-f2cd-4fbb-a049-9b22115fe667",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "DOMAIN_RESOLVE",
+ "name": "domain-resolve",
+ "ID": "6e0d30b0-6297-47d5-a7f6-183cc7185335"
+ },
+ "opcount": 1,
+ "processTime": 435
+ },
+ {
+ "name": "file-download",
+ "additionalInfo": 2,
+ "ID": "2f7f87df-1fd1-4dab-b0cb-95e70ae20dc0",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "FILE_DOWNLOAD",
+ "name": "file-download",
+ "ID": "434d0549-04de-46e3-979b-bee8b5a102dc"
+ },
+ "opcount": 2,
+ "processTime": 1371
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "FILE_HASH_SHA256",
+ "ID": "18a96c92-aeda-453f-8de1-c4f5c06fbdc8",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "7d836969-21ba-4389-938e-baa048df0cb7"
+ },
+ "opcount": 46,
+ "processTime": 3042
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "URL",
+ "ID": "de1096dd-3880-4e27-862b-28929f319d7e",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "8131ecac-6500-4d13-9717-45a5df5036e5"
+ },
+ "opcount": 2,
+ "processTime": 8
+ },
+ {
+ "name": "osint-ex",
+ "additionalInfo": "DOMAIN",
+ "ID": "ecb4d89e-b4da-47a4-b258-876989d0bf2f",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "a320c10e-3db8-470a-9f09-1dcbe60cda84"
+ },
+ "opcount": 0,
+ "processTime": 6
+ },
+ {
+ "name": "osint-fuzzyhash",
+ "additionalInfo": "a174480a-b1ec-4c3d-aed2-7f15b206c692",
+ "ID": "87e54f48-f000-40d5-896a-b7b757c0aae8",
+ "state": "SUCCESS",
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "8b0bfc9e-8456-41a6-b565-1f5f70f2a232"
+ },
+ "opcount": 2,
+ "processTime": 1007
+ }
+ ],
+ "allSignalGroups": [
+ {
+ "identifier": "H060",
+ "description": "PE has icon",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"05febfad978958780fbcd54073fa28228f5375cf4e2d5df5310f3cd8e47e491f\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"30e3536a32c2509357a5472a0eff9335cb5b5607fde8d7ca82bd7a03f9a60ebc\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"63bc73ffa28e0af5077c1bb882c913cdcd2765a34288451c15b8fa832477cc43\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"e091f8e6206b0fba3798d99b465e8c33082ebed634fa71886e1a9f002e99730f\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_ICON\" (SHA256: \"30058e7862f12edbefb181bc36b6443828b9fba9d2f5bb6bfd4a3927d579e46b\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found a resource with \"RT_GROUP_ICON\" (SHA256: \"b3804a4ce8e8f4b7b07a26f688b4a122e22857398c9979cc869a215c50d2b70e\")",
+ "originPath": "file.extendedData.resources.resources",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H062",
+ "description": "PE takes commandline arguments",
+ "allMitreTechniques": [
+ {
+ "ID": "T1059",
+ "relatedTactic": {
+ "ID": "TA0002",
+ "name": "Execution"
+ },
+ "name": "Command and Scripting Interpreter"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetCommandLineW@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H021",
+ "description": "PE imports APIs used for code injection",
+ "allMitreTechniques": [
+ {
+ "ID": "T1055",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Process Injection"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"CreateThread@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"VirtualAlloc@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"OpenProcessToken@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H043",
+ "description": "PE has a known suspicious section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".edata\" is suspicious (probably \"Developed with Easy Programming Language (EPL)\")",
+ "originPath": "file.extendedData.sections.name",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H001",
+ "description": "PE section size is empty",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".bss\" is empty",
+ "originPath": "file.extendedData.sections.sizeOfRawData",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Section \".tls\" is empty",
+ "originPath": "file.extendedData.sections.sizeOfRawData",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H023",
+ "description": "PE imports APIs used to query user information on remote machines",
+ "allMitreTechniques": [
+ {
+ "ID": "T1033",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "System Owner/User Discovery"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"NetWkstaGetInfo@netapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H025",
+ "description": "PE imports APIs commonly used by packers",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"VirtualProtect@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"VirtualAlloc@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H002",
+ "description": "PE has uncommon entrypoint section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section .itext is unusual",
+ "originPath": "file.extendedData.entrypointName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H027",
+ "description": "PE imports APIs used to set privilege levels",
+ "allMitreTechniques": [
+ {
+ "ID": "T1033",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "System Owner/User Discovery"
+ },
+ {
+ "ID": "T1134",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Access Token Manipulation"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"AdjustTokenPrivileges@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"OpenProcessToken@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H004",
+ "description": "PE imports suspicious APIs",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetExitCodeProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"VirtualProtect@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"CreateProcess@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RaiseException@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SwitchToThread@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentThread@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LockResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetCurrentThreadId@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LoadResource@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SuspendThread@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetFileSize@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetThreadPriority@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"VerSetConditionMask@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetDiskFreeSpace@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"FindFirstFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"DeleteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"GetEnvironmentVariable@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"WriteFile@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"EnumCalendarInfo@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"RemoveDirectory@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"SetThreadLocale@kernel32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"ExitWindowsEx@user32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"NetWkstaGetInfo@netapi32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"ConvertStringSecurityDescriptorToSecurityDescriptor@advapi32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Import \"LookupPrivilegeValue@advapi32.dll\" is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H007",
+ "description": "PE imports suspicious modules",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Imported module \"netapi32.dll\" (related to \"network\" activity) is marked as suspicious",
+ "originPath": "file.extendedData.importsEx.module",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H028",
+ "description": "PE imports APIs used to launch other processes",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"CreateProcessW@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "PE004",
+ "description": "PE header references a certificate",
+ "averageSignalStrength": 0,
+ "peakSignalStrength": 0,
+ "finalSignalStrength": 0,
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" contains header field related to digital certificate.",
+ "additionalInfo": "",
+ "originPath": "file.extendedData",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "PE000",
+ "description": "PE contains a valid certificate",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" contains a valid digital signature from \"CN=SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), O=SERVICO FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), L=BRASILIA, ST=DISTRITO FEDERAL, C=BR\" (Serial: 162cc214567a6424c9bfc8c1)",
+ "additionalInfo": "162cc214567a6424c9bfc8c1",
+ "originPath": "file.certInfos",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" contains a valid digital signature from \"CN=GlobalSign Code Signing Root R45, O=GlobalSign nv-sa, C=BE\" (Serial: 7803184245708a41cf6f01b8eeb4a954)",
+ "additionalInfo": "7803184245708a41cf6f01b8eeb4a954",
+ "originPath": "file.certInfos",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" contains a valid digital signature from \"CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE\" (Serial: 77bd0e03a1b708f854ab067210d90447)",
+ "additionalInfo": "77bd0e03a1b708f854ab067210d90447",
+ "originPath": "file.certInfos",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "EF001",
+ "description": "Contains an overlay",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Input file has a \"52734864\" byte overlay at offset \"876032\"",
+ "additionalInfo": "cde42ac73af4a9a566b44267ad18fddb36078f853e37d06e9df506d62f8ea143",
+ "originPath": "file.extractedFiles",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "EF002",
+ "description": "Contains an overlay with an unusually high entropy",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Input file has a \"52734864\" byte overlay at offset \"876032\" with an entropy of \"7.99999666214\"",
+ "additionalInfo": "cde42ac73af4a9a566b44267ad18fddb36078f853e37d06e9df506d62f8ea143",
+ "originPath": "file.extractedFiles",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "overlay",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "packed",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "SIGG016",
+ "description": "Executable is a digitally not signed installer",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "signalReadable": "Found an installer which is not digitally signed",
+ "additionalInfo": "",
+ "originPath": "signalSummary.allTags",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "dataUUID": "a174480a-b1ec-4c3d-aed2-7f15b206c692"
+ }
+ ]
+ },
+ {
+ "identifier": "S007",
+ "description": "Found a Windows desktop utility string artifact",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"control\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"write\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"convert\"",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "BIN001",
+ "description": "The executable is using a known installer framework",
+ "allMitreTechniques": [
+ {
+ "ID": "T1027.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Software Packing"
+ }
+ ],
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The analysis found the signature of a known installer framework (\"Installer: Inno Setup Module(6.1.0)[unicode]\")",
+ "originPath": "file.dieInfo",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H030",
+ "description": "PE imports APIs used to manipulate/query other processes",
+ "allMitreTechniques": [
+ {
+ "ID": "T1518",
+ "name": "Software Discovery"
+ }
+ ],
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"OpenProcessToken@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H032",
+ "description": "PE imports APIs used to access or modify the registry",
+ "allMitreTechniques": [
+ {
+ "ID": "T1012",
+ "relatedTactic": {
+ "ID": "TA0007",
+ "name": "Discovery"
+ },
+ "name": "Query Registry"
+ }
+ ],
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegQueryValueExW@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegCloseKey@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"RegOpenKeyExW@advapi32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "PE005",
+ "description": "PE contains an untrusted digital certificate",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "The artifact \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" contains a \"self-signed\" digital signature from \"CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3\" (Serial: 4000000000121585308a2)",
+ "additionalInfo": "4000000000121585308a2",
+ "originPath": "file.certInfos",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H056",
+ "description": "PE is created with Inno Setup installation system",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "PE is a Inno Setup installer",
+ "originPath": "file.extendedData.verinfo",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "installer",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ }
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "identifier": "H011",
+ "description": "PE imports APIs used for anti-debugging purposes",
+ "averageSignalStrength": 0.25,
+ "peakSignalStrength": 0.25,
+ "finalSignalStrength": 0.25,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"SwitchToThread@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" as \"INFORMATIONAL\"",
+ "additionalInfo": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "originPath": "file.inputSampleOSINT.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H035",
+ "description": "PE imports APIs used to shutdown/lock the system",
+ "allMitreTechniques": [
+ {
+ "ID": "T1499",
+ "relatedTactic": {
+ "ID": "TA0040",
+ "name": "Impact"
+ },
+ "name": "Endpoint Denial of Service"
+ }
+ ],
+ "averageSignalStrength": 0.75,
+ "peakSignalStrength": 0.75,
+ "finalSignalStrength": 0.75,
+ "verdict": {
+ "verdict": "LIKELY_MALICIOUS",
+ "threatLevel": 0.75,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.75,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"ExitWindowsEx@user32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H038",
+ "description": "PE has an uncommon section name",
+ "averageSignalStrength": 0.5,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.5,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section \".itext\" is unusual",
+ "originPath": "file.extendedData.sections.sectionName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Entrypoint section \".didata\" is unusual",
+ "originPath": "file.extendedData.sections.sectionName",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "H016",
+ "description": "PE imports APIs used to hide other imports",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryA@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryExW@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"GetProcAddress@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found API reference \"LoadLibraryW@kernel32.dll\"",
+ "originPath": "file.extendedData.imports.imports",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "S051",
+ "description": "Found a living off the land (LotL) string artifact",
+ "allMitreTechniques": [
+ {
+ "ID": "T1218.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Control Panel"
+ },
+ {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ ],
+ "averageSignalStrength": 0.42,
+ "peakSignalStrength": 0.5,
+ "finalSignalStrength": 0.49,
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ },
+ "allTags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "control",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "setupapi",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "signals": [
+ {
+ "strength": 0.25,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"control\" (Alternate data streams)",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "control",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.25,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.002",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Control Panel"
+ }
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"setupapi.dll\" (AWL bypass Execute)",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "setupapi",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ },
+ {
+ "strength": 0.5,
+ "isStrictlyBasedOnInputData": true,
+ "signalReadable": "Found string artifact \"shell32.dll\" (Execute)",
+ "originPath": "file.strings.references",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "tags": [
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "lolbin",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ },
+ {
+ "source": "SIGNAL",
+ "sourceIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "isRootTag": false,
+ "tag": {
+ "name": "shell32",
+ "synonyms": [],
+ "descriptions": [],
+ "verdict": {
+ "verdict": "SUSPICIOUS",
+ "threatLevel": 0.5,
+ "confidence": 1
+ }
+ }
+ }
+ ],
+ "mitreTechnique": {
+ "ID": "T1218.011",
+ "relatedTactic": {
+ "ID": "TA0005",
+ "name": "Defense Evasion"
+ },
+ "name": "Rundll32"
+ }
+ }
+ ]
+ },
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08\" as \"INFORMATIONAL\"",
+ "additionalInfo": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ]
+ },
+ {
+ "identifier": "I001",
+ "description": "OSINT source detected benign resource(s)",
+ "averageSignalStrength": 0.1,
+ "peakSignalStrength": 0.1,
+ "finalSignalStrength": 0.1,
+ "verdict": {
+ "verdict": "INFORMATIONAL",
+ "threatLevel": 0.1,
+ "confidence": 1
+ },
+ "allTags": [],
+ "signals": [
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"19151c084fcd30aed2f27deed3ec77351f27a94fd9618da56258ea03bbcbc7f3\" as \"INFORMATIONAL\"",
+ "additionalInfo": "19151c084fcd30aed2f27deed3ec77351f27a94fd9618da56258ea03bbcbc7f3",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"22296669c2c50d3fdfee9de9f7730d0a5cc498b7cc54cd2aa8ded74d7e69f654\" as \"INFORMATIONAL\"",
+ "additionalInfo": "22296669c2c50d3fdfee9de9f7730d0a5cc498b7cc54cd2aa8ded74d7e69f654",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"351e7d3c756242cde2e4a2bef16d636d5e073e0cf3e9cfa2b1da1efccd7806ae\" as \"INFORMATIONAL\"",
+ "additionalInfo": "351e7d3c756242cde2e4a2bef16d636d5e073e0cf3e9cfa2b1da1efccd7806ae",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"3c45c82b39b3c90c9c22342a8f6be98073faf1dcd26dbc578b3a6fa9a499cb46\" as \"INFORMATIONAL\"",
+ "additionalInfo": "3c45c82b39b3c90c9c22342a8f6be98073faf1dcd26dbc578b3a6fa9a499cb46",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"734b698aafc2cfabfd0750c88498022d650f6ee025250dc8795de56a6e122445\" as \"INFORMATIONAL\"",
+ "additionalInfo": "734b698aafc2cfabfd0750c88498022d650f6ee025250dc8795de56a6e122445",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ },
+ {
+ "strength": 0.1,
+ "isStrictlyBasedOnInputData": false,
+ "signalReadable": "OSINT provider \"OPSWAT_REPUTATION\" detected resource \"e7dbe99baa5c1045cdf7004edb037018b2e0f639a5edcf800ec4514d5c8e35b5\" as \"INFORMATIONAL\"",
+ "additionalInfo": "e7dbe99baa5c1045cdf7004edb037018b2e0f639a5edcf800ec4514d5c8e35b5",
+ "originPath": "osint.results.verdict",
+ "originType": "INPUT_FILE",
+ "originIdentifier": "5a4eff64fb4b0abe28b640eec4842f4c8e8f0c8499715d6869416dee6a2fcc4d"
+ }
+ ]
+ }
+ ],
+ "resources": {
+ "8b0bfc9e-8456-41a6-b565-1f5f70f2a232": {
+ "results": [],
+ "relatedTaskType": "OSINT_FUZZY_HASH",
+ "origin": {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ },
+ "resourceReference": {
+ "type": "OSINT",
+ "name": "osint",
+ "ID": "8b0bfc9e-8456-41a6-b565-1f5f70f2a232"
+ },
+ "mediaType": {
+ "string": "application/octet-stream",
+ "slash": 11,
+ "semicolon": 24,
+ "parameters": {}
+ },
+ "signalGroupsByID": {},
+ "signalGroups": [],
+ "allTags": [],
+ "originVerdicts": [],
+ "verdict": {
+ "verdict": "UNKNOWN",
+ "threatLevel": 0,
+ "confidence": 1
+ },
+ "notifications": []
+ }
+ },
+ "iocs": {
+ "sha1": [
+ {
+ "data": "a78f44fbaa8fe1af42d182bdf6bba10298e8f9d0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f9e4dd288cf9c760941cadb475675c52e660a4e3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "19969a1f68d497f0114538352da478b41c3d2060",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "95641a365d88f070bcbd921d99bc1c034e92340e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2c365c0341faf71f810a39c69859a7eb5bc0de8d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c8abb69fb38434daf6811309cc88e9d0df65e2cd",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "593953973c74066bcd09b22402948425dab9b12f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "054aa93663138220373081b25672499d38cb2eaf",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ed16991f4f735f8258ff195bed5f1641d1405cc9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "64a194ea368bb16ffac3e7a4ca84b3c00bf15920",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "139a84f87110fb5cb16a386adade21f30cae98b0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b70589a036a33681a1dfb9cf0ae1c044093105bc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "30704560832bafa440df1fd20693653c2a30f815",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2c39cf9c2c1cfab48077cda2d4d6312fdb53c54b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "81703bf084f800ff3fb6a59946afe4d61e19da0a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "881ed848fcd0fd28cc0374dcf424ac1b511449d7",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8b440004b69538573b6cb4d11524bb9a05aa08d9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9d8217a9fe24717ad0458df8cda78581baf9203b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "4d558ad1d7d9df7bb9745a3ec624ceb6853ae027",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "210176c87e076551111487ca538c2c4cc0dc4001",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b164bf0882b60c0d7d4643495a2c1db5a20a1343",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "dc6002a243c7567105aef957d8b01142df42b3d2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "191abfb842d1dc6148f60cd86449cfa9b4a43047",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha256": [
+ {
+ "data": "cde42ac73af4a9a566b44267ad18fddb36078f853e37d06e9df506d62f8ea143",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "05febfad978958780fbcd54073fa28228f5375cf4e2d5df5310f3cd8e47e491f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "51209c8034cd5c2127a7b877a3280699d6bad965bcc102e830420c836f535c97",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "30e3536a32c2509357a5472a0eff9335cb5b5607fde8d7ca82bd7a03f9a60ebc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "30058e7862f12edbefb181bc36b6443828b9fba9d2f5bb6bfd4a3927d579e46b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "63bc73ffa28e0af5077c1bb882c913cdcd2765a34288451c15b8fa832477cc43",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "bb650ee3d30d21f22fc7853936b06be7cbfd05b4d88ed105d3e53774dae7f21f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e091f8e6206b0fba3798d99b465e8c33082ebed634fa71886e1a9f002e99730f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "22296669c2c50d3fdfee9de9f7730d0a5cc498b7cc54cd2aa8ded74d7e69f654",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "19151c084fcd30aed2f27deed3ec77351f27a94fd9618da56258ea03bbcbc7f3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b33f156b0a8ce96c7182dfb6afa9f6a7020433a6e16ca21f6092ba03695bdd12",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "99b7194bf59ac43cbbdc441ab7ca14ab0330449accd33730281da09bb96bcbe3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "2e6d8102640132ccabd2fa3c3a61c77c2b41a80d7f60013cf7149819c2b5c9d2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "75bb01fe4bafdef22d879aaea5b85d1165a30ec0e558536e1b4c6002c4730d5d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0852b5fce0c5b7ff53fe4c4163983daf8a2057d5481911c24253f330bfd65d9a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "b3804a4ce8e8f4b7b07a26f688b4a122e22857398c9979cc869a215c50d2b70e",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "68d71a16528396835848137bd6c36b3b55c116f78a448b900721d87bd04771b8",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3bac7ddac05247d073f294071903715ef0aec49c8a24f2bbae4927ec51260d27",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "351e7d3c756242cde2e4a2bef16d636d5e073e0cf3e9cfa2b1da1efccd7806ae",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "734b698aafc2cfabfd0750c88498022d650f6ee025250dc8795de56a6e122445",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "4be11ded6c924c3181c0b2a17cbf6f017fbf2b074adadaae213a330711e22cd1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "3c45c82b39b3c90c9c22342a8f6be98073faf1dcd26dbc578b3a6fa9a499cb46",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e7dbe99baa5c1045cdf7004edb037018b2e0f639a5edcf800ec4514d5c8e35b5",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "ip": [
+ {
+ "data": "75.119.223.113",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "domain": [
+ {
+ "data": "schemas.microsoft.com",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "jrsoftware.org",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "w3.org",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1c67a524eade7a5a0cfcce57bc321816f979ad069438b9a8f502a3ee5124ae67"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "sha512": [
+ {
+ "data": "446ec1fb6532cfbebc0ccf4b5388fd0e963af33f14e74d1749b21765aefed34e0f7786d8fd9041912253491b34070f4dd107bde05d9820bab8341267447392e9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9f14cffb99a4e46ac633a9df459e6359a8fe373946896de43ed78a38899d8cf3ebea6d6723c6b3d5d9a856232af794dbbfa347496b80bd8118e0120e0a1a726d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "94366a2d90e224dd32bf106bfb97e19addb3f83ebb2580ca3996a7ce5e2813a45840e910162ac92dc5de988d90f60d9e882c414e8b2f908f6134bddc18b514d7",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "67c4c2ef03c7fa88babe0032bdb2e2887a676bf5116e3116079b01bbd7d5a4f511aaaf1b393f872ec2746ff06d0429201c4a26e71d485be497e67bde88d6ec5c",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "bc7c322301145c58aa2979da469b93e1bfa396f586dd4feaecd1a90aef459c7c075cefeab92f9ea2ce16a246afcf604e099d11a03d3dc9d13d3c0afbc4bfd6d0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0f937059fff95bfa6548448f43f1e5d51b6732ac625c135fe84fe40780f5473c03e6cb0b5bb3383ebe0edb0f950e7ffd08fee2f2a707da9748c23d0c91787b16",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "639a097103aafacf7a28b55c4912859368c20d6eb1ebdff34b60a5d1b194c5077c61ed131a5f0a158c1bc8de3bb4d11fed67b907ad5fefccd4ffd6c967101808",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ff31a6fd2c55f2419eb296fcf2d3bd2e3f40c3438f521a9c5c5077e0753462d690dc95b054a4adfa6784681416ee20d3ff6bea2b6b8076d74f245bdc15658e06",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "9be908d7e1335550c777d4c60c6d315e20b761c102f824354105d77157bdea48daf5750728f0e439c6ee838edc0bba107d1144f57c60735a08f9afc22a9a5d7d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7e6e96224e3b705164b39a08a1ec245cf97cc5255b790ceca7fef57f2f112e55975f3d070db8ead20144ce46915a9169e28b61a638e602df9dc1c10579134d3f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "5eecdf060ff4f7cbf92b43f34e0be04f3372ec0231d754869391f8d5ed0c03ba551abb986c7df43312def628568d2a28fac4a46c1e43b09566626315f31f0962",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "61c14fca37a17b5f97db4c4d11c2929f9d1c46e00e6e013c5a1fbf0edbad486bb33a4e34d2af698209dc41bcdda8821fd422cbfdb41228d7a91ef3f9039035d3",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "ec83ebf28016d3cbd6fd2e5c9a35d582adbfeb81cade47cfa258da709fa90c6fecf2f1ce894132a7c25668b4ff278f888757961ab5de73d442aa5982f5caf85b",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "da8a269c92d01acc963595800f63421b0ac19a02fe8ca3dd9d3db668876e080cb5fb9f088bed9879789d940402a707f0339c9a989f6d71f4547b48031a00fcf4",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "88cb5543993103ba68d8a4aacd797e175920129bc0c129a8af97ca3e886927945087a1bb227d4735222ae6b8437dfa36638b2555c9682d29723f6b53a9ae1ce6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "75577743c0d0ff226ed9bbcff6891d8c8c8b5013262aae11d4759738ab214708cc362c84d3d37d4eb3bf98096d334ee0fe82225eae12c19c9cf52e87c36d4727",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "128318b6862e6834925a3c39cde22c17035c23078b2d38b9b27c54d1dd60ffb40296ff9688014055ca547360ed103986681f13797508ace536a25fc67d873887",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "cd22fa5cba2591690f61cd96da4036d2078a9e8e33249387745c1c9e08e0c1887296163367cdfcb88346a4e9931e261c23037c6a60aa455af857b48a3bc78bb9",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "36baf90c3936c013be089c7582f2a185d26411b5ed69a930c9ab5d5c3471bb1ef65c75087b99644ba5ac611176bfc312eb6199ffe5731d81d82f86d961c62af1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0ba8bcb4f1d9a2fda66bf2094235da0c6e24752ef2a2edbaf75bcc014c9dc95fc675e3f46318465be625f9299083bb27103bb8cfe29ed8ad7b6ccca6adf61055",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e9e6729a898a023d34ba33073e29d4e35126f5d14e28ccca79a8132a01018a7bd54cfd79967d497d9a4fa4f26033b24c4541897685912c80eb644604d4f51179",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "328529a3e6fff4185190f97dc5aea5ad08dc7c031952d67b1ebb1aebad82c37e94d4b0ff5a62c6e2baf5b2ea5454340bf0284ca5656709b66fd717d6e9e3116a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "09f7126bcea32f91f39819de654cdb4acddbb40880e9c37c54c5cca0a47863f0fad97f90ef2597c28731aec0f05227d585833b347300fd8c8caa8a6a016cdce6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "uuid": [
+ {
+ "data": "1f676c76-80e1-4239-95bb-83d0f6d0da78",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e2011457-1546-43c5-a5fe-008deee3d3f0",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "35138b9a-5d96-4fbd-8e2d-a2440225f93a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "url": [
+ {
+ "data": "http://www.w3.org/1999/xhtml",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1c67a524eade7a5a0cfcce57bc321816f979ad069438b9a8f502a3ee5124ae67"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd",
+ "origins": [
+ {
+ "type": "EXTRACTED_FILE",
+ "identifier": "1c67a524eade7a5a0cfcce57bc321816f979ad069438b9a8f502a3ee5124ae67"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "http://schemas.microsoft.com/SMI/2005/WindowsSettings",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "registry_path": [
+ {
+ "data": "Software\\Borland\\Locales",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "Software\\Borland\\Delphi\\Locales",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "Software\\Embarcadero\\Locales",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "Software\\CodeGear\\Locales",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ],
+ "md5": [
+ {
+ "data": "22bd761820c0d64ac6866f56e58e8069",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "186e8b284df616726dd2e02f3b908831",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d0969cc9a96275d54a109de740708a5a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d1efb0d972603f09c3a2a866a8b36d48",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e07ab8c9030f776ce0f6d9040d41c616",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e8e4995b464abd85d77008d3750ca7af",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "98da6167be9a4eb3be8bab5877938ff2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "09208f24be8c3f3b08c323e9836db5e6",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "def52a5b1e8bba58fe020b2c959f5c4f",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "a40263c75fde7440b1086b7da9c51fc2",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "d2467f70311fc072d9202909bdfa9fcb",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "aeb11111a0334d20d978e15c3eb3ebab",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "110abe16232608d8671eaca8ee324f45",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "e7cbab9e4b301ee7e5ec1e09c0b084ba",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "c7d3a1e14afcb8402a656a27156f7a00",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "697028c6576655ef520aa0d99011c6d1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "1c9252919f0a0d2072f3fe0565f0b443",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "de899aac74105149ca395b0548549fc1",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "7acc30378a3661ecca806f547c8e4cfc",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "f8cd0efcff1461af9c4d6a7d4fab4c0d",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "21cba6c9d478ce13ad53587cdd7f21f8",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "0d708a089fabb88286009f3f5c509a9a",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ },
+ {
+ "data": "4ac29bb5f7361e85771807112cd4ec93",
+ "origins": [
+ {
+ "type": "INPUT_FILE",
+ "identifier": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08"
+ }
+ ],
+ "isInteresting": false
+ }
+ ]
+ },
+ "file": {
+ "name": "assinador-serpro-4-2-0.exe",
+ "hash": "bd16e02e72d3cbc4326e36f2ca27cad2bc69434a3733879f07c95d2b2cf66f08",
+ "type": "pe"
+ },
+ "filesDownloadFinished": true,
+ "additionalStepsRunning": [],
+ "additionalStepsDone": true,
+ "created_date": "10/19/2023, 16:25:16",
+ "defaultOptionsUsed": true,
+ "scanOptions": {
+ "rapid_mode": false,
+ "osint": true,
+ "extended_osint": true,
+ "extracted_files_osint": true,
+ "visualization": true,
+ "files_download": true,
+ "resolve_domains": true,
+ "input_file_yara": true,
+ "extracted_files_yara": true,
+ "whois": true,
+ "ips_meta": true,
+ "images_ocr": true
+ },
+ "estimatedTime": "9",
+ "estimated_progress": 1.0
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/resources/triage_analyze.json b/tests/resources/triage_analyze.json
new file mode 100644
index 0000000..2fe72ca
--- /dev/null
+++ b/tests/resources/triage_analyze.json
@@ -0,0 +1,8 @@
+{
+ "id": "200707-pht1cwk3ls",
+ "status": "pending",
+ "kind": "file",
+ "filename": "KfhizGC7.ps1",
+ "private": false,
+ "submitted": "2020-07-07T13:19:44Z"
+}
\ No newline at end of file
diff --git a/tests/resources/triage_available.json b/tests/resources/triage_available.json
new file mode 100644
index 0000000..b771934
--- /dev/null
+++ b/tests/resources/triage_available.json
@@ -0,0 +1,925 @@
+{
+ "data": [{
+ "id": "200707-hmjbd2m5te",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "KfhizGC7.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-07-07T09:36:28Z"
+ }, {
+ "id": "200707-lm5k2nnvp2",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "KfhizGC7.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-07-07T09:30:50Z"
+ }, {
+ "id": "200707-85jheqhav6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "KfhizGC7.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "KfhizGC7.ps1"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "KfhizGC7.ps1"
+ }],
+ "submitted": "2020-07-07T09:28:52Z",
+ "completed": "2020-07-07T09:31:31Z"
+ }, {
+ "id": "200703-pln68nvm16",
+ "status": "reported",
+ "kind": "file",
+ "filename": "NvQL5Nyg.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "failed",
+ "target": "NvQL5Nyg.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "failed",
+ "target": "NvQL5Nyg.exe"
+ }],
+ "submitted": "2020-07-03T20:02:23Z",
+ "completed": "2020-07-03T20:02:35Z"
+ }, {
+ "id": "200703-awkf3m9e8j",
+ "status": "reported",
+ "kind": "file",
+ "filename": "tmWVUbbs.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "tmWVUbbs.ps1"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "tmWVUbbs.ps1"
+ }],
+ "submitted": "2020-07-03T19:58:28Z",
+ "completed": "2020-07-03T20:01:10Z"
+ }, {
+ "id": "200630-jh8753bqvx",
+ "status": "reported",
+ "kind": "file",
+ "filename": "AMn5b2MA.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "AMn5b2MA.ps1"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "AMn5b2MA.ps1"
+ }],
+ "submitted": "2020-06-30T15:56:00Z",
+ "completed": "2020-06-30T15:58:40Z"
+ }, {
+ "id": "200630-lxttq9wyws",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2BqW1ME8.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2BqW1ME8.ps1"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2BqW1ME8.ps1"
+ }],
+ "submitted": "2020-06-30T15:37:22Z",
+ "completed": "2020-06-30T15:40:03Z"
+ }, {
+ "id": "200630-bn46hyxz72",
+ "status": "reported",
+ "kind": "file",
+ "filename": "tpn8Le3g.hta",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "tpn8Le3g.hta"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "tpn8Le3g.hta"
+ }],
+ "submitted": "2020-06-30T15:32:21Z",
+ "completed": "2020-06-30T15:35:03Z"
+ }, {
+ "id": "200630-lsfpwj84cx",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "2DRiXkGV.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-06-30T15:32:14Z"
+ }, {
+ "id": "200630-tv8pcn4yl6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2DRiXkGV.ps1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2DRiXkGV.ps1"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2DRiXkGV.ps1"
+ }],
+ "submitted": "2020-06-30T15:28:20Z",
+ "completed": "2020-06-30T15:31:02Z"
+ }, {
+ "id": "200623-9a314l23vj",
+ "status": "reported",
+ "kind": "file",
+ "filename": "koahk.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "failed",
+ "target": "koahk.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "failed",
+ "target": "koahk.exe"
+ }],
+ "submitted": "2020-06-23T20:11:30Z",
+ "completed": "2020-06-23T20:11:42Z"
+ }, {
+ "id": "200620-yw99pq1z6a",
+ "status": "reported",
+ "kind": "file",
+ "filename": "VTCWorldSetup-0.1.12.8.4.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "VTCWorldSetup-0.1.12.8.4.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "VTCWorldSetup-0.1.12.8.4.exe"
+ }],
+ "submitted": "2020-06-20T19:29:14Z",
+ "completed": "2020-06-20T19:32:04Z"
+ }, {
+ "id": "200617-12x1fcwg9e",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2020-01-17-18-01_SRjFhQkL.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2020-01-17-18-01_SRjFhQkL.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2020-01-17-18-01_SRjFhQkL.exe"
+ }],
+ "submitted": "2020-06-17T22:58:16Z",
+ "completed": "2020-06-17T23:00:58Z"
+ }, {
+ "id": "200617-9v6jq9lxy2",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2020-02-11-08-58_ygaizp44.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2020-02-11-08-58_ygaizp44.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2020-02-11-08-58_ygaizp44.exe"
+ }],
+ "submitted": "2020-06-17T22:06:03Z",
+ "completed": "2020-06-17T22:08:39Z"
+ }, {
+ "id": "200617-7y21ltvd3n",
+ "status": "reported",
+ "kind": "file",
+ "filename": "85nGZfpB.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "failed",
+ "target": "85nGZfpB.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "failed",
+ "target": "85nGZfpB.exe"
+ }],
+ "submitted": "2020-06-17T21:58:24Z",
+ "completed": "2020-06-17T21:58:35Z"
+ }, {
+ "id": "200615-8jbndpgg9n",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe"
+ }],
+ "submitted": "2020-06-15T10:04:02Z",
+ "completed": "2020-06-15T10:06:44Z"
+ }, {
+ "id": "200615-9dxhxe22ra",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ZeroAccess.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ZeroAccess.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ZeroAccess.exe"
+ }],
+ "submitted": "2020-06-15T09:58:25Z",
+ "completed": "2020-06-15T10:01:08Z"
+ }, {
+ "id": "200602-4czw6gd9ha",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "scanner2.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-06-02T12:43:26Z"
+ }, {
+ "id": "200422-s6p2vbgywx",
+ "status": "reported",
+ "kind": "file",
+ "filename": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.zip",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.hta"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.hta"
+ }],
+ "submitted": "2020-04-22T20:37:17Z",
+ "completed": "2020-04-22T20:39:57Z"
+ }, {
+ "id": "200421-2m9hatqqvx",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-04-21T15:23:15Z",
+ "completed": "2020-04-21T15:27:24Z"
+ }, {
+ "id": "200417-1tfxt2wqre",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-04-17T13:07:22Z",
+ "completed": "2020-04-17T13:22:15Z"
+ }, {
+ "id": "200415-7ytzzw3ttj",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.img",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-04-15T13:13:58Z"
+ }, {
+ "id": "200415-jcknfzjgvj",
+ "status": "reported",
+ "kind": "file",
+ "filename": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.hta",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.hta"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "Bankcopy_307144_2020-04-15_DE_E-INVOICE_20-613129926-12.hta"
+ }],
+ "submitted": "2020-04-15T09:27:26Z",
+ "completed": "2020-04-15T09:30:03Z"
+ }, {
+ "id": "200414-5hc9qww6c2",
+ "status": "reported",
+ "kind": "file",
+ "filename": "Passware+Kit+Forensic+2020-RTMD-ANs9ll41mwAAvhwCAE5MFwAoAIRi__8A.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "Passware+Kit+Forensic+2020-RTMD-ANs9ll41mwAAvhwCAE5MFwAoAIRi__8A.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "Passware+Kit+Forensic+2020-RTMD-ANs9ll41mwAAvhwCAE5MFwAoAIRi__8A.exe"
+ }],
+ "submitted": "2020-04-14T22:51:17Z",
+ "completed": "2020-04-14T22:53:55Z"
+ }, {
+ "id": "200413-nsv31vhsss",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-04-13T07:40:35Z",
+ "completed": "2020-04-13T07:44:30Z"
+ }, {
+ "id": "200407-2xgf3hp3qj",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-04-07T15:21:31Z",
+ "completed": "2020-04-07T15:25:11Z"
+ }, {
+ "id": "200407-hq23kgztnn",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-04-07T13:16:23Z",
+ "completed": "2020-04-07T13:19:41Z"
+ }, {
+ "id": "200402-387pacnqmj",
+ "status": "reported",
+ "kind": "url",
+ "url": "http://8988.ru/goto/22721528842/547789/aHR0cHM6Ly90aW1jYWNoLmJsb2dzcG90LmNvbQ==",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "http://8988.ru/goto/22721528842/547789/aHR0cHM6Ly90aW1jYWNoLmJsb2dzcG90LmNvbQ=="
+ }],
+ "submitted": "2020-04-02T17:10:16Z",
+ "completed": "2020-04-02T17:13:02Z"
+ }, {
+ "id": "200330-s3zszrwjen",
+ "status": "reported",
+ "kind": "file",
+ "filename": "kek.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "kek.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "kek.exe"
+ }],
+ "submitted": "2020-03-30T10:42:26Z",
+ "completed": "2020-03-30T10:45:05Z"
+ }, {
+ "id": "200325-vx4znkwz1x",
+ "status": "reported",
+ "kind": "file",
+ "filename": "0b283b3ee065c2a1a5d9b5fef691be7b70cf5c5f1371f5a6653ec35a998602a0_0b283b3ee065c2a1a5d9b5fef691be7b70cf5c5f1371f5a6653ec35a998602a0.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "0b283b3ee065c2a1a5d9b5fef691be7b70cf5c5f1371f5a6653ec35a998602a0_0b283b3ee065c2a1a5d9b5fef691be7b70c.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "0b283b3ee065c2a1a5d9b5fef691be7b70cf5c5f1371f5a6653ec35a998602a0_0b283b3ee065c2a1a5d9b5fef691be7b70c.exe"
+ }],
+ "submitted": "2020-03-25T13:24:05Z",
+ "completed": "2020-03-25T13:26:42Z"
+ }, {
+ "id": "200325-kz3b927gv6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "1.lnk",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "1.lnk"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "1.lnk"
+ }],
+ "submitted": "2020-03-25T13:14:23Z",
+ "completed": "2020-03-25T13:17:01Z"
+ }, {
+ "id": "200324-hpbf2e9f2n",
+ "status": "reported",
+ "kind": "file",
+ "filename": "JVC_36998.vbs",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "JVC_36998.vbs"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "JVC_36998.vbs"
+ }],
+ "submitted": "2020-03-24T14:54:26Z",
+ "completed": "2020-03-24T14:57:03Z"
+ }, {
+ "id": "200324-qct35fk3zn",
+ "status": "reported",
+ "kind": "file",
+ "filename": "676224fb3ab782fc096351c2419ebd8f7df95a9180407f725c57e72d2bbec5b1",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "676224fb3ab782fc096351c2419ebd8f7df95a9180407f725c57e72d2bbec5b1.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "676224fb3ab782fc096351c2419ebd8f7df95a9180407f725c57e72d2bbec5b1.exe"
+ }],
+ "submitted": "2020-03-24T14:20:41Z",
+ "completed": "2020-03-24T14:23:17Z"
+ }, {
+ "id": "200324-fc55dk22ds",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ZeroAccess.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ZeroAccess.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ZeroAccess.exe"
+ }],
+ "submitted": "2020-03-24T14:05:42Z",
+ "completed": "2020-03-24T14:08:30Z"
+ }, {
+ "id": "200323-dq9s6zcy5n",
+ "status": "reported",
+ "kind": "url",
+ "url": "https://google.com",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "https://google.com"
+ }],
+ "submitted": "2020-03-23T16:48:50Z",
+ "completed": "2020-03-23T16:49:31Z"
+ }, {
+ "id": "200323-lm2yqwhhxe",
+ "status": "reported",
+ "kind": "file",
+ "filename": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
+ }],
+ "submitted": "2020-03-23T16:26:35Z",
+ "completed": "2020-03-23T16:29:51Z"
+ }, {
+ "id": "200323-j2ya2bdpd6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe"
+ }],
+ "submitted": "2020-03-23T14:50:16Z",
+ "completed": "2020-03-23T14:52:53Z"
+ }, {
+ "id": "200319-lhwscgnbdj",
+ "status": "reported",
+ "kind": "file",
+ "filename": "e5527d1bfc8b1448dcd698f23ac7142a066bb19b6109ef1c92df4d6214aa2d6a",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "e5527d1bfc8b1448dcd698f23ac7142a066bb19b6109ef1c92df4d6214aa2d6a.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "e5527d1bfc8b1448dcd698f23ac7142a066bb19b6109ef1c92df4d6214aa2d6a.exe"
+ }],
+ "submitted": "2020-03-19T16:50:00Z",
+ "completed": "2020-03-19T16:52:37Z"
+ }, {
+ "id": "200319-a2vwe4dajn",
+ "status": "reported",
+ "kind": "file",
+ "filename": "NDA vorm.docx",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "NDA vorm.docx"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "NDA vorm.docx"
+ }],
+ "submitted": "2020-03-19T15:59:24Z",
+ "completed": "2020-03-19T16:02:21Z"
+ }, {
+ "id": "200319-bfa95csd5e",
+ "status": "reported",
+ "kind": "file",
+ "filename": "Error 1601-repairkit.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "Error 1601-repairkit.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "Error 1601-repairkit.exe"
+ }],
+ "submitted": "2020-03-19T14:35:40Z",
+ "completed": "2020-03-19T14:38:22Z"
+ }, {
+ "id": "200319-wcs4kpnvln",
+ "status": "reported",
+ "kind": "url",
+ "url": "https://nyship-my.sharepoint.com/:o:/g/personal/lkrause_nysanet_org/EkEmqu73NddBsuiGT1D3tb0BdN2MoWdpxS_qTQrspsVKiQ?eJjLzq",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "https://nyship-my.sharepoint.com/:o:/g/personal/lkrause_nysanet_org/EkEmqu73NddBsuiGT1D3tb0BdN2MoWdpxS_qTQrspsVKiQ?eJjLzq"
+ }],
+ "submitted": "2020-03-19T13:09:34Z",
+ "completed": "2020-03-19T13:12:09Z"
+ }, {
+ "id": "200319-meaxe9xsx6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "405df2b5aa985c8386d347b6e7f269e546231a02abd1e793ae792010248bc9da",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "405df2b5aa985c8386d347b6e7f269e546231a02abd1e793ae792010248bc9da.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "405df2b5aa985c8386d347b6e7f269e546231a02abd1e793ae792010248bc9da.exe"
+ }],
+ "submitted": "2020-03-19T13:05:10Z",
+ "completed": "2020-03-19T13:07:49Z"
+ }, {
+ "id": "200318-vz1ardh74n",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "view_presentation_v2c.js",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-03-18T13:38:01Z"
+ }, {
+ "id": "200318-qvj6g8zd7j",
+ "status": "reported",
+ "kind": "file",
+ "filename": "view_presentation_v2c.js",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "view_presentation_v2c.js"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "view_presentation_v2c.js"
+ }],
+ "submitted": "2020-03-18T13:27:19Z",
+ "completed": "2020-03-18T13:29:56Z"
+ }, {
+ "id": "200316-w9m37b5eda",
+ "status": "reported",
+ "kind": "file",
+ "filename": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889.exe"
+ }],
+ "submitted": "2020-03-16T15:46:33Z",
+ "completed": "2020-03-16T15:49:11Z"
+ }, {
+ "id": "200316-fae4hlh5e6",
+ "status": "reported",
+ "kind": "file",
+ "filename": "Error 1601-repairkit.exe",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "Error 1601-repairkit.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "Error 1601-repairkit.exe"
+ }],
+ "submitted": "2020-03-16T15:27:54Z",
+ "completed": "2020-03-16T15:30:31Z"
+ }, {
+ "id": "200316-lmtp6t2nxe",
+ "status": "reported",
+ "kind": "file",
+ "filename": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889.exe"
+ }],
+ "submitted": "2020-03-16T13:46:50Z",
+ "completed": "2020-03-16T13:51:57Z"
+ }, {
+ "id": "200316-7hr1j7egks",
+ "status": "reported",
+ "kind": "file",
+ "filename": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "3207b5da6ecf0d6ea787c5047c1e886c0ee6342a5d79e4bcb757e7e817caa889.exe"
+ }],
+ "submitted": "2020-03-16T13:26:10Z",
+ "completed": "2020-03-16T13:28:48Z"
+ }, {
+ "id": "200316-7j6l7m4efs",
+ "status": "reported",
+ "kind": "file",
+ "filename": "e070a88883634bf7105f9744123adfd3890947e8da4754d2560293e68f809f10",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }, {
+ "id": "behavioral1",
+ "status": "reported",
+ "target": "e070a88883634bf7105f9744123adfd3890947e8da4754d2560293e68f809f10.exe"
+ }, {
+ "id": "behavioral2",
+ "status": "reported",
+ "target": "e070a88883634bf7105f9744123adfd3890947e8da4754d2560293e68f809f10.exe"
+ }],
+ "submitted": "2020-03-16T11:15:17Z",
+ "completed": "2020-03-16T11:17:56Z"
+ }, {
+ "id": "200316-5hs4ktmmzj",
+ "status": "static_analysis",
+ "kind": "file",
+ "filename": "07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541",
+ "private": false,
+ "tasks": [{
+ "id": "static1",
+ "status": "reported"
+ }],
+ "submitted": "2020-03-16T11:10:22Z"
+ }],
+ "next": "2020-03-16T11:10:22.744164Z"
+}
\ No newline at end of file
diff --git a/tests/resources/triage_behavioral1.json b/tests/resources/triage_behavioral1.json
new file mode 100644
index 0000000..69380ac
--- /dev/null
+++ b/tests/resources/triage_behavioral1.json
@@ -0,0 +1,5550 @@
+{
+ "version": "0.2.1",
+ "sample": {
+ "id": "200615-8jbndpgg9n",
+ "score": 10,
+ "submitted": "2020-06-15T10:04:02Z",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "size": 210944,
+ "md5": "880585ebbd4a96a065d689b0ee4d6f30",
+ "sha1": "e70c69be9cb6cb0497445b8bd7fe76c08844752e",
+ "sha256": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "sha512": "4ce2bb8c6bd49465eb97a1b4e93e19c01906e63bcc526fa5072db9124faf62de86c87f02d7a17b27b59a3e77eb108302a72de6ccf43c59558e0d4adc8eab93c0",
+ "static_tags": ["windows", "x86"]
+ },
+ "task": {
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "size": 210944,
+ "md5": "880585ebbd4a96a065d689b0ee4d6f30",
+ "sha1": "e70c69be9cb6cb0497445b8bd7fe76c08844752e",
+ "sha256": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "sha512": "4ce2bb8c6bd49465eb97a1b4e93e19c01906e63bcc526fa5072db9124faf62de86c87f02d7a17b27b59a3e77eb108302a72de6ccf43c59558e0d4adc8eab93c0",
+ "static_tags": ["windows", "x86"]
+ },
+ "analysis": {
+ "score": 10,
+ "tags": ["ransomware", "persistence", "family:nemty"],
+ "ttp": ["T1107", "T1490", "T1112", "T1031", "T1053", "T1102"],
+ "features": ["analog"],
+ "submitted": "2020-06-15T10:04:02Z",
+ "reported": "2020-06-15T10:06:44Z",
+ "max_time_network": 92972,
+ "max_time_kernel": 150759,
+ "backend": "horse2",
+ "resource": "win7v200430",
+ "platform": "windows7_x64"
+ },
+ "processes": [{
+ "procid": 23,
+ "procid_parent": 20,
+ "pid": 1360,
+ "ppid": 1324,
+ "cmd": "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe\"",
+ "image": "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "orig": false,
+ "started": 1295,
+ "terminated": 20545
+ }, {
+ "procid": 24,
+ "procid_parent": 23,
+ "pid": 1444,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 4227,
+ "terminated": 4929
+ }, {
+ "procid": 26,
+ "procid_parent": 23,
+ "pid": 1040,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 4383,
+ "terminated": 4945
+ }, {
+ "procid": 28,
+ "procid_parent": 24,
+ "pid": 1612,
+ "ppid": 1444,
+ "cmd": "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 4430,
+ "terminated": 4929
+ }, {
+ "procid": 29,
+ "procid_parent": 26,
+ "pid": 1020,
+ "ppid": 1040,
+ "cmd": "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 4461,
+ "terminated": 4929
+ }, {
+ "procid": 30,
+ "procid_parent": 6,
+ "pid": 1028,
+ "ppid": 468,
+ "cmd": "C:\\Windows\\system32\\vssvc.exe",
+ "image": "C:\\Windows\\system32\\vssvc.exe",
+ "orig": true,
+ "started": 4602
+ }, {
+ "procid": 33,
+ "procid_parent": 23,
+ "pid": 752,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im sql.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7722,
+ "terminated": 11591
+ }, {
+ "procid": 34,
+ "procid_parent": 23,
+ "pid": 796,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im winword.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7722,
+ "terminated": 11466
+ }, {
+ "procid": 37,
+ "procid_parent": 23,
+ "pid": 552,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im wordpad.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7737,
+ "terminated": 11466
+ }, {
+ "procid": 38,
+ "procid_parent": 23,
+ "pid": 1088,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im outlook.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7769,
+ "terminated": 11341
+ }, {
+ "procid": 40,
+ "procid_parent": 23,
+ "pid": 532,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im thunderbird.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7784,
+ "terminated": 11372
+ }, {
+ "procid": 43,
+ "procid_parent": 34,
+ "pid": 1592,
+ "ppid": 796,
+ "cmd": "taskkill /f /im winword.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7815,
+ "terminated": 11466
+ }, {
+ "procid": 44,
+ "procid_parent": 33,
+ "pid": 1604,
+ "ppid": 752,
+ "cmd": "taskkill /f /im sql.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7815,
+ "terminated": 11466
+ }, {
+ "procid": 45,
+ "procid_parent": 23,
+ "pid": 1632,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im oracle.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7831,
+ "terminated": 11388
+ }, {
+ "procid": 46,
+ "procid_parent": 37,
+ "pid": 1744,
+ "ppid": 552,
+ "cmd": "taskkill /f /im wordpad.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7831,
+ "terminated": 11466
+ }, {
+ "procid": 47,
+ "procid_parent": 23,
+ "pid": 1564,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im excel.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7847,
+ "terminated": 11481
+ }, {
+ "procid": 48,
+ "procid_parent": 23,
+ "pid": 1560,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im onenote.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7862,
+ "terminated": 11325
+ }, {
+ "procid": 49,
+ "procid_parent": 23,
+ "pid": 1544,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im virtualboxvm.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7878,
+ "terminated": 11450
+ }, {
+ "procid": 51,
+ "procid_parent": 38,
+ "pid": 1916,
+ "ppid": 1088,
+ "cmd": "taskkill /f /im outlook.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7893,
+ "terminated": 11325
+ }, {
+ "procid": 55,
+ "procid_parent": 40,
+ "pid": 1960,
+ "ppid": 532,
+ "cmd": "taskkill /f /im thunderbird.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7925,
+ "terminated": 11357
+ }, {
+ "procid": 56,
+ "procid_parent": 23,
+ "pid": 1928,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im node.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7940,
+ "terminated": 11310
+ }, {
+ "procid": 58,
+ "procid_parent": 23,
+ "pid": 1676,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im QBW32.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 7987,
+ "terminated": 11481
+ }, {
+ "procid": 59,
+ "procid_parent": 48,
+ "pid": 1208,
+ "ppid": 1560,
+ "cmd": "taskkill /f /im onenote.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 7987,
+ "terminated": 11310
+ }, {
+ "procid": 60,
+ "procid_parent": 47,
+ "pid": 112,
+ "ppid": 1564,
+ "cmd": "taskkill /f /im excel.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8003,
+ "terminated": 11481
+ }, {
+ "procid": 61,
+ "procid_parent": 56,
+ "pid": 1084,
+ "ppid": 1928,
+ "cmd": "taskkill /f /im node.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8018,
+ "terminated": 11310
+ }, {
+ "procid": 62,
+ "procid_parent": 23,
+ "pid": 1064,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im WBGX.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8018,
+ "terminated": 11435
+ }, {
+ "procid": 65,
+ "procid_parent": 23,
+ "pid": 300,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im Teams.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8081,
+ "terminated": 11450
+ }, {
+ "procid": 66,
+ "procid_parent": 45,
+ "pid": 1832,
+ "ppid": 1632,
+ "cmd": "taskkill /f /im oracle.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8081,
+ "terminated": 11388
+ }, {
+ "procid": 67,
+ "procid_parent": 49,
+ "pid": 1836,
+ "ppid": 1544,
+ "cmd": "taskkill /f /im virtualboxvm.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8096,
+ "terminated": 11419
+ }, {
+ "procid": 68,
+ "procid_parent": 62,
+ "pid": 1052,
+ "ppid": 1064,
+ "cmd": "taskkill /f /im WBGX.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8096,
+ "terminated": 11435
+ }, {
+ "procid": 69,
+ "procid_parent": 58,
+ "pid": 1628,
+ "ppid": 1676,
+ "cmd": "taskkill /f /im QBW32.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8143,
+ "terminated": 11466
+ }, {
+ "procid": 70,
+ "procid_parent": 23,
+ "pid": 1508,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im Flow.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8190,
+ "terminated": 11388
+ }, {
+ "procid": 72,
+ "procid_parent": 23,
+ "pid": 1548,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8190,
+ "terminated": 9594
+ }, {
+ "procid": 74,
+ "procid_parent": 23,
+ "pid": 1004,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8221,
+ "terminated": 9313
+ }, {
+ "procid": 76,
+ "procid_parent": 23,
+ "pid": 368,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8237,
+ "terminated": 9282
+ }, {
+ "procid": 78,
+ "procid_parent": 23,
+ "pid": 1912,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8252,
+ "terminated": 9313
+ }, {
+ "procid": 81,
+ "procid_parent": 23,
+ "pid": 896,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8268,
+ "terminated": 9297
+ }, {
+ "procid": 82,
+ "procid_parent": 23,
+ "pid": 2044,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8283,
+ "terminated": 9297
+ }, {
+ "procid": 83,
+ "procid_parent": 23,
+ "pid": 2064,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8299,
+ "terminated": 9297
+ }, {
+ "procid": 85,
+ "procid_parent": 23,
+ "pid": 2088,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8315,
+ "terminated": 9750
+ }, {
+ "procid": 86,
+ "procid_parent": 70,
+ "pid": 2096,
+ "ppid": 1508,
+ "cmd": "taskkill /f /im Flow.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8315,
+ "terminated": 11388
+ }, {
+ "procid": 90,
+ "procid_parent": 23,
+ "pid": 2140,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8346,
+ "terminated": 9329
+ }, {
+ "procid": 91,
+ "procid_parent": 23,
+ "pid": 2156,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8361,
+ "terminated": 9313
+ }, {
+ "procid": 93,
+ "procid_parent": 72,
+ "pid": 2188,
+ "ppid": 1548,
+ "cmd": "net stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8393,
+ "terminated": 9563
+ }, {
+ "procid": 94,
+ "procid_parent": 23,
+ "pid": 2196,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8393,
+ "terminated": 9329
+ }, {
+ "procid": 95,
+ "procid_parent": 23,
+ "pid": 2208,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8393,
+ "terminated": 9999
+ }, {
+ "procid": 97,
+ "procid_parent": 23,
+ "pid": 2224,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8408,
+ "terminated": 10046
+ }, {
+ "procid": 98,
+ "procid_parent": 82,
+ "pid": 2244,
+ "ppid": 2044,
+ "cmd": "net stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8439,
+ "terminated": 9282
+ }, {
+ "procid": 99,
+ "procid_parent": 65,
+ "pid": 2252,
+ "ppid": 300,
+ "cmd": "taskkill /f /im Teams.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 8439,
+ "terminated": 11450
+ }, {
+ "procid": 100,
+ "procid_parent": 74,
+ "pid": 2264,
+ "ppid": 1004,
+ "cmd": "net stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8455,
+ "terminated": 9297
+ }, {
+ "procid": 101,
+ "procid_parent": 78,
+ "pid": 2288,
+ "ppid": 1912,
+ "cmd": "net stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8471,
+ "terminated": 9313
+ }, {
+ "procid": 104,
+ "procid_parent": 81,
+ "pid": 2332,
+ "ppid": 896,
+ "cmd": "net stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8517,
+ "terminated": 9282
+ }, {
+ "procid": 105,
+ "procid_parent": 76,
+ "pid": 2344,
+ "ppid": 368,
+ "cmd": "net stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8533,
+ "terminated": 9282
+ }, {
+ "procid": 106,
+ "procid_parent": 83,
+ "pid": 2356,
+ "ppid": 2064,
+ "cmd": "net stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8533,
+ "terminated": 9297
+ }, {
+ "procid": 108,
+ "procid_parent": 85,
+ "pid": 2400,
+ "ppid": 2088,
+ "cmd": "net stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8580,
+ "terminated": 9750
+ }, {
+ "procid": 109,
+ "procid_parent": 90,
+ "pid": 2416,
+ "ppid": 2140,
+ "cmd": "net stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8595,
+ "terminated": 9297
+ }, {
+ "procid": 110,
+ "procid_parent": 91,
+ "pid": 2424,
+ "ppid": 2156,
+ "cmd": "net stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8595,
+ "terminated": 9297
+ }, {
+ "procid": 111,
+ "procid_parent": 94,
+ "pid": 2432,
+ "ppid": 2196,
+ "cmd": "net stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8611,
+ "terminated": 9297
+ }, {
+ "procid": 112,
+ "procid_parent": 23,
+ "pid": 2272,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8611,
+ "terminated": 9687
+ }, {
+ "procid": 113,
+ "procid_parent": 23,
+ "pid": 2448,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8642,
+ "terminated": 10233
+ }, {
+ "procid": 115,
+ "procid_parent": 23,
+ "pid": 2468,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8658,
+ "terminated": 9703
+ }, {
+ "procid": 116,
+ "procid_parent": 23,
+ "pid": 2492,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8673,
+ "terminated": 10109
+ }, {
+ "procid": 117,
+ "procid_parent": 23,
+ "pid": 2500,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8689,
+ "terminated": 9812
+ }, {
+ "procid": 120,
+ "procid_parent": 23,
+ "pid": 2536,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8705,
+ "terminated": 9797
+ }, {
+ "procid": 123,
+ "procid_parent": 23,
+ "pid": 2572,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8736,
+ "terminated": 10311
+ }, {
+ "procid": 125,
+ "procid_parent": 23,
+ "pid": 2596,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8751,
+ "terminated": 9812
+ }, {
+ "procid": 126,
+ "procid_parent": 23,
+ "pid": 2608,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8767,
+ "terminated": 10296
+ }, {
+ "procid": 128,
+ "procid_parent": 23,
+ "pid": 2636,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c schtasks.exe /create /sc onstart /tn \"NEMTY_XHNNB1O\" /tr \"C:\\Users\\Admin\\AdobeUpdate.exe\"",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8783,
+ "terminated": 9812
+ }, {
+ "procid": 131,
+ "procid_parent": 23,
+ "pid": 2668,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin.exe delete shadows /all /quiet \u0026 bcdedit /set {default} bootstatuspolicy ignoreallfailures \u0026 bcdedit /set {default} recoveryenabled no \u0026 wbadmin delete catalog -quiet \u0026 wmic shadowcopy delete",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 8798,
+ "terminated": 10795
+ }, {
+ "procid": 134,
+ "procid_parent": 100,
+ "pid": 2792,
+ "ppid": 2264,
+ "cmd": "C:\\Windows\\system32\\net1 stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 8907,
+ "terminated": 9282
+ }, {
+ "procid": 135,
+ "procid_parent": 131,
+ "pid": 2820,
+ "ppid": 2668,
+ "cmd": "vssadmin.exe delete shadows /all /quiet ",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 8923,
+ "terminated": 9063
+ }, {
+ "procid": 136,
+ "procid_parent": 128,
+ "pid": 2828,
+ "ppid": 2636,
+ "cmd": "schtasks.exe /create /sc onstart /tn \"NEMTY_XHNNB1O\" /tr \"C:\\Users\\Admin\\AdobeUpdate.exe\"",
+ "image": "C:\\Windows\\SysWOW64\\schtasks.exe",
+ "orig": true,
+ "started": 8923,
+ "terminated": 9812
+ }, {
+ "procid": 137,
+ "procid_parent": 97,
+ "pid": 2688,
+ "ppid": 2224,
+ "cmd": "net stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 8954,
+ "terminated": 10046
+ }, {
+ "procid": 138,
+ "procid_parent": 105,
+ "pid": 2928,
+ "ppid": 2344,
+ "cmd": "C:\\Windows\\system32\\net1 stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 8985,
+ "terminated": 9282
+ }, {
+ "procid": 139,
+ "procid_parent": 106,
+ "pid": 2976,
+ "ppid": 2356,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9017,
+ "terminated": 9282
+ }, {
+ "procid": 140,
+ "procid_parent": 98,
+ "pid": 2992,
+ "ppid": 2244,
+ "cmd": "C:\\Windows\\system32\\net1 stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9017,
+ "terminated": 9282
+ }, {
+ "procid": 141,
+ "procid_parent": 109,
+ "pid": 2984,
+ "ppid": 2416,
+ "cmd": "C:\\Windows\\system32\\net1 stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9017,
+ "terminated": 9297
+ }, {
+ "procid": 142,
+ "procid_parent": 101,
+ "pid": 3000,
+ "ppid": 2288,
+ "cmd": "C:\\Windows\\system32\\net1 stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9032,
+ "terminated": 9297
+ }, {
+ "procid": 143,
+ "procid_parent": 115,
+ "pid": 2912,
+ "ppid": 2468,
+ "cmd": "net stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9063,
+ "terminated": 9703
+ }, {
+ "procid": 144,
+ "procid_parent": 116,
+ "pid": 2860,
+ "ppid": 2492,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9063,
+ "terminated": 10109
+ }, {
+ "procid": 145,
+ "procid_parent": 113,
+ "pid": 2904,
+ "ppid": 2448,
+ "cmd": "net stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9095,
+ "terminated": 10233
+ }, {
+ "procid": 146,
+ "procid_parent": 117,
+ "pid": 2896,
+ "ppid": 2500,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9095,
+ "terminated": 9812
+ }, {
+ "procid": 147,
+ "procid_parent": 104,
+ "pid": 3032,
+ "ppid": 2332,
+ "cmd": "C:\\Windows\\system32\\net1 stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9095,
+ "terminated": 9282
+ }, {
+ "procid": 148,
+ "procid_parent": 111,
+ "pid": 3024,
+ "ppid": 2432,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9095,
+ "terminated": 9297
+ }, {
+ "procid": 149,
+ "procid_parent": 93,
+ "pid": 3016,
+ "ppid": 2188,
+ "cmd": "C:\\Windows\\system32\\net1 stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9110,
+ "terminated": 9547
+ }, {
+ "procid": 150,
+ "procid_parent": 110,
+ "pid": 3040,
+ "ppid": 2424,
+ "cmd": "C:\\Windows\\system32\\net1 stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9110,
+ "terminated": 9282
+ }, {
+ "procid": 151,
+ "procid_parent": 131,
+ "pid": 3048,
+ "ppid": 2668,
+ "cmd": "wmic shadowcopy delete",
+ "image": "C:\\Windows\\SysWOW64\\Wbem\\WMIC.exe",
+ "orig": true,
+ "started": 9110,
+ "terminated": 10795
+ }, {
+ "procid": 152,
+ "procid_parent": 112,
+ "pid": 2888,
+ "ppid": 2272,
+ "cmd": "net stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9126,
+ "terminated": 9687
+ }, {
+ "procid": 153,
+ "procid_parent": 95,
+ "pid": 2880,
+ "ppid": 2208,
+ "cmd": "net stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9141,
+ "terminated": 9999
+ }, {
+ "procid": 154,
+ "procid_parent": 123,
+ "pid": 2936,
+ "ppid": 2572,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9141,
+ "terminated": 10296
+ }, {
+ "procid": 155,
+ "procid_parent": 125,
+ "pid": 2952,
+ "ppid": 2596,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9141,
+ "terminated": 9797
+ }, {
+ "procid": 156,
+ "procid_parent": 120,
+ "pid": 2920,
+ "ppid": 2536,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9141,
+ "terminated": 9797
+ }, {
+ "procid": 157,
+ "procid_parent": 126,
+ "pid": 2968,
+ "ppid": 2608,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 9141,
+ "terminated": 10296
+ }, {
+ "procid": 158,
+ "procid_parent": 108,
+ "pid": 3056,
+ "ppid": 2400,
+ "cmd": "C:\\Windows\\system32\\net1 stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9235,
+ "terminated": 9750
+ }, {
+ "procid": 160,
+ "procid_parent": 153,
+ "pid": 2332,
+ "ppid": 2880,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9563,
+ "terminated": 9984
+ }, {
+ "procid": 161,
+ "procid_parent": 137,
+ "pid": 2180,
+ "ppid": 2688,
+ "cmd": "C:\\Windows\\system32\\net1 stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9609,
+ "terminated": 10046
+ }, {
+ "procid": 162,
+ "procid_parent": 143,
+ "pid": 2792,
+ "ppid": 2912,
+ "cmd": "C:\\Windows\\system32\\net1 stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9625,
+ "terminated": 9703
+ }, {
+ "procid": 163,
+ "procid_parent": 156,
+ "pid": 2420,
+ "ppid": 2920,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9625,
+ "terminated": 9797
+ }, {
+ "procid": 164,
+ "procid_parent": 155,
+ "pid": 2204,
+ "ppid": 2952,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9625,
+ "terminated": 9797
+ }, {
+ "procid": 165,
+ "procid_parent": 152,
+ "pid": 2984,
+ "ppid": 2888,
+ "cmd": "C:\\Windows\\system32\\net1 stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9641,
+ "terminated": 9687
+ }, {
+ "procid": 166,
+ "procid_parent": 146,
+ "pid": 2280,
+ "ppid": 2896,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9656,
+ "terminated": 9812
+ }, {
+ "procid": 167,
+ "procid_parent": 144,
+ "pid": 2360,
+ "ppid": 2860,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9719,
+ "terminated": 10109
+ }, {
+ "procid": 168,
+ "procid_parent": 145,
+ "pid": 780,
+ "ppid": 2904,
+ "cmd": "C:\\Windows\\system32\\net1 stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9765,
+ "terminated": 10218
+ }, {
+ "procid": 169,
+ "procid_parent": 154,
+ "pid": 3000,
+ "ppid": 2936,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9781,
+ "terminated": 10296
+ }, {
+ "procid": 170,
+ "procid_parent": 157,
+ "pid": 2432,
+ "ppid": 2968,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 9781,
+ "terminated": 10280
+ }, {
+ "procid": 173,
+ "procid_parent": 23,
+ "pid": 2920,
+ "ppid": 1360,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c \"C:\\Users\\Admin\\NEMTY_XHNNB1O-DECRYPT.txt\"",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 20514
+ }, {
+ "procid": 175,
+ "procid_parent": 173,
+ "pid": 2280,
+ "ppid": 2920,
+ "cmd": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Admin\\NEMTY_XHNNB1O-DECRYPT.txt",
+ "image": "C:\\Windows\\SysWOW64\\NOTEPAD.EXE",
+ "orig": true,
+ "started": 20779
+ }],
+ "signatures": [{
+ "name": "Suspicious use of WriteProcessMemory",
+ "indicators": [{
+ "description": "PID 1360 wrote to memory of 1444",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 24
+ }, {
+ "description": "PID 1360 wrote to memory of 1444",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 24
+ }, {
+ "description": "PID 1360 wrote to memory of 1444",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 24
+ }, {
+ "description": "PID 1360 wrote to memory of 1444",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 24
+ }, {
+ "description": "PID 1360 wrote to memory of 1040",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 26
+ }, {
+ "description": "PID 1360 wrote to memory of 1040",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 26
+ }, {
+ "description": "PID 1360 wrote to memory of 1040",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 26
+ }, {
+ "description": "PID 1360 wrote to memory of 1040",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 26
+ }, {
+ "description": "PID 1444 wrote to memory of 1612",
+ "pid": 1444,
+ "procid": 24,
+ "procid_target": 28
+ }, {
+ "description": "PID 1444 wrote to memory of 1612",
+ "pid": 1444,
+ "procid": 24,
+ "procid_target": 28
+ }, {
+ "description": "PID 1444 wrote to memory of 1612",
+ "pid": 1444,
+ "procid": 24,
+ "procid_target": 28
+ }, {
+ "description": "PID 1444 wrote to memory of 1612",
+ "pid": 1444,
+ "procid": 24,
+ "procid_target": 28
+ }, {
+ "description": "PID 1040 wrote to memory of 1020",
+ "pid": 1040,
+ "procid": 26,
+ "procid_target": 29
+ }, {
+ "description": "PID 1040 wrote to memory of 1020",
+ "pid": 1040,
+ "procid": 26,
+ "procid_target": 29
+ }, {
+ "description": "PID 1040 wrote to memory of 1020",
+ "pid": 1040,
+ "procid": 26,
+ "procid_target": 29
+ }, {
+ "description": "PID 1040 wrote to memory of 1020",
+ "pid": 1040,
+ "procid": 26,
+ "procid_target": 29
+ }, {
+ "description": "PID 1360 wrote to memory of 752",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 33
+ }, {
+ "description": "PID 1360 wrote to memory of 752",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 33
+ }, {
+ "description": "PID 1360 wrote to memory of 752",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 33
+ }, {
+ "description": "PID 1360 wrote to memory of 752",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 33
+ }, {
+ "description": "PID 1360 wrote to memory of 796",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 34
+ }, {
+ "description": "PID 1360 wrote to memory of 796",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 34
+ }, {
+ "description": "PID 1360 wrote to memory of 796",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 34
+ }, {
+ "description": "PID 1360 wrote to memory of 796",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 34
+ }, {
+ "description": "PID 1360 wrote to memory of 552",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 37
+ }, {
+ "description": "PID 1360 wrote to memory of 552",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 37
+ }, {
+ "description": "PID 1360 wrote to memory of 552",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 37
+ }, {
+ "description": "PID 1360 wrote to memory of 552",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 37
+ }, {
+ "description": "PID 1360 wrote to memory of 1088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 38
+ }, {
+ "description": "PID 1360 wrote to memory of 1088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 38
+ }, {
+ "description": "PID 1360 wrote to memory of 1088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 38
+ }, {
+ "description": "PID 1360 wrote to memory of 1088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 38
+ }, {
+ "description": "PID 1360 wrote to memory of 532",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 40
+ }, {
+ "description": "PID 1360 wrote to memory of 532",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 40
+ }, {
+ "description": "PID 1360 wrote to memory of 532",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 40
+ }, {
+ "description": "PID 1360 wrote to memory of 532",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 40
+ }, {
+ "description": "PID 796 wrote to memory of 1592",
+ "pid": 796,
+ "procid": 34,
+ "procid_target": 43
+ }, {
+ "description": "PID 796 wrote to memory of 1592",
+ "pid": 796,
+ "procid": 34,
+ "procid_target": 43
+ }, {
+ "description": "PID 796 wrote to memory of 1592",
+ "pid": 796,
+ "procid": 34,
+ "procid_target": 43
+ }, {
+ "description": "PID 796 wrote to memory of 1592",
+ "pid": 796,
+ "procid": 34,
+ "procid_target": 43
+ }, {
+ "description": "PID 752 wrote to memory of 1604",
+ "pid": 752,
+ "procid": 33,
+ "procid_target": 44
+ }, {
+ "description": "PID 752 wrote to memory of 1604",
+ "pid": 752,
+ "procid": 33,
+ "procid_target": 44
+ }, {
+ "description": "PID 752 wrote to memory of 1604",
+ "pid": 752,
+ "procid": 33,
+ "procid_target": 44
+ }, {
+ "description": "PID 752 wrote to memory of 1604",
+ "pid": 752,
+ "procid": 33,
+ "procid_target": 44
+ }, {
+ "description": "PID 1360 wrote to memory of 1632",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 45
+ }, {
+ "description": "PID 1360 wrote to memory of 1632",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 45
+ }, {
+ "description": "PID 1360 wrote to memory of 1632",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 45
+ }, {
+ "description": "PID 1360 wrote to memory of 1632",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 45
+ }, {
+ "description": "PID 552 wrote to memory of 1744",
+ "pid": 552,
+ "procid": 37,
+ "procid_target": 46
+ }, {
+ "description": "PID 552 wrote to memory of 1744",
+ "pid": 552,
+ "procid": 37,
+ "procid_target": 46
+ }, {
+ "description": "PID 552 wrote to memory of 1744",
+ "pid": 552,
+ "procid": 37,
+ "procid_target": 46
+ }, {
+ "description": "PID 552 wrote to memory of 1744",
+ "pid": 552,
+ "procid": 37,
+ "procid_target": 46
+ }, {
+ "description": "PID 1360 wrote to memory of 1564",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 47
+ }, {
+ "description": "PID 1360 wrote to memory of 1564",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 47
+ }, {
+ "description": "PID 1360 wrote to memory of 1564",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 47
+ }, {
+ "description": "PID 1360 wrote to memory of 1564",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 47
+ }, {
+ "description": "PID 1360 wrote to memory of 1560",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 48
+ }, {
+ "description": "PID 1360 wrote to memory of 1560",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 48
+ }, {
+ "description": "PID 1360 wrote to memory of 1560",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 48
+ }, {
+ "description": "PID 1360 wrote to memory of 1560",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 48
+ }, {
+ "description": "PID 1360 wrote to memory of 1544",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 49
+ }, {
+ "description": "PID 1360 wrote to memory of 1544",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 49
+ }, {
+ "description": "PID 1360 wrote to memory of 1544",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 49
+ }, {
+ "description": "PID 1360 wrote to memory of 1544",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 49
+ }, {
+ "description": "PID 1088 wrote to memory of 1916",
+ "pid": 1088,
+ "procid": 38,
+ "procid_target": 51
+ }, {
+ "description": "PID 1088 wrote to memory of 1916",
+ "pid": 1088,
+ "procid": 38,
+ "procid_target": 51
+ }, {
+ "description": "PID 1088 wrote to memory of 1916",
+ "pid": 1088,
+ "procid": 38,
+ "procid_target": 51
+ }, {
+ "description": "PID 1088 wrote to memory of 1916",
+ "pid": 1088,
+ "procid": 38,
+ "procid_target": 51
+ }, {
+ "description": "PID 532 wrote to memory of 1960",
+ "pid": 532,
+ "procid": 40,
+ "procid_target": 55
+ }, {
+ "description": "PID 532 wrote to memory of 1960",
+ "pid": 532,
+ "procid": 40,
+ "procid_target": 55
+ }, {
+ "description": "PID 532 wrote to memory of 1960",
+ "pid": 532,
+ "procid": 40,
+ "procid_target": 55
+ }, {
+ "description": "PID 532 wrote to memory of 1960",
+ "pid": 532,
+ "procid": 40,
+ "procid_target": 55
+ }, {
+ "description": "PID 1360 wrote to memory of 1928",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 56
+ }, {
+ "description": "PID 1360 wrote to memory of 1928",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 56
+ }, {
+ "description": "PID 1360 wrote to memory of 1928",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 56
+ }, {
+ "description": "PID 1360 wrote to memory of 1928",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 56
+ }, {
+ "description": "PID 1360 wrote to memory of 1676",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 58
+ }, {
+ "description": "PID 1360 wrote to memory of 1676",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 58
+ }, {
+ "description": "PID 1360 wrote to memory of 1676",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 58
+ }, {
+ "description": "PID 1360 wrote to memory of 1676",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 58
+ }, {
+ "description": "PID 1560 wrote to memory of 1208",
+ "pid": 1560,
+ "procid": 48,
+ "procid_target": 59
+ }, {
+ "description": "PID 1560 wrote to memory of 1208",
+ "pid": 1560,
+ "procid": 48,
+ "procid_target": 59
+ }, {
+ "description": "PID 1560 wrote to memory of 1208",
+ "pid": 1560,
+ "procid": 48,
+ "procid_target": 59
+ }, {
+ "description": "PID 1560 wrote to memory of 1208",
+ "pid": 1560,
+ "procid": 48,
+ "procid_target": 59
+ }, {
+ "description": "PID 1564 wrote to memory of 112",
+ "pid": 1564,
+ "procid": 47,
+ "procid_target": 60
+ }, {
+ "description": "PID 1564 wrote to memory of 112",
+ "pid": 1564,
+ "procid": 47,
+ "procid_target": 60
+ }, {
+ "description": "PID 1564 wrote to memory of 112",
+ "pid": 1564,
+ "procid": 47,
+ "procid_target": 60
+ }, {
+ "description": "PID 1564 wrote to memory of 112",
+ "pid": 1564,
+ "procid": 47,
+ "procid_target": 60
+ }, {
+ "description": "PID 1360 wrote to memory of 1064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 62
+ }, {
+ "description": "PID 1360 wrote to memory of 1064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 62
+ }, {
+ "description": "PID 1360 wrote to memory of 1064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 62
+ }, {
+ "description": "PID 1360 wrote to memory of 1064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 62
+ }, {
+ "description": "PID 1928 wrote to memory of 1084",
+ "pid": 1928,
+ "procid": 56,
+ "procid_target": 61
+ }, {
+ "description": "PID 1928 wrote to memory of 1084",
+ "pid": 1928,
+ "procid": 56,
+ "procid_target": 61
+ }, {
+ "description": "PID 1928 wrote to memory of 1084",
+ "pid": 1928,
+ "procid": 56,
+ "procid_target": 61
+ }, {
+ "description": "PID 1928 wrote to memory of 1084",
+ "pid": 1928,
+ "procid": 56,
+ "procid_target": 61
+ }, {
+ "description": "PID 1632 wrote to memory of 1832",
+ "pid": 1632,
+ "procid": 45,
+ "procid_target": 66
+ }, {
+ "description": "PID 1632 wrote to memory of 1832",
+ "pid": 1632,
+ "procid": 45,
+ "procid_target": 66
+ }, {
+ "description": "PID 1632 wrote to memory of 1832",
+ "pid": 1632,
+ "procid": 45,
+ "procid_target": 66
+ }, {
+ "description": "PID 1632 wrote to memory of 1832",
+ "pid": 1632,
+ "procid": 45,
+ "procid_target": 66
+ }, {
+ "description": "PID 1064 wrote to memory of 1052",
+ "pid": 1064,
+ "procid": 62,
+ "procid_target": 68
+ }, {
+ "description": "PID 1064 wrote to memory of 1052",
+ "pid": 1064,
+ "procid": 62,
+ "procid_target": 68
+ }, {
+ "description": "PID 1064 wrote to memory of 1052",
+ "pid": 1064,
+ "procid": 62,
+ "procid_target": 68
+ }, {
+ "description": "PID 1064 wrote to memory of 1052",
+ "pid": 1064,
+ "procid": 62,
+ "procid_target": 68
+ }, {
+ "description": "PID 1544 wrote to memory of 1836",
+ "pid": 1544,
+ "procid": 49,
+ "procid_target": 67
+ }, {
+ "description": "PID 1544 wrote to memory of 1836",
+ "pid": 1544,
+ "procid": 49,
+ "procid_target": 67
+ }, {
+ "description": "PID 1544 wrote to memory of 1836",
+ "pid": 1544,
+ "procid": 49,
+ "procid_target": 67
+ }, {
+ "description": "PID 1544 wrote to memory of 1836",
+ "pid": 1544,
+ "procid": 49,
+ "procid_target": 67
+ }, {
+ "description": "PID 1676 wrote to memory of 1628",
+ "pid": 1676,
+ "procid": 58,
+ "procid_target": 69
+ }, {
+ "description": "PID 1676 wrote to memory of 1628",
+ "pid": 1676,
+ "procid": 58,
+ "procid_target": 69
+ }, {
+ "description": "PID 1676 wrote to memory of 1628",
+ "pid": 1676,
+ "procid": 58,
+ "procid_target": 69
+ }, {
+ "description": "PID 1676 wrote to memory of 1628",
+ "pid": 1676,
+ "procid": 58,
+ "procid_target": 69
+ }, {
+ "description": "PID 1360 wrote to memory of 300",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 65
+ }, {
+ "description": "PID 1360 wrote to memory of 300",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 65
+ }, {
+ "description": "PID 1360 wrote to memory of 300",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 65
+ }, {
+ "description": "PID 1360 wrote to memory of 300",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 65
+ }, {
+ "description": "PID 1360 wrote to memory of 1508",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 70
+ }, {
+ "description": "PID 1360 wrote to memory of 1508",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 70
+ }, {
+ "description": "PID 1360 wrote to memory of 1508",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 70
+ }, {
+ "description": "PID 1360 wrote to memory of 1508",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 70
+ }, {
+ "description": "PID 1360 wrote to memory of 1548",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 72
+ }, {
+ "description": "PID 1360 wrote to memory of 1548",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 72
+ }, {
+ "description": "PID 1360 wrote to memory of 1548",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 72
+ }, {
+ "description": "PID 1360 wrote to memory of 1548",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 72
+ }, {
+ "description": "PID 1360 wrote to memory of 1004",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 74
+ }, {
+ "description": "PID 1360 wrote to memory of 1004",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 74
+ }, {
+ "description": "PID 1360 wrote to memory of 1004",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 74
+ }, {
+ "description": "PID 1360 wrote to memory of 1004",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 74
+ }, {
+ "description": "PID 1360 wrote to memory of 368",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 76
+ }, {
+ "description": "PID 1360 wrote to memory of 368",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 76
+ }, {
+ "description": "PID 1360 wrote to memory of 368",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 76
+ }, {
+ "description": "PID 1360 wrote to memory of 368",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 76
+ }, {
+ "description": "PID 1360 wrote to memory of 1912",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 78
+ }, {
+ "description": "PID 1360 wrote to memory of 1912",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 78
+ }, {
+ "description": "PID 1360 wrote to memory of 1912",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 78
+ }, {
+ "description": "PID 1360 wrote to memory of 1912",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 78
+ }, {
+ "description": "PID 1360 wrote to memory of 896",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 81
+ }, {
+ "description": "PID 1360 wrote to memory of 896",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 81
+ }, {
+ "description": "PID 1360 wrote to memory of 896",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 81
+ }, {
+ "description": "PID 1360 wrote to memory of 896",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 81
+ }, {
+ "description": "PID 1360 wrote to memory of 2044",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 82
+ }, {
+ "description": "PID 1360 wrote to memory of 2044",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 82
+ }, {
+ "description": "PID 1360 wrote to memory of 2044",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 82
+ }, {
+ "description": "PID 1360 wrote to memory of 2044",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 82
+ }, {
+ "description": "PID 1360 wrote to memory of 2064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 83
+ }, {
+ "description": "PID 1360 wrote to memory of 2064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 83
+ }, {
+ "description": "PID 1360 wrote to memory of 2064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 83
+ }, {
+ "description": "PID 1360 wrote to memory of 2064",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 83
+ }, {
+ "description": "PID 1360 wrote to memory of 2088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 85
+ }, {
+ "description": "PID 1360 wrote to memory of 2088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 85
+ }, {
+ "description": "PID 1360 wrote to memory of 2088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 85
+ }, {
+ "description": "PID 1360 wrote to memory of 2088",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 85
+ }, {
+ "description": "PID 1508 wrote to memory of 2096",
+ "pid": 1508,
+ "procid": 70,
+ "procid_target": 86
+ }, {
+ "description": "PID 1508 wrote to memory of 2096",
+ "pid": 1508,
+ "procid": 70,
+ "procid_target": 86
+ }, {
+ "description": "PID 1508 wrote to memory of 2096",
+ "pid": 1508,
+ "procid": 70,
+ "procid_target": 86
+ }, {
+ "description": "PID 1508 wrote to memory of 2096",
+ "pid": 1508,
+ "procid": 70,
+ "procid_target": 86
+ }, {
+ "description": "PID 1360 wrote to memory of 2140",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 90
+ }, {
+ "description": "PID 1360 wrote to memory of 2140",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 90
+ }, {
+ "description": "PID 1360 wrote to memory of 2140",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 90
+ }, {
+ "description": "PID 1360 wrote to memory of 2140",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 90
+ }, {
+ "description": "PID 1360 wrote to memory of 2156",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 91
+ }, {
+ "description": "PID 1360 wrote to memory of 2156",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 91
+ }, {
+ "description": "PID 1360 wrote to memory of 2156",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 91
+ }, {
+ "description": "PID 1360 wrote to memory of 2156",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 91
+ }, {
+ "description": "PID 1548 wrote to memory of 2188",
+ "pid": 1548,
+ "procid": 72,
+ "procid_target": 93
+ }, {
+ "description": "PID 1548 wrote to memory of 2188",
+ "pid": 1548,
+ "procid": 72,
+ "procid_target": 93
+ }, {
+ "description": "PID 1548 wrote to memory of 2188",
+ "pid": 1548,
+ "procid": 72,
+ "procid_target": 93
+ }, {
+ "description": "PID 1548 wrote to memory of 2188",
+ "pid": 1548,
+ "procid": 72,
+ "procid_target": 93
+ }, {
+ "description": "PID 1360 wrote to memory of 2196",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 94
+ }, {
+ "description": "PID 1360 wrote to memory of 2196",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 94
+ }, {
+ "description": "PID 1360 wrote to memory of 2196",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 94
+ }, {
+ "description": "PID 1360 wrote to memory of 2196",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 94
+ }, {
+ "description": "PID 1360 wrote to memory of 2208",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 95
+ }, {
+ "description": "PID 1360 wrote to memory of 2208",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 95
+ }, {
+ "description": "PID 1360 wrote to memory of 2208",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 95
+ }, {
+ "description": "PID 1360 wrote to memory of 2208",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 95
+ }, {
+ "description": "PID 1360 wrote to memory of 2224",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 97
+ }, {
+ "description": "PID 1360 wrote to memory of 2224",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 97
+ }, {
+ "description": "PID 1360 wrote to memory of 2224",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 97
+ }, {
+ "description": "PID 1360 wrote to memory of 2224",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 97
+ }, {
+ "description": "PID 2044 wrote to memory of 2244",
+ "pid": 2044,
+ "procid": 82,
+ "procid_target": 98
+ }, {
+ "description": "PID 2044 wrote to memory of 2244",
+ "pid": 2044,
+ "procid": 82,
+ "procid_target": 98
+ }, {
+ "description": "PID 2044 wrote to memory of 2244",
+ "pid": 2044,
+ "procid": 82,
+ "procid_target": 98
+ }, {
+ "description": "PID 2044 wrote to memory of 2244",
+ "pid": 2044,
+ "procid": 82,
+ "procid_target": 98
+ }, {
+ "description": "PID 300 wrote to memory of 2252",
+ "pid": 300,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 300 wrote to memory of 2252",
+ "pid": 300,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 300 wrote to memory of 2252",
+ "pid": 300,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 300 wrote to memory of 2252",
+ "pid": 300,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 1004 wrote to memory of 2264",
+ "pid": 1004,
+ "procid": 74,
+ "procid_target": 100
+ }, {
+ "description": "PID 1004 wrote to memory of 2264",
+ "pid": 1004,
+ "procid": 74,
+ "procid_target": 100
+ }, {
+ "description": "PID 1004 wrote to memory of 2264",
+ "pid": 1004,
+ "procid": 74,
+ "procid_target": 100
+ }, {
+ "description": "PID 1004 wrote to memory of 2264",
+ "pid": 1004,
+ "procid": 74,
+ "procid_target": 100
+ }, {
+ "description": "PID 1912 wrote to memory of 2288",
+ "pid": 1912,
+ "procid": 78,
+ "procid_target": 101
+ }, {
+ "description": "PID 1912 wrote to memory of 2288",
+ "pid": 1912,
+ "procid": 78,
+ "procid_target": 101
+ }, {
+ "description": "PID 1912 wrote to memory of 2288",
+ "pid": 1912,
+ "procid": 78,
+ "procid_target": 101
+ }, {
+ "description": "PID 1912 wrote to memory of 2288",
+ "pid": 1912,
+ "procid": 78,
+ "procid_target": 101
+ }, {
+ "description": "PID 896 wrote to memory of 2332",
+ "pid": 896,
+ "procid": 81,
+ "procid_target": 104
+ }, {
+ "description": "PID 896 wrote to memory of 2332",
+ "pid": 896,
+ "procid": 81,
+ "procid_target": 104
+ }, {
+ "description": "PID 896 wrote to memory of 2332",
+ "pid": 896,
+ "procid": 81,
+ "procid_target": 104
+ }, {
+ "description": "PID 896 wrote to memory of 2332",
+ "pid": 896,
+ "procid": 81,
+ "procid_target": 104
+ }, {
+ "description": "PID 368 wrote to memory of 2344",
+ "pid": 368,
+ "procid": 76,
+ "procid_target": 105
+ }, {
+ "description": "PID 368 wrote to memory of 2344",
+ "pid": 368,
+ "procid": 76,
+ "procid_target": 105
+ }, {
+ "description": "PID 368 wrote to memory of 2344",
+ "pid": 368,
+ "procid": 76,
+ "procid_target": 105
+ }, {
+ "description": "PID 368 wrote to memory of 2344",
+ "pid": 368,
+ "procid": 76,
+ "procid_target": 105
+ }, {
+ "description": "PID 2064 wrote to memory of 2356",
+ "pid": 2064,
+ "procid": 83,
+ "procid_target": 106
+ }, {
+ "description": "PID 2064 wrote to memory of 2356",
+ "pid": 2064,
+ "procid": 83,
+ "procid_target": 106
+ }, {
+ "description": "PID 2064 wrote to memory of 2356",
+ "pid": 2064,
+ "procid": 83,
+ "procid_target": 106
+ }, {
+ "description": "PID 2064 wrote to memory of 2356",
+ "pid": 2064,
+ "procid": 83,
+ "procid_target": 106
+ }, {
+ "description": "PID 2088 wrote to memory of 2400",
+ "pid": 2088,
+ "procid": 85,
+ "procid_target": 108
+ }, {
+ "description": "PID 2088 wrote to memory of 2400",
+ "pid": 2088,
+ "procid": 85,
+ "procid_target": 108
+ }, {
+ "description": "PID 2088 wrote to memory of 2400",
+ "pid": 2088,
+ "procid": 85,
+ "procid_target": 108
+ }, {
+ "description": "PID 2088 wrote to memory of 2400",
+ "pid": 2088,
+ "procid": 85,
+ "procid_target": 108
+ }, {
+ "description": "PID 2156 wrote to memory of 2424",
+ "pid": 2156,
+ "procid": 91,
+ "procid_target": 110
+ }, {
+ "description": "PID 2156 wrote to memory of 2424",
+ "pid": 2156,
+ "procid": 91,
+ "procid_target": 110
+ }, {
+ "description": "PID 2156 wrote to memory of 2424",
+ "pid": 2156,
+ "procid": 91,
+ "procid_target": 110
+ }, {
+ "description": "PID 2156 wrote to memory of 2424",
+ "pid": 2156,
+ "procid": 91,
+ "procid_target": 110
+ }, {
+ "description": "PID 2140 wrote to memory of 2416",
+ "pid": 2140,
+ "procid": 90,
+ "procid_target": 109
+ }, {
+ "description": "PID 2140 wrote to memory of 2416",
+ "pid": 2140,
+ "procid": 90,
+ "procid_target": 109
+ }, {
+ "description": "PID 2140 wrote to memory of 2416",
+ "pid": 2140,
+ "procid": 90,
+ "procid_target": 109
+ }, {
+ "description": "PID 2140 wrote to memory of 2416",
+ "pid": 2140,
+ "procid": 90,
+ "procid_target": 109
+ }, {
+ "description": "PID 2196 wrote to memory of 2432",
+ "pid": 2196,
+ "procid": 94,
+ "procid_target": 111
+ }, {
+ "description": "PID 2196 wrote to memory of 2432",
+ "pid": 2196,
+ "procid": 94,
+ "procid_target": 111
+ }, {
+ "description": "PID 2196 wrote to memory of 2432",
+ "pid": 2196,
+ "procid": 94,
+ "procid_target": 111
+ }, {
+ "description": "PID 2196 wrote to memory of 2432",
+ "pid": 2196,
+ "procid": 94,
+ "procid_target": 111
+ }, {
+ "description": "PID 1360 wrote to memory of 2272",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 112
+ }, {
+ "description": "PID 1360 wrote to memory of 2272",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 112
+ }, {
+ "description": "PID 1360 wrote to memory of 2272",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 112
+ }, {
+ "description": "PID 1360 wrote to memory of 2272",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 112
+ }, {
+ "description": "PID 1360 wrote to memory of 2448",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 113
+ }, {
+ "description": "PID 1360 wrote to memory of 2448",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 113
+ }, {
+ "description": "PID 1360 wrote to memory of 2448",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 113
+ }, {
+ "description": "PID 1360 wrote to memory of 2448",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 113
+ }, {
+ "description": "PID 1360 wrote to memory of 2468",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 115
+ }, {
+ "description": "PID 1360 wrote to memory of 2468",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 115
+ }, {
+ "description": "PID 1360 wrote to memory of 2468",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 115
+ }, {
+ "description": "PID 1360 wrote to memory of 2468",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 115
+ }, {
+ "description": "PID 1360 wrote to memory of 2492",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 116
+ }, {
+ "description": "PID 1360 wrote to memory of 2492",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 116
+ }, {
+ "description": "PID 1360 wrote to memory of 2492",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 116
+ }, {
+ "description": "PID 1360 wrote to memory of 2492",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 116
+ }, {
+ "description": "PID 1360 wrote to memory of 2500",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 117
+ }, {
+ "description": "PID 1360 wrote to memory of 2500",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 117
+ }, {
+ "description": "PID 1360 wrote to memory of 2500",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 117
+ }, {
+ "description": "PID 1360 wrote to memory of 2500",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 117
+ }, {
+ "description": "PID 1360 wrote to memory of 2536",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 120
+ }, {
+ "description": "PID 1360 wrote to memory of 2536",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 120
+ }, {
+ "description": "PID 1360 wrote to memory of 2536",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 120
+ }, {
+ "description": "PID 1360 wrote to memory of 2536",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 120
+ }, {
+ "description": "PID 1360 wrote to memory of 2572",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 123
+ }, {
+ "description": "PID 1360 wrote to memory of 2572",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 123
+ }, {
+ "description": "PID 1360 wrote to memory of 2572",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 123
+ }, {
+ "description": "PID 1360 wrote to memory of 2572",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 123
+ }, {
+ "description": "PID 1360 wrote to memory of 2596",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 125
+ }, {
+ "description": "PID 1360 wrote to memory of 2596",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 125
+ }, {
+ "description": "PID 1360 wrote to memory of 2596",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 125
+ }, {
+ "description": "PID 1360 wrote to memory of 2596",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 125
+ }, {
+ "description": "PID 1360 wrote to memory of 2608",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 126
+ }, {
+ "description": "PID 1360 wrote to memory of 2608",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 126
+ }, {
+ "description": "PID 1360 wrote to memory of 2608",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 126
+ }, {
+ "description": "PID 1360 wrote to memory of 2608",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 126
+ }, {
+ "description": "PID 1360 wrote to memory of 2636",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 128
+ }, {
+ "description": "PID 1360 wrote to memory of 2636",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 128
+ }, {
+ "description": "PID 1360 wrote to memory of 2636",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 128
+ }, {
+ "description": "PID 1360 wrote to memory of 2636",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 128
+ }, {
+ "description": "PID 1360 wrote to memory of 2668",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 131
+ }, {
+ "description": "PID 1360 wrote to memory of 2668",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 131
+ }, {
+ "description": "PID 1360 wrote to memory of 2668",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 131
+ }, {
+ "description": "PID 1360 wrote to memory of 2668",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 131
+ }, {
+ "description": "PID 2264 wrote to memory of 2792",
+ "pid": 2264,
+ "procid": 100,
+ "procid_target": 134
+ }, {
+ "description": "PID 2264 wrote to memory of 2792",
+ "pid": 2264,
+ "procid": 100,
+ "procid_target": 134
+ }, {
+ "description": "PID 2264 wrote to memory of 2792",
+ "pid": 2264,
+ "procid": 100,
+ "procid_target": 134
+ }, {
+ "description": "PID 2264 wrote to memory of 2792",
+ "pid": 2264,
+ "procid": 100,
+ "procid_target": 134
+ }, {
+ "description": "PID 2668 wrote to memory of 2820",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 135
+ }, {
+ "description": "PID 2668 wrote to memory of 2820",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 135
+ }, {
+ "description": "PID 2668 wrote to memory of 2820",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 135
+ }, {
+ "description": "PID 2668 wrote to memory of 2820",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 135
+ }, {
+ "description": "PID 2636 wrote to memory of 2828",
+ "pid": 2636,
+ "procid": 128,
+ "procid_target": 136
+ }, {
+ "description": "PID 2636 wrote to memory of 2828",
+ "pid": 2636,
+ "procid": 128,
+ "procid_target": 136
+ }, {
+ "description": "PID 2636 wrote to memory of 2828",
+ "pid": 2636,
+ "procid": 128,
+ "procid_target": 136
+ }, {
+ "description": "PID 2636 wrote to memory of 2828",
+ "pid": 2636,
+ "procid": 128,
+ "procid_target": 136
+ }, {
+ "description": "PID 2344 wrote to memory of 2928",
+ "pid": 2344,
+ "procid": 105,
+ "procid_target": 138
+ }, {
+ "description": "PID 2344 wrote to memory of 2928",
+ "pid": 2344,
+ "procid": 105,
+ "procid_target": 138
+ }, {
+ "description": "PID 2344 wrote to memory of 2928",
+ "pid": 2344,
+ "procid": 105,
+ "procid_target": 138
+ }, {
+ "description": "PID 2344 wrote to memory of 2928",
+ "pid": 2344,
+ "procid": 105,
+ "procid_target": 138
+ }, {
+ "description": "PID 2356 wrote to memory of 2976",
+ "pid": 2356,
+ "procid": 106,
+ "procid_target": 139
+ }, {
+ "description": "PID 2356 wrote to memory of 2976",
+ "pid": 2356,
+ "procid": 106,
+ "procid_target": 139
+ }, {
+ "description": "PID 2356 wrote to memory of 2976",
+ "pid": 2356,
+ "procid": 106,
+ "procid_target": 139
+ }, {
+ "description": "PID 2356 wrote to memory of 2976",
+ "pid": 2356,
+ "procid": 106,
+ "procid_target": 139
+ }, {
+ "description": "PID 2416 wrote to memory of 2984",
+ "pid": 2416,
+ "procid": 109,
+ "procid_target": 141
+ }, {
+ "description": "PID 2416 wrote to memory of 2984",
+ "pid": 2416,
+ "procid": 109,
+ "procid_target": 141
+ }, {
+ "description": "PID 2416 wrote to memory of 2984",
+ "pid": 2416,
+ "procid": 109,
+ "procid_target": 141
+ }, {
+ "description": "PID 2416 wrote to memory of 2984",
+ "pid": 2416,
+ "procid": 109,
+ "procid_target": 141
+ }, {
+ "description": "PID 2244 wrote to memory of 2992",
+ "pid": 2244,
+ "procid": 98,
+ "procid_target": 140
+ }, {
+ "description": "PID 2244 wrote to memory of 2992",
+ "pid": 2244,
+ "procid": 98,
+ "procid_target": 140
+ }, {
+ "description": "PID 2244 wrote to memory of 2992",
+ "pid": 2244,
+ "procid": 98,
+ "procid_target": 140
+ }, {
+ "description": "PID 2244 wrote to memory of 2992",
+ "pid": 2244,
+ "procid": 98,
+ "procid_target": 140
+ }, {
+ "description": "PID 2288 wrote to memory of 3000",
+ "pid": 2288,
+ "procid": 101,
+ "procid_target": 142
+ }, {
+ "description": "PID 2288 wrote to memory of 3000",
+ "pid": 2288,
+ "procid": 101,
+ "procid_target": 142
+ }, {
+ "description": "PID 2288 wrote to memory of 3000",
+ "pid": 2288,
+ "procid": 101,
+ "procid_target": 142
+ }, {
+ "description": "PID 2288 wrote to memory of 3000",
+ "pid": 2288,
+ "procid": 101,
+ "procid_target": 142
+ }, {
+ "description": "PID 2432 wrote to memory of 3024",
+ "pid": 2432,
+ "procid": 111,
+ "procid_target": 148
+ }, {
+ "description": "PID 2432 wrote to memory of 3024",
+ "pid": 2432,
+ "procid": 111,
+ "procid_target": 148
+ }, {
+ "description": "PID 2432 wrote to memory of 3024",
+ "pid": 2432,
+ "procid": 111,
+ "procid_target": 148
+ }, {
+ "description": "PID 2432 wrote to memory of 3024",
+ "pid": 2432,
+ "procid": 111,
+ "procid_target": 148
+ }, {
+ "description": "PID 2332 wrote to memory of 3032",
+ "pid": 2332,
+ "procid": 104,
+ "procid_target": 147
+ }, {
+ "description": "PID 2332 wrote to memory of 3032",
+ "pid": 2332,
+ "procid": 104,
+ "procid_target": 147
+ }, {
+ "description": "PID 2332 wrote to memory of 3032",
+ "pid": 2332,
+ "procid": 104,
+ "procid_target": 147
+ }, {
+ "description": "PID 2332 wrote to memory of 3032",
+ "pid": 2332,
+ "procid": 104,
+ "procid_target": 147
+ }, {
+ "description": "PID 2668 wrote to memory of 3048",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 151
+ }, {
+ "description": "PID 2668 wrote to memory of 3048",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 151
+ }, {
+ "description": "PID 2668 wrote to memory of 3048",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 151
+ }, {
+ "description": "PID 2668 wrote to memory of 3048",
+ "pid": 2668,
+ "procid": 131,
+ "procid_target": 151
+ }, {
+ "description": "PID 2424 wrote to memory of 3040",
+ "pid": 2424,
+ "procid": 110,
+ "procid_target": 150
+ }, {
+ "description": "PID 2424 wrote to memory of 3040",
+ "pid": 2424,
+ "procid": 110,
+ "procid_target": 150
+ }, {
+ "description": "PID 2424 wrote to memory of 3040",
+ "pid": 2424,
+ "procid": 110,
+ "procid_target": 150
+ }, {
+ "description": "PID 2424 wrote to memory of 3040",
+ "pid": 2424,
+ "procid": 110,
+ "procid_target": 150
+ }, {
+ "description": "PID 2208 wrote to memory of 2880",
+ "pid": 2208,
+ "procid": 95,
+ "procid_target": 153
+ }, {
+ "description": "PID 2208 wrote to memory of 2880",
+ "pid": 2208,
+ "procid": 95,
+ "procid_target": 153
+ }, {
+ "description": "PID 2208 wrote to memory of 2880",
+ "pid": 2208,
+ "procid": 95,
+ "procid_target": 153
+ }, {
+ "description": "PID 2208 wrote to memory of 2880",
+ "pid": 2208,
+ "procid": 95,
+ "procid_target": 153
+ }, {
+ "description": "PID 2224 wrote to memory of 2688",
+ "pid": 2224,
+ "procid": 97,
+ "procid_target": 137
+ }, {
+ "description": "PID 2224 wrote to memory of 2688",
+ "pid": 2224,
+ "procid": 97,
+ "procid_target": 137
+ }, {
+ "description": "PID 2224 wrote to memory of 2688",
+ "pid": 2224,
+ "procid": 97,
+ "procid_target": 137
+ }, {
+ "description": "PID 2224 wrote to memory of 2688",
+ "pid": 2224,
+ "procid": 97,
+ "procid_target": 137
+ }, {
+ "description": "PID 2492 wrote to memory of 2860",
+ "pid": 2492,
+ "procid": 116,
+ "procid_target": 144
+ }, {
+ "description": "PID 2492 wrote to memory of 2860",
+ "pid": 2492,
+ "procid": 116,
+ "procid_target": 144
+ }, {
+ "description": "PID 2492 wrote to memory of 2860",
+ "pid": 2492,
+ "procid": 116,
+ "procid_target": 144
+ }, {
+ "description": "PID 2492 wrote to memory of 2860",
+ "pid": 2492,
+ "procid": 116,
+ "procid_target": 144
+ }, {
+ "description": "PID 2188 wrote to memory of 3016",
+ "pid": 2188,
+ "procid": 93,
+ "procid_target": 149
+ }, {
+ "description": "PID 2188 wrote to memory of 3016",
+ "pid": 2188,
+ "procid": 93,
+ "procid_target": 149
+ }, {
+ "description": "PID 2188 wrote to memory of 3016",
+ "pid": 2188,
+ "procid": 93,
+ "procid_target": 149
+ }, {
+ "description": "PID 2188 wrote to memory of 3016",
+ "pid": 2188,
+ "procid": 93,
+ "procid_target": 149
+ }, {
+ "description": "PID 2448 wrote to memory of 2904",
+ "pid": 2448,
+ "procid": 113,
+ "procid_target": 145
+ }, {
+ "description": "PID 2448 wrote to memory of 2904",
+ "pid": 2448,
+ "procid": 113,
+ "procid_target": 145
+ }, {
+ "description": "PID 2448 wrote to memory of 2904",
+ "pid": 2448,
+ "procid": 113,
+ "procid_target": 145
+ }, {
+ "description": "PID 2448 wrote to memory of 2904",
+ "pid": 2448,
+ "procid": 113,
+ "procid_target": 145
+ }, {
+ "description": "PID 2500 wrote to memory of 2896",
+ "pid": 2500,
+ "procid": 117,
+ "procid_target": 146
+ }, {
+ "description": "PID 2500 wrote to memory of 2896",
+ "pid": 2500,
+ "procid": 117,
+ "procid_target": 146
+ }, {
+ "description": "PID 2500 wrote to memory of 2896",
+ "pid": 2500,
+ "procid": 117,
+ "procid_target": 146
+ }, {
+ "description": "PID 2500 wrote to memory of 2896",
+ "pid": 2500,
+ "procid": 117,
+ "procid_target": 146
+ }, {
+ "description": "PID 2272 wrote to memory of 2888",
+ "pid": 2272,
+ "procid": 112,
+ "procid_target": 152
+ }, {
+ "description": "PID 2272 wrote to memory of 2888",
+ "pid": 2272,
+ "procid": 112,
+ "procid_target": 152
+ }, {
+ "description": "PID 2272 wrote to memory of 2888",
+ "pid": 2272,
+ "procid": 112,
+ "procid_target": 152
+ }, {
+ "description": "PID 2272 wrote to memory of 2888",
+ "pid": 2272,
+ "procid": 112,
+ "procid_target": 152
+ }, {
+ "description": "PID 2536 wrote to memory of 2920",
+ "pid": 2536,
+ "procid": 120,
+ "procid_target": 156
+ }, {
+ "description": "PID 2536 wrote to memory of 2920",
+ "pid": 2536,
+ "procid": 120,
+ "procid_target": 156
+ }, {
+ "description": "PID 2536 wrote to memory of 2920",
+ "pid": 2536,
+ "procid": 120,
+ "procid_target": 156
+ }, {
+ "description": "PID 2536 wrote to memory of 2920",
+ "pid": 2536,
+ "procid": 120,
+ "procid_target": 156
+ }, {
+ "description": "PID 2596 wrote to memory of 2952",
+ "pid": 2596,
+ "procid": 125,
+ "procid_target": 155
+ }, {
+ "description": "PID 2596 wrote to memory of 2952",
+ "pid": 2596,
+ "procid": 125,
+ "procid_target": 155
+ }, {
+ "description": "PID 2596 wrote to memory of 2952",
+ "pid": 2596,
+ "procid": 125,
+ "procid_target": 155
+ }, {
+ "description": "PID 2596 wrote to memory of 2952",
+ "pid": 2596,
+ "procid": 125,
+ "procid_target": 155
+ }, {
+ "description": "PID 2468 wrote to memory of 2912",
+ "pid": 2468,
+ "procid": 115,
+ "procid_target": 143
+ }, {
+ "description": "PID 2468 wrote to memory of 2912",
+ "pid": 2468,
+ "procid": 115,
+ "procid_target": 143
+ }, {
+ "description": "PID 2468 wrote to memory of 2912",
+ "pid": 2468,
+ "procid": 115,
+ "procid_target": 143
+ }, {
+ "description": "PID 2468 wrote to memory of 2912",
+ "pid": 2468,
+ "procid": 115,
+ "procid_target": 143
+ }, {
+ "description": "PID 2952 wrote to memory of 2204",
+ "pid": 2952,
+ "procid": 155,
+ "procid_target": 164
+ }, {
+ "description": "PID 2952 wrote to memory of 2204",
+ "pid": 2952,
+ "procid": 155,
+ "procid_target": 164
+ }, {
+ "description": "PID 2952 wrote to memory of 2204",
+ "pid": 2952,
+ "procid": 155,
+ "procid_target": 164
+ }, {
+ "description": "PID 2952 wrote to memory of 2204",
+ "pid": 2952,
+ "procid": 155,
+ "procid_target": 164
+ }, {
+ "description": "PID 2920 wrote to memory of 2420",
+ "pid": 2920,
+ "procid": 156,
+ "procid_target": 163
+ }, {
+ "description": "PID 2920 wrote to memory of 2420",
+ "pid": 2920,
+ "procid": 156,
+ "procid_target": 163
+ }, {
+ "description": "PID 2920 wrote to memory of 2420",
+ "pid": 2920,
+ "procid": 156,
+ "procid_target": 163
+ }, {
+ "description": "PID 2920 wrote to memory of 2420",
+ "pid": 2920,
+ "procid": 156,
+ "procid_target": 163
+ }, {
+ "description": "PID 2912 wrote to memory of 2792",
+ "pid": 2912,
+ "procid": 143,
+ "procid_target": 162
+ }, {
+ "description": "PID 2912 wrote to memory of 2792",
+ "pid": 2912,
+ "procid": 143,
+ "procid_target": 162
+ }, {
+ "description": "PID 2912 wrote to memory of 2792",
+ "pid": 2912,
+ "procid": 143,
+ "procid_target": 162
+ }, {
+ "description": "PID 2912 wrote to memory of 2792",
+ "pid": 2912,
+ "procid": 143,
+ "procid_target": 162
+ }, {
+ "description": "PID 2572 wrote to memory of 2936",
+ "pid": 2572,
+ "procid": 123,
+ "procid_target": 154
+ }, {
+ "description": "PID 2572 wrote to memory of 2936",
+ "pid": 2572,
+ "procid": 123,
+ "procid_target": 154
+ }, {
+ "description": "PID 2572 wrote to memory of 2936",
+ "pid": 2572,
+ "procid": 123,
+ "procid_target": 154
+ }, {
+ "description": "PID 2572 wrote to memory of 2936",
+ "pid": 2572,
+ "procid": 123,
+ "procid_target": 154
+ }, {
+ "description": "PID 2608 wrote to memory of 2968",
+ "pid": 2608,
+ "procid": 126,
+ "procid_target": 157
+ }, {
+ "description": "PID 2608 wrote to memory of 2968",
+ "pid": 2608,
+ "procid": 126,
+ "procid_target": 157
+ }, {
+ "description": "PID 2608 wrote to memory of 2968",
+ "pid": 2608,
+ "procid": 126,
+ "procid_target": 157
+ }, {
+ "description": "PID 2608 wrote to memory of 2968",
+ "pid": 2608,
+ "procid": 126,
+ "procid_target": 157
+ }, {
+ "description": "PID 2888 wrote to memory of 2984",
+ "pid": 2888,
+ "procid": 152,
+ "procid_target": 165
+ }, {
+ "description": "PID 2888 wrote to memory of 2984",
+ "pid": 2888,
+ "procid": 152,
+ "procid_target": 165
+ }, {
+ "description": "PID 2888 wrote to memory of 2984",
+ "pid": 2888,
+ "procid": 152,
+ "procid_target": 165
+ }, {
+ "description": "PID 2888 wrote to memory of 2984",
+ "pid": 2888,
+ "procid": 152,
+ "procid_target": 165
+ }, {
+ "description": "PID 2400 wrote to memory of 3056",
+ "pid": 2400,
+ "procid": 108,
+ "procid_target": 158
+ }, {
+ "description": "PID 2400 wrote to memory of 3056",
+ "pid": 2400,
+ "procid": 108,
+ "procid_target": 158
+ }, {
+ "description": "PID 2400 wrote to memory of 3056",
+ "pid": 2400,
+ "procid": 108,
+ "procid_target": 158
+ }, {
+ "description": "PID 2400 wrote to memory of 3056",
+ "pid": 2400,
+ "procid": 108,
+ "procid_target": 158
+ }, {
+ "description": "PID 2896 wrote to memory of 2280",
+ "pid": 2896,
+ "procid": 146,
+ "procid_target": 166
+ }, {
+ "description": "PID 2896 wrote to memory of 2280",
+ "pid": 2896,
+ "procid": 146,
+ "procid_target": 166
+ }, {
+ "description": "PID 2896 wrote to memory of 2280",
+ "pid": 2896,
+ "procid": 146,
+ "procid_target": 166
+ }, {
+ "description": "PID 2896 wrote to memory of 2280",
+ "pid": 2896,
+ "procid": 146,
+ "procid_target": 166
+ }, {
+ "description": "PID 2880 wrote to memory of 2332",
+ "pid": 2880,
+ "procid": 153,
+ "procid_target": 160
+ }, {
+ "description": "PID 2880 wrote to memory of 2332",
+ "pid": 2880,
+ "procid": 153,
+ "procid_target": 160
+ }, {
+ "description": "PID 2880 wrote to memory of 2332",
+ "pid": 2880,
+ "procid": 153,
+ "procid_target": 160
+ }, {
+ "description": "PID 2880 wrote to memory of 2332",
+ "pid": 2880,
+ "procid": 153,
+ "procid_target": 160
+ }, {
+ "description": "PID 2688 wrote to memory of 2180",
+ "pid": 2688,
+ "procid": 137,
+ "procid_target": 161
+ }, {
+ "description": "PID 2688 wrote to memory of 2180",
+ "pid": 2688,
+ "procid": 137,
+ "procid_target": 161
+ }, {
+ "description": "PID 2688 wrote to memory of 2180",
+ "pid": 2688,
+ "procid": 137,
+ "procid_target": 161
+ }, {
+ "description": "PID 2688 wrote to memory of 2180",
+ "pid": 2688,
+ "procid": 137,
+ "procid_target": 161
+ }, {
+ "description": "PID 2860 wrote to memory of 2360",
+ "pid": 2860,
+ "procid": 144,
+ "procid_target": 167
+ }, {
+ "description": "PID 2860 wrote to memory of 2360",
+ "pid": 2860,
+ "procid": 144,
+ "procid_target": 167
+ }, {
+ "description": "PID 2860 wrote to memory of 2360",
+ "pid": 2860,
+ "procid": 144,
+ "procid_target": 167
+ }, {
+ "description": "PID 2860 wrote to memory of 2360",
+ "pid": 2860,
+ "procid": 144,
+ "procid_target": 167
+ }, {
+ "description": "PID 2904 wrote to memory of 780",
+ "pid": 2904,
+ "procid": 145,
+ "procid_target": 168
+ }, {
+ "description": "PID 2904 wrote to memory of 780",
+ "pid": 2904,
+ "procid": 145,
+ "procid_target": 168
+ }, {
+ "description": "PID 2904 wrote to memory of 780",
+ "pid": 2904,
+ "procid": 145,
+ "procid_target": 168
+ }, {
+ "description": "PID 2904 wrote to memory of 780",
+ "pid": 2904,
+ "procid": 145,
+ "procid_target": 168
+ }, {
+ "description": "PID 2968 wrote to memory of 2432",
+ "pid": 2968,
+ "procid": 157,
+ "procid_target": 170
+ }, {
+ "description": "PID 2968 wrote to memory of 2432",
+ "pid": 2968,
+ "procid": 157,
+ "procid_target": 170
+ }, {
+ "description": "PID 2968 wrote to memory of 2432",
+ "pid": 2968,
+ "procid": 157,
+ "procid_target": 170
+ }, {
+ "description": "PID 2968 wrote to memory of 2432",
+ "pid": 2968,
+ "procid": 157,
+ "procid_target": 170
+ }, {
+ "description": "PID 2936 wrote to memory of 3000",
+ "pid": 2936,
+ "procid": 154,
+ "procid_target": 169
+ }, {
+ "description": "PID 2936 wrote to memory of 3000",
+ "pid": 2936,
+ "procid": 154,
+ "procid_target": 169
+ }, {
+ "description": "PID 2936 wrote to memory of 3000",
+ "pid": 2936,
+ "procid": 154,
+ "procid_target": 169
+ }, {
+ "description": "PID 2936 wrote to memory of 3000",
+ "pid": 2936,
+ "procid": 154,
+ "procid_target": 169
+ }, {
+ "description": "PID 1360 wrote to memory of 2920",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 173
+ }, {
+ "description": "PID 1360 wrote to memory of 2920",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 173
+ }, {
+ "description": "PID 1360 wrote to memory of 2920",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 173
+ }, {
+ "description": "PID 1360 wrote to memory of 2920",
+ "pid": 1360,
+ "procid": 23,
+ "procid_target": 173
+ }, {
+ "description": "PID 2920 wrote to memory of 2280",
+ "pid": 2920,
+ "procid": 173,
+ "procid_target": 175
+ }, {
+ "description": "PID 2920 wrote to memory of 2280",
+ "pid": 2920,
+ "procid": 173,
+ "procid_target": 175
+ }, {
+ "description": "PID 2920 wrote to memory of 2280",
+ "pid": 2920,
+ "procid": 173,
+ "procid_target": 175
+ }, {
+ "description": "PID 2920 wrote to memory of 2280",
+ "pid": 2920,
+ "procid": 173,
+ "procid_target": 175
+ }]
+ }, {
+ "name": "Suspicious behavior: EnumeratesProcesses",
+ "indicators": [{
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }, {
+ "pid": 1360,
+ "procid": 23
+ }]
+ }, {
+ "label": "vssadmin_shadows_general",
+ "name": "Interacts with shadow copies",
+ "ttp": ["T1107", "T1490"],
+ "tags": ["ransomware"],
+ "indicators": [{
+ "pid": 1612,
+ "procid": 28
+ }, {
+ "pid": 1020,
+ "procid": 29
+ }, {
+ "pid": 2820,
+ "procid": 135
+ }],
+ "desc": "Shadow copies are often targeted by ransomware to inhibit system recovery."
+ }, {
+ "label": "external_ip_lookup",
+ "name": "Looks up external IP address via web service",
+ "score": 6,
+ "indicators": [{
+ "ioc": "api.db-ip.com",
+ "flow": 7
+ }],
+ "desc": "Uses a legitimate IP lookup service to find the infected system's external IP."
+ }, {
+ "name": "Modifies service",
+ "score": 5,
+ "ttp": ["T1112", "T1031"],
+ "tags": ["persistence"],
+ "indicators": [{
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\Registry Writer",
+ "description": "Key created",
+ "procid": 30
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\COM+ REGDB Writer",
+ "description": "Key created",
+ "procid": 30
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\ASR Writer",
+ "description": "Key created",
+ "procid": 30
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\Shadow Copy Optimization Writer",
+ "description": "Key created",
+ "procid": 30
+ }]
+ }, {
+ "label": "net_generic",
+ "name": "Runs net.exe"
+ }, {
+ "label": "deletes_shadows",
+ "name": "Deletes shadow copies",
+ "score": 9,
+ "ttp": ["T1107", "T1490"],
+ "tags": ["ransomware"],
+ "desc": "Ransomware often targets backup files to inhibit system recovery."
+ }, {
+ "label": "nemty",
+ "name": "Nemty",
+ "score": 10,
+ "tags": ["ransomware", "family:nemty"],
+ "desc": "Ransomware discovered in late 2019 which has been actively developed/updated over time."
+ }, {
+ "name": "Suspicious use of AdjustPrivilegeToken",
+ "indicators": [{
+ "description": "Token: SeBackupPrivilege",
+ "pid": 1028,
+ "procid": 30
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 1028,
+ "procid": 30
+ }, {
+ "description": "Token: SeAuditPrivilege",
+ "pid": 1028,
+ "procid": 30
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1744,
+ "procid": 46
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1832,
+ "procid": 66
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 112,
+ "procid": 60
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1592,
+ "procid": 43
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1084,
+ "procid": 61
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1604,
+ "procid": 44
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1916,
+ "procid": 51
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1052,
+ "procid": 68
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1960,
+ "procid": 55
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1208,
+ "procid": 59
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 2252,
+ "procid": 99
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1628,
+ "procid": 69
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 1836,
+ "procid": 67
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 2096,
+ "procid": 86
+ }, {
+ "description": "Token: SeIncreaseQuotaPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSecurityPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeTakeOwnershipPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeLoadDriverPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemProfilePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemtimePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeProfSingleProcessPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeIncBasePriorityPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeCreatePagefilePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeBackupPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeShutdownPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemEnvironmentPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeRemoteShutdownPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeUndockPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeManageVolumePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 33",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 34",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 35",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeIncreaseQuotaPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSecurityPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeTakeOwnershipPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeLoadDriverPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemProfilePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemtimePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeProfSingleProcessPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeIncBasePriorityPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeCreatePagefilePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeBackupPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeShutdownPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeSystemEnvironmentPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeRemoteShutdownPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeUndockPrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: SeManageVolumePrivilege",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 33",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 34",
+ "pid": 3048,
+ "procid": 151
+ }, {
+ "description": "Token: 35",
+ "pid": 3048,
+ "procid": 151
+ }]
+ }, {
+ "label": "taskkill_kill_process",
+ "name": "Kills process with taskkill",
+ "tags": ["evasion"],
+ "indicators": [{
+ "pid": 1628,
+ "procid": 69
+ }, {
+ "pid": 1604,
+ "procid": 44
+ }, {
+ "pid": 112,
+ "procid": 60
+ }, {
+ "pid": 1832,
+ "procid": 66
+ }, {
+ "pid": 1052,
+ "procid": 68
+ }, {
+ "pid": 2252,
+ "procid": 99
+ }, {
+ "pid": 1592,
+ "procid": 43
+ }, {
+ "pid": 1744,
+ "procid": 46
+ }, {
+ "pid": 1916,
+ "procid": 51
+ }, {
+ "pid": 1960,
+ "procid": 55
+ }, {
+ "pid": 1084,
+ "procid": 61
+ }, {
+ "pid": 1836,
+ "procid": 67
+ }, {
+ "pid": 1208,
+ "procid": 59
+ }, {
+ "pid": 2096,
+ "procid": 86
+ }]
+ }, {
+ "label": "schtasks_persist",
+ "name": "Creates scheduled task(s)",
+ "ttp": ["T1053"],
+ "tags": ["persistence"],
+ "indicators": [{
+ "pid": 2828,
+ "procid": 136
+ }],
+ "desc": "Schtasks is often used by malware for persistence or to perform post-infection execution."
+ }, {
+ "label": "susp_dom_as_c2",
+ "name": "Legitimate hosting services abused for malware hosting/C2",
+ "score": 6,
+ "ttp": ["T1102"]
+ }],
+ "network": {
+ "flows": [{
+ "id": 1,
+ "src": "10.7.0.10:50053",
+ "dst": "224.0.0.252:5355",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "last_seen": 95,
+ "tx_bytes": 100,
+ "tx_packets": 2
+ }, {
+ "id": 2,
+ "src": "10.7.0.10:137",
+ "dst": "10.7.0.255:137",
+ "proto": "udp",
+ "first_seen": 298,
+ "last_seen": 1826,
+ "tx_bytes": 234,
+ "tx_packets": 3,
+ "protocols": ["netbios-ns"]
+ }, {
+ "id": 3,
+ "src": "10.7.0.10:60030",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 461,
+ "last_seen": 472,
+ "rx_bytes": 113,
+ "rx_packets": 1,
+ "tx_bytes": 66,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "www.myexternalip.com"
+ }, {
+ "id": 4,
+ "src": "10.7.0.10:57887",
+ "dst": "216.58.208.115:443",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 568,
+ "last_seen": 15747,
+ "rx_bytes": 3663,
+ "rx_packets": 9,
+ "tx_bytes": 878,
+ "tx_packets": 9,
+ "protocols": ["tls", "http"],
+ "domain": "www.myexternalip.com",
+ "tls_ja3": "2a458dd9c65afbcf591cd8c2a194b804",
+ "tls_sni": "www.myexternalip.com"
+ }, {
+ "id": 5,
+ "src": "10.7.0.10:61224",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 1022,
+ "last_seen": 1028,
+ "rx_bytes": 110,
+ "rx_packets": 1,
+ "tx_bytes": 59,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "ocsp.pki.goog"
+ }, {
+ "id": 6,
+ "src": "10.7.0.10:57888",
+ "dst": "172.217.17.131:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 1030,
+ "last_seen": 15747,
+ "rx_bytes": 1583,
+ "rx_packets": 4,
+ "tx_bytes": 742,
+ "tx_packets": 6,
+ "protocols": ["http"],
+ "domain": "ocsp.pki.goog"
+ }, {
+ "id": 7,
+ "src": "10.7.0.10:54178",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 1342,
+ "last_seen": 1348,
+ "rx_bytes": 107,
+ "rx_packets": 1,
+ "tx_bytes": 59,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "api.db-ip.com"
+ }, {
+ "id": 8,
+ "src": "10.7.0.10:57889",
+ "dst": "104.26.5.15:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 1349,
+ "last_seen": 15747,
+ "rx_bytes": 758,
+ "rx_packets": 4,
+ "tx_bytes": 346,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "api.db-ip.com"
+ }, {
+ "id": 9,
+ "src": "10.7.0.10:64129",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 4025,
+ "last_seen": 4026,
+ "rx_bytes": 74,
+ "rx_packets": 1,
+ "tx_bytes": 58,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "iplogger.org"
+ }, {
+ "id": 10,
+ "src": "10.7.0.10:57890",
+ "dst": "88.99.66.31:443",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 4027,
+ "last_seen": 15747,
+ "rx_bytes": 5342,
+ "rx_packets": 9,
+ "tx_bytes": 860,
+ "tx_packets": 9,
+ "protocols": ["tls", "http"],
+ "domain": "iplogger.org",
+ "tls_ja3": "2a458dd9c65afbcf591cd8c2a194b804",
+ "tls_sni": "iplogger.org"
+ }, {
+ "id": 11,
+ "src": "10.7.0.10:57662",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 4199,
+ "last_seen": 4201,
+ "rx_bytes": 111,
+ "rx_packets": 1,
+ "tx_bytes": 64,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "apps.identrust.com"
+ }, {
+ "id": 12,
+ "src": "10.7.0.10:57891",
+ "dst": "192.35.177.64:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 4203,
+ "last_seen": 15747,
+ "rx_bytes": 1540,
+ "rx_packets": 3,
+ "tx_bytes": 369,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "apps.identrust.com"
+ }, {
+ "id": 13,
+ "src": "10.7.0.10:65088",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 4607,
+ "last_seen": 4629,
+ "rx_bytes": 285,
+ "rx_packets": 1,
+ "tx_bytes": 76,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "www.download.windowsupdate.com"
+ }, {
+ "id": 14,
+ "src": "10.7.0.10:57892",
+ "dst": "72.21.81.240:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 4632,
+ "last_seen": 15747,
+ "rx_bytes": 60469,
+ "rx_packets": 43,
+ "tx_bytes": 1543,
+ "tx_packets": 27,
+ "protocols": ["http"],
+ "domain": "www.download.windowsupdate.com"
+ }, {
+ "id": 15,
+ "src": "10.7.0.10:62123",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 5294,
+ "last_seen": 5307,
+ "rx_bytes": 199,
+ "rx_packets": 1,
+ "tx_bytes": 77,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "isrg.trustid.ocsp.identrust.com"
+ }, {
+ "id": 16,
+ "src": "10.7.0.10:57893",
+ "dst": "95.100.96.193:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 5309,
+ "last_seen": 15747,
+ "rx_bytes": 1969,
+ "rx_packets": 4,
+ "tx_bytes": 477,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "isrg.trustid.ocsp.identrust.com"
+ }, {
+ "id": 17,
+ "src": "10.7.0.10:55311",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 5338,
+ "last_seen": 5355,
+ "rx_bytes": 191,
+ "rx_packets": 1,
+ "tx_bytes": 73,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "ocsp.int-x3.letsencrypt.org"
+ }, {
+ "id": 18,
+ "src": "10.7.0.10:57894",
+ "dst": "95.100.96.226:80",
+ "proto": "tcp",
+ "pid": 1360,
+ "procid": 23,
+ "first_seen": 5357,
+ "last_seen": 15748,
+ "rx_bytes": 1998,
+ "rx_packets": 4,
+ "tx_bytes": 489,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "ocsp.int-x3.letsencrypt.org"
+ }, {
+ "id": 19,
+ "src": "10.7.0.10:55314",
+ "dst": "239.255.255.250:1900",
+ "proto": "udp",
+ "pid": 2500,
+ "procid": 176,
+ "first_seen": 26782,
+ "last_seen": 33125,
+ "tx_bytes": 966,
+ "tx_packets": 6
+ }, {
+ "id": 20,
+ "src": "127.0.0.1:55315",
+ "dst": "239.255.255.250:1900",
+ "proto": "udp",
+ "pid": 2500,
+ "procid": 176
+ }, {
+ "id": 21,
+ "src": "10.7.0.10:64123",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 31296,
+ "last_seen": 31315,
+ "rx_bytes": 146,
+ "rx_packets": 1,
+ "tx_bytes": 62,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "crl.verisign.com"
+ }, {
+ "id": 22,
+ "src": "10.7.0.10:57897",
+ "dst": "72.21.91.29:80",
+ "proto": "tcp",
+ "pid": 276,
+ "procid": 16,
+ "first_seen": 31318,
+ "last_seen": 92972,
+ "rx_bytes": 445,
+ "rx_packets": 4,
+ "tx_bytes": 465,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "crl.verisign.com"
+ }],
+ "requests": [{
+ "flow": 3,
+ "index": 1,
+ "dns_request": {
+ "domains": ["www.myexternalip.com"],
+ "questions": [{
+ "name": "www.myexternalip.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 3,
+ "index": 1,
+ "dns_response": {
+ "domains": ["www.myexternalip.com", "ghs.googlehosted.com"],
+ "ip": ["216.58.208.115"],
+ "answers": [{
+ "name": "www.myexternalip.com",
+ "type": "IN CNAME",
+ "value": "ghs.googlehosted.com"
+ }, {
+ "name": "ghs.googlehosted.com",
+ "type": "IN A",
+ "value": "216.58.208.115"
+ }]
+ }
+ }, {
+ "flow": 4,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "https://www.myexternalip.com/raw",
+ "request": "GET /raw HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: www.myexternalip.com", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 4,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Mon, 15 Jun 2020 10:04:19 GMT", "Content-Type: text/html; charset=utf-8", "Content-Length: 12", "Access-Control-Allow-Origin: *", "Via: 1.1 google"]
+ }
+ }, {
+ "flow": 5,
+ "index": 1,
+ "dns_request": {
+ "domains": ["ocsp.pki.goog"],
+ "questions": [{
+ "name": "ocsp.pki.goog",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 5,
+ "index": 1,
+ "dns_response": {
+ "domains": ["ocsp.pki.goog", "pki-goog.l.google.com"],
+ "ip": ["172.217.17.131"],
+ "answers": [{
+ "name": "ocsp.pki.goog",
+ "type": "IN CNAME",
+ "value": "pki-goog.l.google.com"
+ }, {
+ "name": "pki-goog.l.google.com",
+ "type": "IN A",
+ "value": "172.217.17.131"
+ }]
+ }
+ }, {
+ "flow": 6,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJ13zfQMBhkWtuM%3D",
+ "request": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJ13zfQMBhkWtuM%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: ocsp.pki.goog"]
+ }
+ }, {
+ "flow": 6,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Content-Type: application/ocsp-response", "Date: Sun, 14 Jun 2020 11:55:27 GMT", "Server: ocsp_responder", "Content-Length: 468", "X-XSS-Protection: 0", "X-Frame-Options: SAMEORIGIN", "Cache-Control: public, max-age=86400", "Age: 79731"]
+ }
+ }, {
+ "flow": 6,
+ "index": 2,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.pki.goog/gts1d2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT4YwNSyUnwC88de5a5l4eUO%2BLQewQUsd0yXei3N3LSzlzOJv5HeeIBCOkCEF0AC6SVi%2FG%2BCgAAAAAwZ%2B8%3D",
+ "request": "GET /gts1d2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT4YwNSyUnwC88de5a5l4eUO%2BLQewQUsd0yXei3N3LSzlzOJv5HeeIBCOkCEF0AC6SVi%2FG%2BCgAAAAAwZ%2B8%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: ocsp.pki.goog"]
+ }
+ }, {
+ "flow": 6,
+ "index": 2,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Content-Type: application/ocsp-response", "Date: Mon, 15 Jun 2020 10:04:18 GMT", "Cache-Control: public, max-age=86400", "Server: ocsp_responder", "Content-Length: 471", "X-XSS-Protection: 0", "X-Frame-Options: SAMEORIGIN"]
+ }
+ }, {
+ "flow": 7,
+ "index": 1,
+ "dns_request": {
+ "domains": ["api.db-ip.com"],
+ "questions": [{
+ "name": "api.db-ip.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 7,
+ "index": 1,
+ "dns_response": {
+ "domains": ["api.db-ip.com", "api.db-ip.com", "api.db-ip.com"],
+ "ip": ["104.26.5.15", "104.26.4.15", "172.67.75.166"],
+ "answers": [{
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "104.26.5.15"
+ }, {
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "104.26.4.15"
+ }, {
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "172.67.75.166"
+ }]
+ }
+ }, {
+ "flow": 8,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://api.db-ip.com/v2/free/154.61.71.13/countryName",
+ "request": "GET /v2/free/154.61.71.13/countryName HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: api.db-ip.com", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 8,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Mon, 15 Jun 2020 10:04:19 GMT", "Content-Type: text/plain;charset=UTF-8", "Transfer-Encoding: chunked", "Connection: keep-alive", "Set-Cookie: __cfduid=d936f56c1ed5c74f99c0464c64e4d25651592215459; expires=Wed, 15-Jul-20 10:04:19 GMT; path=/; domain=.db-ip.com; HttpOnly; SameSite=Lax", "Vary: Accept-Encoding", "Access-Control-Allow-Origin: *", "Cache-control: max-age=1800", "X-IPLB-Instance: 37097", "CF-Cache-Status: MISS", "cf-request-id: 035908ed9100009beb52ab5200000001", "Server: cloudflare", "CF-RAY: 5a3b775c181e9beb-AMS", "alt-svc: h3-27=\":443\"; ma=86400"]
+ }
+ }, {
+ "flow": 9,
+ "index": 1,
+ "dns_request": {
+ "domains": ["iplogger.org"],
+ "questions": [{
+ "name": "iplogger.org",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 9,
+ "index": 1,
+ "dns_response": {
+ "domains": ["iplogger.org"],
+ "ip": ["88.99.66.31"],
+ "answers": [{
+ "name": "iplogger.org",
+ "type": "IN A",
+ "value": "88.99.66.31"
+ }]
+ }
+ }, {
+ "flow": 10,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "https://iplogger.org/1fRVq7",
+ "request": "GET /1fRVq7 HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: iplogger.org", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 10,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: nginx", "Date: Mon, 15 Jun 2020 10:04:23 GMT", "Content-Type: image/png", "Transfer-Encoding: chunked", "Connection: keep-alive", "Set-Cookie: PHPSESSID=172h0tkbrafclde5s3dkv897m7; path=/; HttpOnly", "Pragma: no-cache", "Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/", "Cache-Control: no-cache", "Expires: Thu, 01 Jan 1970 00:00:01 GMT", "Answers: ", "whoami: 1abf194eae8e9b03cd43be9ab4dedfad5cf6ae513e3c5e5c1333aabd48454073", "Strict-Transport-Security: max-age=31536000; preload", "X-Frame-Options: DENY"]
+ }
+ }, {
+ "flow": 11,
+ "index": 1,
+ "dns_request": {
+ "domains": ["apps.identrust.com"],
+ "questions": [{
+ "name": "apps.identrust.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 11,
+ "index": 1,
+ "dns_response": {
+ "domains": ["apps.identrust.com", "apps.digsigtrust.com"],
+ "ip": ["192.35.177.64"],
+ "answers": [{
+ "name": "apps.identrust.com",
+ "type": "IN CNAME",
+ "value": "apps.digsigtrust.com"
+ }, {
+ "name": "apps.digsigtrust.com",
+ "type": "IN A",
+ "value": "192.35.177.64"
+ }]
+ }
+ }, {
+ "flow": 12,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://apps.identrust.com/roots/dstrootcax3.p7c",
+ "request": "GET /roots/dstrootcax3.p7c HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: apps.identrust.com"]
+ }
+ }, {
+ "flow": 12,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Sun, 14 Jun 2020 16:24:31 GMT", "Server: Apache", "X-XSS-Protection: 1; mode=block", "Strict-Transport-Security: max-age=15768000", "X-Frame-Options: SAMEORIGIN", "X-Content-Type-Options: nosniff", "Content-Security-Policy: default-src 'self' *.identrust.com", "Cache-control: max-age=86400", "Last-Modified: Thu, 13 Feb 2020 15:25:43 GMT", "ETag: \"37d-59e76b3c64bc0\"", "Accept-Ranges: bytes", "Content-Length: 893", "X-Content-Type-Options: nosniff", "X-Frame-Options: sameorigin", "Content-Type: application/pkcs7-mime"]
+ }
+ }, {
+ "flow": 13,
+ "index": 1,
+ "dns_request": {
+ "domains": ["www.download.windowsupdate.com"],
+ "questions": [{
+ "name": "www.download.windowsupdate.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 13,
+ "index": 1,
+ "dns_response": {
+ "domains": ["www.download.windowsupdate.com", "2-01-3cf7-0009.cdx.cedexis.net", "wu.azureedge.net", "wu.ec.azureedge.net", "wu.wpc.apr-52dd2.edgecastdns.net", "hlb.apr-52dd2-0.edgecastdns.net", "cs11.wpc.v0cdn.net"],
+ "ip": ["72.21.81.240"],
+ "answers": [{
+ "name": "www.download.windowsupdate.com",
+ "type": "IN CNAME",
+ "value": "2-01-3cf7-0009.cdx.cedexis.net"
+ }, {
+ "name": "2-01-3cf7-0009.cdx.cedexis.net",
+ "type": "IN CNAME",
+ "value": "wu.azureedge.net"
+ }, {
+ "name": "wu.azureedge.net",
+ "type": "IN CNAME",
+ "value": "wu.ec.azureedge.net"
+ }, {
+ "name": "wu.ec.azureedge.net",
+ "type": "IN CNAME",
+ "value": "wu.wpc.apr-52dd2.edgecastdns.net"
+ }, {
+ "name": "wu.wpc.apr-52dd2.edgecastdns.net",
+ "type": "IN CNAME",
+ "value": "hlb.apr-52dd2-0.edgecastdns.net"
+ }, {
+ "name": "hlb.apr-52dd2-0.edgecastdns.net",
+ "type": "IN CNAME",
+ "value": "cs11.wpc.v0cdn.net"
+ }, {
+ "name": "cs11.wpc.v0cdn.net",
+ "type": "IN A",
+ "value": "72.21.81.240"
+ }]
+ }
+ }, {
+ "flow": 14,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab",
+ "request": "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1",
+ "headers": ["Cache-Control: max-age = 3600", "Connection: Keep-Alive", "Accept: */*", "If-Modified-Since: Tue, 21 Apr 2020 00:50:26 GMT", "If-None-Match: \"03582d87617d61:0\"", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: www.download.windowsupdate.com"]
+ }
+ }, {
+ "flow": 14,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Accept-Ranges: bytes", "Age: 1814", "Cache-Control: public,max-age=3600", "Content-Type: application/vnd.ms-cab-compressed", "Date: Mon, 15 Jun 2020 10:04:22 GMT", "Etag: \"0597791bc2cd61:0\"", "Last-Modified: Mon, 18 May 2020 02:32:26 GMT", "Server: ECAcc (bsa/EB75)", "X-Cache: HIT", "X-CCC: US", "X-CID: 11", "X-Powered-By: ASP.NET", "Content-Length: 58383"]
+ }
+ }, {
+ "flow": 15,
+ "index": 1,
+ "dns_request": {
+ "domains": ["isrg.trustid.ocsp.identrust.com"],
+ "questions": [{
+ "name": "isrg.trustid.ocsp.identrust.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 15,
+ "index": 1,
+ "dns_response": {
+ "domains": ["isrg.trustid.ocsp.identrust.com", "isrg.trustid.ocsp.identrust.com.edgesuite.net", "a279.dscq.akamai.net", "a279.dscq.akamai.net"],
+ "ip": ["95.100.96.193", "95.100.96.201"],
+ "answers": [{
+ "name": "isrg.trustid.ocsp.identrust.com",
+ "type": "IN CNAME",
+ "value": "isrg.trustid.ocsp.identrust.com.edgesuite.net"
+ }, {
+ "name": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
+ "type": "IN CNAME",
+ "value": "a279.dscq.akamai.net"
+ }, {
+ "name": "a279.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.193"
+ }, {
+ "name": "a279.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.201"
+ }]
+ }
+ }, {
+ "flow": 16,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
+ "request": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: isrg.trustid.ocsp.identrust.com"]
+ }
+ }, {
+ "flow": 16,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: Apache", "Content-transfer-encoding: Binary", "Last-Modified: Sat, 13 Jun 2020 23:51:10 GMT", "ETag: \"f71e2c741c6399bbdfdd29e3294bfca186fed14c\"", "Content-Type: application/ocsp-response", "Content-Length: 1398", "Cache-Control: public, no-transform, must-revalidate, max-age=34597", "Expires: Mon, 15 Jun 2020 19:41:00 GMT", "Date: Mon, 15 Jun 2020 10:04:23 GMT", "Connection: keep-alive"]
+ }
+ }, {
+ "flow": 17,
+ "index": 1,
+ "dns_request": {
+ "domains": ["ocsp.int-x3.letsencrypt.org"],
+ "questions": [{
+ "name": "ocsp.int-x3.letsencrypt.org",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 17,
+ "index": 1,
+ "dns_response": {
+ "domains": ["ocsp.int-x3.letsencrypt.org", "ocsp.int-x3.letsencrypt.org.edgesuite.net", "a771.dscq.akamai.net", "a771.dscq.akamai.net"],
+ "ip": ["95.100.96.226", "95.100.96.232"],
+ "answers": [{
+ "name": "ocsp.int-x3.letsencrypt.org",
+ "type": "IN CNAME",
+ "value": "ocsp.int-x3.letsencrypt.org.edgesuite.net"
+ }, {
+ "name": "ocsp.int-x3.letsencrypt.org.edgesuite.net",
+ "type": "IN CNAME",
+ "value": "a771.dscq.akamai.net"
+ }, {
+ "name": "a771.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.226"
+ }, {
+ "name": "a771.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.232"
+ }]
+ }
+ }, {
+ "flow": 18,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgQZw6LS9Be0oZi5BYcrjz8A4w%3D%3D",
+ "request": "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgQZw6LS9Be0oZi5BYcrjz8A4w%3D%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: ocsp.int-x3.letsencrypt.org"]
+ }
+ }, {
+ "flow": 18,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: nginx", "Content-Type: application/ocsp-response", "Content-Length: 527", "ETag: \"ADACA9354566434F0931FB5330579C8748ED3D9B7396315A84E3C22FEBA11311\"", "Last-Modified: Sat, 13 Jun 2020 22:00:00 UTC", "Cache-Control: public, no-transform, must-revalidate, max-age=24389", "Expires: Mon, 15 Jun 2020 16:50:52 GMT", "Date: Mon, 15 Jun 2020 10:04:23 GMT", "Connection: keep-alive"]
+ }
+ }, {
+ "flow": 21,
+ "index": 1,
+ "dns_request": {
+ "domains": ["crl.verisign.com"],
+ "questions": [{
+ "name": "crl.verisign.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 21,
+ "index": 1,
+ "dns_response": {
+ "domains": ["crl.verisign.com", "crl-symcprod.digicert.com", "cs9.wac.phicdn.net"],
+ "ip": ["72.21.91.29"],
+ "answers": [{
+ "name": "crl.verisign.com",
+ "type": "IN CNAME",
+ "value": "crl-symcprod.digicert.com"
+ }, {
+ "name": "crl-symcprod.digicert.com",
+ "type": "IN CNAME",
+ "value": "cs9.wac.phicdn.net"
+ }, {
+ "name": "cs9.wac.phicdn.net",
+ "type": "IN A",
+ "value": "72.21.91.29"
+ }]
+ }
+ }, {
+ "flow": 22,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://crl.verisign.com/pca3.crl",
+ "request": "GET /pca3.crl HTTP/1.1",
+ "headers": ["Cache-Control: max-age = 172800", "Connection: Keep-Alive", "Accept: */*", "If-Modified-Since: Thu, 19 Mar 2020 12:57:21 GMT", "If-None-Match: \"867220127\"", "User-Agent: Microsoft-CryptoAPI/6.1", "Host: crl.verisign.com"]
+ }
+ }, {
+ "flow": 22,
+ "index": 1,
+ "http_response": {
+ "status": "304",
+ "response": "HTTP/1.1 304 Not Modified",
+ "headers": ["Accept-Ranges: bytes", "Age: 9184", "Cache-Control: max-age=172800", "Date: Mon, 15 Jun 2020 10:04:49 GMT", "Etag: \"867220127\"", "Expires: Wed, 17 Jun 2020 10:04:49 GMT", "Last-Modified: Thu, 19 Mar 2020 12:57:21 GMT", "Server: ECS (bsa/EB23)", "X-Cache: HIT"]
+ }
+ }]
+ },
+ "dumped": [{
+ "at": 2870,
+ "pid": 1360,
+ "procid": 23,
+ "name": "memory/1360-0-0x00000000006BD000-0x00000000006BE000-memory.dmp",
+ "kind": "region",
+ "addr": 7065600,
+ "length": 4096
+ }, {
+ "at": 2870,
+ "pid": 1360,
+ "procid": 23,
+ "name": "memory/1360-1-0x0000000001EC0000-0x0000000001ED1000-memory.dmp",
+ "kind": "region",
+ "addr": 32243712,
+ "length": 69632
+ }, {
+ "at": 21278,
+ "pid": 2280,
+ "procid": 175,
+ "path": "C:\\Users\\Admin\\NEMTY_XHNNB1O-DECRYPT.txt",
+ "name": "files/0x00030000000131b8-5.dat",
+ "kind": "martian"
+ }],
+ "extracted": [{
+ "path": "C:\\NEMTY_XHNNB1O-DECRYPT.txt",
+ "ransom_note": {
+ "emails": ["elzmflqxj@tutanota.de", "helpdesk_nemty@aol.com"],
+ "note": "---\u003e NEMTY REVENGE 2.0 \u003c---\r\n\r\nDon't worry, some of your files have extension .NEMTY_XHNNB1O and they are encrypted.\r\nBut you can return them!\r\n\r\nIn confirmatiom, that we have private decryption key,\r\nWe can provide test decryption for 1 file (png,jpg,bmp,gif).\r\nIt's a business, if we can't provide full decryption, other people won't trust us.\r\n\r\nThere is no way to decrypt your files without our help.\r\nDon't trust anyone. Even your dog.\r\n\r\nmain mail: elzmflqxj@tutanota.de\r\nif no answer: helpdesk_nemty@aol.com\r\n\r\nDon't change decryption key below!!!\r\n\r\nNEMTY DECRYPTION KEY:\r\n\r\nYX8eGH0jauC7vNbMYSzhGLvHNZrO2PLxRmyhwZW4XlaeR/9sgerqpm2Xuu3d8VRvplcBO2QI3uUlPFiicoJgiA6LjdqrgKDJ8rBYdY+aPc1JMdTUagQNYrNWXJNsjMjvEIwCx44wZS5wil+VubnY9IDFqLM1Uk4aPfydCfpeAXvK3+hcCddhkKpZ47sujMNShuX+PmUf482a/s1uQTmvoESvLzdSQlnksgfW0jhpor+FnoJvrApjvU21Bw+kul38s2gf03ih60ihqToVTswXVf2/oL7S8wmEogdYbhm1Kta/QaZ+qJsMZtYOz6jFUm8mwWtZm4AEIjv+gM/aRu/t4WiVdLPrVFnsUQ8fd4omSjv4I+jfxBr1uxrpsJe419Fx3PIxwvIIBP889Fu0sPdwZ5dMxl39knbgZzUv4LQffhwakDD8/U03vkc7rcLKusgjlDhGlRvA9cyN+2SuJYhmp968LwLdN1wjUfPkXRsIkJAZy7NOiE5uwjDOQRrTcsp3BdBA5pPkI4FkBSzRjCPN2MS1MoU7TfPSVvDOIvYg5C0nj3mpVXE5zqTcRaUsgPdwGKJ7Cb1kRFut9vreJ9GWF79+njXUphcGJzlGoIfwFFzsH0aHwG9n9EF9vg6xSNCUib1ZwRd2IyljdWOWTgTsqYhOVz75Nulfv8aiWvZMsmLav4TxVXCmCj+Jz+llZZiztagWEwpETvRFqFClz5NLc2VagStuHhT39FFwm8uczyHel51IpQClLOS038d/tCdUswQoVVyh7BygHEu/zJ7bV1m0/aTLHodWrqGSLajny9WrHiJZhdfjkmQ8FMlca1WzbuaMoG70SQSp8mRyuB2lmQB2nG0V5SfKYtdbJOiWXbSbvZwks2HTp7djmAWfw0EYpLRDhI95OV1HZA1TO/vglnHNalwNbuzwn6069hiMOz5C+dxrl/6LEbktXx3UG53zjpM1nmvIll8G/xQCa9+yuU7SlFjm/Nack0iacJd2KL2T33PEJq15q6PQdkVCRrX4+KacmuyK3t+tTGYffpKvNjVtD3ANRwzfJwciXNEQQXipzLxylSlOpHabTsKedL1N1Z26gWUvvTCHBWTaNkivk+P78WJ1lNvT30/WC3VTZgarmvsfgeT6SfB8oID5AtVhbNYyR/kTK5WBypuOQvjLUdMPXf84NIhiMy9Bwfoq4KvFkjMdvaFiwGaLURo6ECsBt6RBpfk12CEtoEQKT05no7RP5P8Azcph0dzcTRgnsRdqUPVeWJoGEw3w25RFvw+3TxZ3iZU/0KKXrEsWVn7x6pEemoCFVZnUR95MFD4g/92KNglNywcaAY7kAEcqlpWThqwCKI2Nr5cFJgla1clDtg==JKP3CWDjLuyMf3dvw2VizsSCEdMhnxjjnYXlETT79e7TpJ5cQckFo1hwNgiRdCuoQb0FkgyDvnjy8QSdfel0gsXFoXKKncDAF9TZX3UTNhw79DwwRE35L7a4JpRvEbgDDzohJE55gjvSNZ+b3utb8z+PdUdr1GPhSaIKcMcQaNgPcxz8+YlLRs72uqKJCreCtoRW2QgTbKlKSzg+RDBkbRtoM53VI1u7q/nIQ7nrdPLAAeYDZAqSg0xxUXZZJqhoD2ch39RGUAZHpDMb53vFQGqObUt62Uwt4ykRrYXsOJZGnaSWz9XY/fHGiOIXb85ad+eNNWjdBs40x14VACwBXqUoFJ6AtvQGdkEiVLjQNXwqLAYcnTpOzc/5KHM/t/j0j9j6pwu1CWeRdUNVOK+9FZwXDr19bH/cucJiGJcppkdnpyPJZYBYTgP4507Sgk3K3dE3shCcL4t9wDvXunp0Q76QNw2KFRt0b6A7dvbwjka6dgeL1NVaH8jBWBQUqZaKZGxJQ6Fy/SrhLmyLR2fYPaqKvfHADNNtq5M69B3zkkliM0eq1VHX9t9Kf5KD/tBRD6AqkizQYEQMobyCOMFZrxC5rrIJDMknlQixXGTrGj8TPZoOsrrsRS5WjgpKFyXd7NqB+ol/2bDqs+WOqCdO2hq425glisxDhan5gXdjIXl6wy4IEIBCswelN0C90rx/MgVPpR/EXvHupg5xoaBMKWqJBZWegiVD1mnwomT207BCLyLi12dPp6b2tAdWMkjNIiAKySmPJgFx5AIsgF/RKcIaSH4Vj/sQgqS6Qi0xJ9oeJhKCLUGe8EshQ90dPO9uf3RliJ/M3+Y4sn1LBmnYZp54Wo0ZM9LnQOu4H22Av4otMpkLGKKUwy3Z/PkwqVa81+ONv4lRW3sSrFHZi05tCFWFvxgivImYjSl9Vjwt7nNIdEUyF0WOwsP6sdH0BseCrEHhyYsOWQSjE2LHn8L8gpIVlCXYI02j5Y5Kdj+NtvU00mT6S0ysov9eqzNVAwq3uodp13OxaiNvvX0bWP9oOXeCVSKkZcHTA+V/3Z4hbiaZBAXOPgdEWsufBkHvMYrdt044C8nph11/hUP9cdJlSRIdl0ouxxfo2u845WWUf0VQgBFT2wgnit+2UzX9QQMytnwrnmYB6lx7oap7soUPhfrRNxsBxeymPXjXafjB+ATTpcdO30ExUeJjTecG6qUiK/yPVSzSMkKcijpd121dKqfQvjJXsMPHLAM/+qodxpu7KkwyNXDv0vUfA814ioVBbmpHGBnNPlCcghw9ZXoUq9zSspXPYERfXc6QGjh0tAHW17Rm6Irt4edyMRywRhOi9UVDspClBfDEPCQZN7hPQw=="
+ }
+ }]
+}
\ No newline at end of file
diff --git a/tests/resources/triage_behavioral2.json b/tests/resources/triage_behavioral2.json
new file mode 100644
index 0000000..487a742
--- /dev/null
+++ b/tests/resources/triage_behavioral2.json
@@ -0,0 +1,11248 @@
+{
+ "version": "0.2.1",
+ "sample": {
+ "id": "200615-8jbndpgg9n",
+ "score": 10,
+ "submitted": "2020-06-15T10:04:02Z",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "size": 210944,
+ "md5": "880585ebbd4a96a065d689b0ee4d6f30",
+ "sha1": "e70c69be9cb6cb0497445b8bd7fe76c08844752e",
+ "sha256": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "sha512": "4ce2bb8c6bd49465eb97a1b4e93e19c01906e63bcc526fa5072db9124faf62de86c87f02d7a17b27b59a3e77eb108302a72de6ccf43c59558e0d4adc8eab93c0",
+ "static_tags": ["windows", "x86"]
+ },
+ "task": {
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "size": 210944,
+ "md5": "880585ebbd4a96a065d689b0ee4d6f30",
+ "sha1": "e70c69be9cb6cb0497445b8bd7fe76c08844752e",
+ "sha256": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "sha512": "4ce2bb8c6bd49465eb97a1b4e93e19c01906e63bcc526fa5072db9124faf62de86c87f02d7a17b27b59a3e77eb108302a72de6ccf43c59558e0d4adc8eab93c0",
+ "static_tags": ["windows", "x86"]
+ },
+ "analysis": {
+ "score": 10,
+ "tags": ["ransomware", "family:nemty", "persistence"],
+ "ttp": ["T1107", "T1490", "T1112", "T1031", "T1053", "T1102"],
+ "features": ["analog"],
+ "submitted": "2020-06-15T10:04:02Z",
+ "reported": "2020-06-15T10:06:38Z",
+ "max_time_network": 150881,
+ "max_time_kernel": 149047,
+ "backend": "horse2",
+ "resource": "win10v200430",
+ "platform": "windows10_x64"
+ },
+ "processes": [{
+ "procid": 65,
+ "procid_parent": 56,
+ "pid": 3812,
+ "ppid": 3000,
+ "cmd": "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe\"",
+ "image": "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "orig": false,
+ "started": 266,
+ "terminated": 61125
+ }, {
+ "procid": 68,
+ "procid_parent": 65,
+ "pid": 1504,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 27672,
+ "terminated": 28203
+ }, {
+ "procid": 69,
+ "procid_parent": 65,
+ "pid": 1556,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 27688,
+ "terminated": 28203
+ }, {
+ "procid": 72,
+ "procid_parent": 68,
+ "pid": 1604,
+ "ppid": 1504,
+ "cmd": "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 27844,
+ "terminated": 28203
+ }, {
+ "procid": 73,
+ "procid_parent": 69,
+ "pid": 1940,
+ "ppid": 1556,
+ "cmd": "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=unbounded",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 27844,
+ "terminated": 28203
+ }, {
+ "procid": 74,
+ "procid_parent": 6,
+ "pid": 2084,
+ "ppid": 624,
+ "cmd": "C:\\Windows\\system32\\vssvc.exe",
+ "image": "C:\\Windows\\system32\\vssvc.exe",
+ "orig": true,
+ "started": 28000
+ }, {
+ "procid": 76,
+ "procid_parent": 65,
+ "pid": 3440,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im sql.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30000,
+ "terminated": 34750
+ }, {
+ "procid": 77,
+ "procid_parent": 65,
+ "pid": 3672,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im winword.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30016,
+ "terminated": 34750
+ }, {
+ "procid": 78,
+ "procid_parent": 65,
+ "pid": 3788,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im wordpad.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30032,
+ "terminated": 34750
+ }, {
+ "procid": 79,
+ "procid_parent": 65,
+ "pid": 3852,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im outlook.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30032,
+ "terminated": 34750
+ }, {
+ "procid": 83,
+ "procid_parent": 65,
+ "pid": 4080,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im thunderbird.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30063,
+ "terminated": 34750
+ }, {
+ "procid": 85,
+ "procid_parent": 65,
+ "pid": 1016,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im oracle.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30063,
+ "terminated": 34735
+ }, {
+ "procid": 88,
+ "procid_parent": 65,
+ "pid": 4004,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im excel.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30094,
+ "terminated": 34766
+ }, {
+ "procid": 89,
+ "procid_parent": 65,
+ "pid": 3500,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im onenote.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30110,
+ "terminated": 34735
+ }, {
+ "procid": 90,
+ "procid_parent": 65,
+ "pid": 3300,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im virtualboxvm.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30110,
+ "terminated": 34750
+ }, {
+ "procid": 91,
+ "procid_parent": 65,
+ "pid": 3580,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im node.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30125,
+ "terminated": 34735
+ }, {
+ "procid": 93,
+ "procid_parent": 65,
+ "pid": 3172,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im QBW32.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30141,
+ "terminated": 34750
+ }, {
+ "procid": 96,
+ "procid_parent": 65,
+ "pid": 740,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im WBGX.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30141,
+ "terminated": 34750
+ }, {
+ "procid": 98,
+ "procid_parent": 65,
+ "pid": 2984,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im Teams.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30157,
+ "terminated": 34735
+ }, {
+ "procid": 99,
+ "procid_parent": 65,
+ "pid": 2996,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /f /im Flow.*",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30157,
+ "terminated": 34735
+ }, {
+ "procid": 100,
+ "procid_parent": 65,
+ "pid": 3020,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30172,
+ "terminated": 33985
+ }, {
+ "procid": 101,
+ "procid_parent": 65,
+ "pid": 3532,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30172,
+ "terminated": 33985
+ }, {
+ "procid": 102,
+ "procid_parent": 65,
+ "pid": 1840,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30188,
+ "terminated": 34063
+ }, {
+ "procid": 104,
+ "procid_parent": 65,
+ "pid": 3844,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30188,
+ "terminated": 34094
+ }, {
+ "procid": 105,
+ "procid_parent": 65,
+ "pid": 3076,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30203,
+ "terminated": 33985
+ }, {
+ "procid": 106,
+ "procid_parent": 65,
+ "pid": 2132,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30203,
+ "terminated": 33953
+ }, {
+ "procid": 108,
+ "procid_parent": 65,
+ "pid": 3720,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30219,
+ "terminated": 33969
+ }, {
+ "procid": 110,
+ "procid_parent": 65,
+ "pid": 2228,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30219,
+ "terminated": 34000
+ }, {
+ "procid": 112,
+ "procid_parent": 65,
+ "pid": 3660,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30235,
+ "terminated": 33985
+ }, {
+ "procid": 113,
+ "procid_parent": 65,
+ "pid": 2988,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30235,
+ "terminated": 33953
+ }, {
+ "procid": 114,
+ "procid_parent": 65,
+ "pid": 3776,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30250,
+ "terminated": 33969
+ }, {
+ "procid": 115,
+ "procid_parent": 65,
+ "pid": 3784,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30250,
+ "terminated": 33953
+ }, {
+ "procid": 116,
+ "procid_parent": 65,
+ "pid": 3836,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30250,
+ "terminated": 33953
+ }, {
+ "procid": 118,
+ "procid_parent": 65,
+ "pid": 1312,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30266,
+ "terminated": 34000
+ }, {
+ "procid": 119,
+ "procid_parent": 65,
+ "pid": 1360,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30266,
+ "terminated": 34094
+ }, {
+ "procid": 120,
+ "procid_parent": 65,
+ "pid": 1596,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30282,
+ "terminated": 33985
+ }, {
+ "procid": 121,
+ "procid_parent": 65,
+ "pid": 2416,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30282,
+ "terminated": 32078
+ }, {
+ "procid": 122,
+ "procid_parent": 65,
+ "pid": 2080,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30297,
+ "terminated": 32032
+ }, {
+ "procid": 123,
+ "procid_parent": 65,
+ "pid": 1616,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30297,
+ "terminated": 32047
+ }, {
+ "procid": 125,
+ "procid_parent": 65,
+ "pid": 1528,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30313,
+ "terminated": 32078
+ }, {
+ "procid": 127,
+ "procid_parent": 65,
+ "pid": 1568,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30344,
+ "terminated": 32047
+ }, {
+ "procid": 128,
+ "procid_parent": 65,
+ "pid": 1820,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c net stop ",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30344,
+ "terminated": 32078
+ }, {
+ "procid": 131,
+ "procid_parent": 65,
+ "pid": 1804,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c schtasks.exe /create /sc onstart /tn \"NEMTY_2ELOZ2T\" /tr \"C:\\Users\\Admin\\AdobeUpdate.exe\"",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30360,
+ "terminated": 32594
+ }, {
+ "procid": 134,
+ "procid_parent": 65,
+ "pid": 996,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin.exe delete shadows /all /quiet \u0026 bcdedit /set {default} bootstatuspolicy ignoreallfailures \u0026 bcdedit /set {default} recoveryenabled no \u0026 wbadmin delete catalog -quiet \u0026 wmic shadowcopy delete",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 30375,
+ "terminated": 34547
+ }, {
+ "procid": 152,
+ "procid_parent": 120,
+ "pid": 4856,
+ "ppid": 1596,
+ "cmd": "net stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31344,
+ "terminated": 33875
+ }, {
+ "procid": 153,
+ "procid_parent": 134,
+ "pid": 4864,
+ "ppid": 996,
+ "cmd": "vssadmin.exe delete shadows /all /quiet ",
+ "image": "C:\\Windows\\SysWOW64\\vssadmin.exe",
+ "orig": true,
+ "started": 31344,
+ "terminated": 32157
+ }, {
+ "procid": 154,
+ "procid_parent": 78,
+ "pid": 4872,
+ "ppid": 3788,
+ "cmd": "taskkill /f /im wordpad.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31344,
+ "terminated": 34719
+ }, {
+ "procid": 155,
+ "procid_parent": 85,
+ "pid": 4880,
+ "ppid": 1016,
+ "cmd": "taskkill /f /im oracle.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31344,
+ "terminated": 34703
+ }, {
+ "procid": 156,
+ "procid_parent": 83,
+ "pid": 4888,
+ "ppid": 4080,
+ "cmd": "taskkill /f /im thunderbird.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31344,
+ "terminated": 34719
+ }, {
+ "procid": 157,
+ "procid_parent": 76,
+ "pid": 4896,
+ "ppid": 3440,
+ "cmd": "taskkill /f /im sql.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34719
+ }, {
+ "procid": 158,
+ "procid_parent": 89,
+ "pid": 4904,
+ "ppid": 3500,
+ "cmd": "taskkill /f /im onenote.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34703
+ }, {
+ "procid": 159,
+ "procid_parent": 88,
+ "pid": 4912,
+ "ppid": 4004,
+ "cmd": "taskkill /f /im excel.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34719
+ }, {
+ "procid": 160,
+ "procid_parent": 112,
+ "pid": 4920,
+ "ppid": 3660,
+ "cmd": "net stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 33891
+ }, {
+ "procid": 161,
+ "procid_parent": 91,
+ "pid": 4928,
+ "ppid": 3580,
+ "cmd": "taskkill /f /im node.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34703
+ }, {
+ "procid": 162,
+ "procid_parent": 100,
+ "pid": 4936,
+ "ppid": 3020,
+ "cmd": "net stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 33875
+ }, {
+ "procid": 163,
+ "procid_parent": 79,
+ "pid": 4944,
+ "ppid": 3852,
+ "cmd": "taskkill /f /im outlook.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34719
+ }, {
+ "procid": 164,
+ "procid_parent": 77,
+ "pid": 4952,
+ "ppid": 3672,
+ "cmd": "taskkill /f /im winword.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31360,
+ "terminated": 34719
+ }, {
+ "procid": 165,
+ "procid_parent": 98,
+ "pid": 4968,
+ "ppid": 2984,
+ "cmd": "taskkill /f /im Teams.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31391,
+ "terminated": 34703
+ }, {
+ "procid": 166,
+ "procid_parent": 90,
+ "pid": 4976,
+ "ppid": 3300,
+ "cmd": "taskkill /f /im virtualboxvm.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31391,
+ "terminated": 34719
+ }, {
+ "procid": 167,
+ "procid_parent": 113,
+ "pid": 4996,
+ "ppid": 2988,
+ "cmd": "net stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31407,
+ "terminated": 33860
+ }, {
+ "procid": 168,
+ "procid_parent": 99,
+ "pid": 5012,
+ "ppid": 2996,
+ "cmd": "taskkill /f /im Flow.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31422,
+ "terminated": 34703
+ }, {
+ "procid": 169,
+ "procid_parent": 108,
+ "pid": 5032,
+ "ppid": 3720,
+ "cmd": "net stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31422,
+ "terminated": 33860
+ }, {
+ "procid": 170,
+ "procid_parent": 116,
+ "pid": 5048,
+ "ppid": 3836,
+ "cmd": "net stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31438,
+ "terminated": 33875
+ }, {
+ "procid": 171,
+ "procid_parent": 114,
+ "pid": 5072,
+ "ppid": 3776,
+ "cmd": "net stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31453,
+ "terminated": 33875
+ }, {
+ "procid": 172,
+ "procid_parent": 93,
+ "pid": 5084,
+ "ppid": 3172,
+ "cmd": "taskkill /f /im QBW32.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31453,
+ "terminated": 34719
+ }, {
+ "procid": 173,
+ "procid_parent": 96,
+ "pid": 5092,
+ "ppid": 740,
+ "cmd": "taskkill /f /im WBGX.*",
+ "image": "C:\\Windows\\SysWOW64\\taskkill.exe",
+ "orig": true,
+ "started": 31453,
+ "terminated": 34719
+ }, {
+ "procid": 174,
+ "procid_parent": 110,
+ "pid": 1556,
+ "ppid": 2228,
+ "cmd": "net stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31485,
+ "terminated": 33891
+ }, {
+ "procid": 175,
+ "procid_parent": 118,
+ "pid": 2196,
+ "ppid": 1312,
+ "cmd": "net stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31563,
+ "terminated": 33891
+ }, {
+ "procid": 176,
+ "procid_parent": 160,
+ "pid": 4144,
+ "ppid": 4920,
+ "cmd": "C:\\Windows\\system32\\net1 stop MSSQLServerADHelper100",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31578,
+ "terminated": 33860
+ }, {
+ "procid": 177,
+ "procid_parent": 152,
+ "pid": 4632,
+ "ppid": 4856,
+ "cmd": "C:\\Windows\\system32\\net1 stop QBVSS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31657,
+ "terminated": 33844
+ }, {
+ "procid": 178,
+ "procid_parent": 102,
+ "pid": 2256,
+ "ppid": 1840,
+ "cmd": "net stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31657,
+ "terminated": 33922
+ }, {
+ "procid": 179,
+ "procid_parent": 162,
+ "pid": 5136,
+ "ppid": 4936,
+ "cmd": "C:\\Windows\\system32\\net1 stop DbxSvc",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31688,
+ "terminated": 33844
+ }, {
+ "procid": 180,
+ "procid_parent": 115,
+ "pid": 5156,
+ "ppid": 3784,
+ "cmd": "net stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31703,
+ "terminated": 33875
+ }, {
+ "procid": 181,
+ "procid_parent": 127,
+ "pid": 5164,
+ "ppid": 1568,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31719,
+ "terminated": 32016
+ }, {
+ "procid": 182,
+ "procid_parent": 125,
+ "pid": 5176,
+ "ppid": 1528,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31719,
+ "terminated": 32032
+ }, {
+ "procid": 183,
+ "procid_parent": 167,
+ "pid": 5192,
+ "ppid": 4996,
+ "cmd": "C:\\Windows\\system32\\net1 stop MongoDB",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31719,
+ "terminated": 33828
+ }, {
+ "procid": 184,
+ "procid_parent": 106,
+ "pid": 5200,
+ "ppid": 2132,
+ "cmd": "net stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31719,
+ "terminated": 33860
+ }, {
+ "procid": 185,
+ "procid_parent": 101,
+ "pid": 5208,
+ "ppid": 3532,
+ "cmd": "net stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31735,
+ "terminated": 33875
+ }, {
+ "procid": 186,
+ "procid_parent": 105,
+ "pid": 5228,
+ "ppid": 3076,
+ "cmd": "net stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31735,
+ "terminated": 33875
+ }, {
+ "procid": 187,
+ "procid_parent": 128,
+ "pid": 5232,
+ "ppid": 1820,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31735,
+ "terminated": 32032
+ }, {
+ "procid": 188,
+ "procid_parent": 121,
+ "pid": 5244,
+ "ppid": 2416,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31735,
+ "terminated": 32032
+ }, {
+ "procid": 189,
+ "procid_parent": 131,
+ "pid": 5260,
+ "ppid": 1804,
+ "cmd": "schtasks.exe /create /sc onstart /tn \"NEMTY_2ELOZ2T\" /tr \"C:\\Users\\Admin\\AdobeUpdate.exe\"",
+ "image": "C:\\Windows\\SysWOW64\\schtasks.exe",
+ "orig": true,
+ "started": 31735,
+ "terminated": 32563
+ }, {
+ "procid": 190,
+ "procid_parent": 169,
+ "pid": 5268,
+ "ppid": 5032,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLWriter",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31750,
+ "terminated": 33828
+ }, {
+ "procid": 191,
+ "procid_parent": 119,
+ "pid": 5288,
+ "ppid": 1360,
+ "cmd": "net stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31766,
+ "terminated": 33953
+ }, {
+ "procid": 192,
+ "procid_parent": 122,
+ "pid": 5292,
+ "ppid": 2080,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31766,
+ "terminated": 32016
+ }, {
+ "procid": 193,
+ "procid_parent": 170,
+ "pid": 5304,
+ "ppid": 5048,
+ "cmd": "C:\\Windows\\system32\\net1 stop CobianBackup11",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31766,
+ "terminated": 33844
+ }, {
+ "procid": 194,
+ "procid_parent": 123,
+ "pid": 5328,
+ "ppid": 1616,
+ "cmd": "net stop ",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31782,
+ "terminated": 32016
+ }, {
+ "procid": 195,
+ "procid_parent": 104,
+ "pid": 5336,
+ "ppid": 3844,
+ "cmd": "net stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\net.exe",
+ "orig": true,
+ "started": 31782,
+ "terminated": 33953
+ }, {
+ "procid": 196,
+ "procid_parent": 174,
+ "pid": 5344,
+ "ppid": 1556,
+ "cmd": "C:\\Windows\\system32\\net1 stop MSSQL$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31797,
+ "terminated": 33860
+ }, {
+ "procid": 197,
+ "procid_parent": 171,
+ "pid": 5364,
+ "ppid": 5072,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLAgent$SQLEXPRESS",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31797,
+ "terminated": 33844
+ }, {
+ "procid": 198,
+ "procid_parent": 185,
+ "pid": 5404,
+ "ppid": 5208,
+ "cmd": "C:\\Windows\\system32\\net1 stop OracleXETNSListener",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31813,
+ "terminated": 33844
+ }, {
+ "procid": 199,
+ "procid_parent": 175,
+ "pid": 5424,
+ "ppid": 2196,
+ "cmd": "C:\\Windows\\system32\\net1 stop cbVSCService11",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31828,
+ "terminated": 33844
+ }, {
+ "procid": 200,
+ "procid_parent": 195,
+ "pid": 5468,
+ "ppid": 5336,
+ "cmd": "C:\\Windows\\system32\\net1 stop AcrSch2Svc",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31844,
+ "terminated": 33953
+ }, {
+ "procid": 201,
+ "procid_parent": 191,
+ "pid": 5480,
+ "ppid": 5288,
+ "cmd": "C:\\Windows\\system32\\net1 stop QBCFMontorService",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31844,
+ "terminated": 33953
+ }, {
+ "procid": 202,
+ "procid_parent": 178,
+ "pid": 5492,
+ "ppid": 2256,
+ "cmd": "C:\\Windows\\system32\\net1 stop OracleServiceXE",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31860,
+ "terminated": 33891
+ }, {
+ "procid": 203,
+ "procid_parent": 182,
+ "pid": 5508,
+ "ppid": 5176,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31860,
+ "terminated": 32016
+ }, {
+ "procid": 204,
+ "procid_parent": 188,
+ "pid": 5548,
+ "ppid": 5244,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31875,
+ "terminated": 32016
+ }, {
+ "procid": 205,
+ "procid_parent": 180,
+ "pid": 5576,
+ "ppid": 5156,
+ "cmd": "C:\\Windows\\system32\\net1 stop SQLBrowser",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31891,
+ "terminated": 33844
+ }, {
+ "procid": 206,
+ "procid_parent": 192,
+ "pid": 5588,
+ "ppid": 5292,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31891,
+ "terminated": 32000
+ }, {
+ "procid": 207,
+ "procid_parent": 187,
+ "pid": 5600,
+ "ppid": 5232,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31907,
+ "terminated": 32016
+ }, {
+ "procid": 208,
+ "procid_parent": 181,
+ "pid": 5628,
+ "ppid": 5164,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31907,
+ "terminated": 32016
+ }, {
+ "procid": 209,
+ "procid_parent": 184,
+ "pid": 5636,
+ "ppid": 5200,
+ "cmd": "C:\\Windows\\system32\\net1 stop Apache2.4",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31907,
+ "terminated": 33828
+ }, {
+ "procid": 210,
+ "procid_parent": 186,
+ "pid": 5648,
+ "ppid": 5228,
+ "cmd": "C:\\Windows\\system32\\net1 stop AcronisAgent",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31922,
+ "terminated": 33844
+ }, {
+ "procid": 211,
+ "procid_parent": 194,
+ "pid": 5696,
+ "ppid": 5328,
+ "cmd": "C:\\Windows\\system32\\net1 stop ",
+ "image": "C:\\Windows\\SysWOW64\\net1.exe",
+ "orig": true,
+ "started": 31953,
+ "terminated": 32000
+ }, {
+ "procid": 212,
+ "procid_parent": 134,
+ "pid": 5940,
+ "ppid": 996,
+ "cmd": "wmic shadowcopy delete",
+ "image": "C:\\Windows\\SysWOW64\\Wbem\\WMIC.exe",
+ "orig": true,
+ "started": 32282,
+ "terminated": 34532
+ }, {
+ "procid": 221,
+ "procid_parent": 65,
+ "pid": 2836,
+ "ppid": 3812,
+ "cmd": "\"C:\\Windows\\System32\\cmd.exe\" /c \"C:\\Users\\Admin\\NEMTY_2ELOZ2T-DECRYPT.txt\"",
+ "image": "C:\\Windows\\SysWOW64\\cmd.exe",
+ "orig": true,
+ "started": 61094
+ }, {
+ "procid": 223,
+ "procid_parent": 221,
+ "pid": 5580,
+ "ppid": 2836,
+ "cmd": "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\Admin\\NEMTY_2ELOZ2T-DECRYPT.txt",
+ "image": "C:\\Windows\\SysWOW64\\NOTEPAD.EXE",
+ "orig": true,
+ "started": 61516
+ }],
+ "signatures": [{
+ "label": "schtasks_persist",
+ "name": "Creates scheduled task(s)",
+ "ttp": ["T1053"],
+ "tags": ["persistence"],
+ "indicators": [{
+ "pid": 5260,
+ "procid": 189
+ }],
+ "desc": "Schtasks is often used by malware for persistence or to perform post-infection execution."
+ }, {
+ "label": "susp_dom_as_c2",
+ "name": "Legitimate hosting services abused for malware hosting/C2",
+ "score": 6,
+ "ttp": ["T1102"]
+ }, {
+ "name": "Suspicious use of WriteProcessMemory",
+ "indicators": [{
+ "description": "PID 3812 wrote to memory of 1504",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 68
+ }, {
+ "description": "PID 3812 wrote to memory of 1504",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 68
+ }, {
+ "description": "PID 3812 wrote to memory of 1504",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 68
+ }, {
+ "description": "PID 3812 wrote to memory of 1556",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 69
+ }, {
+ "description": "PID 3812 wrote to memory of 1556",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 69
+ }, {
+ "description": "PID 3812 wrote to memory of 1556",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 69
+ }, {
+ "description": "PID 1504 wrote to memory of 1604",
+ "pid": 1504,
+ "procid": 68,
+ "procid_target": 72
+ }, {
+ "description": "PID 1504 wrote to memory of 1604",
+ "pid": 1504,
+ "procid": 68,
+ "procid_target": 72
+ }, {
+ "description": "PID 1504 wrote to memory of 1604",
+ "pid": 1504,
+ "procid": 68,
+ "procid_target": 72
+ }, {
+ "description": "PID 1556 wrote to memory of 1940",
+ "pid": 1556,
+ "procid": 69,
+ "procid_target": 73
+ }, {
+ "description": "PID 1556 wrote to memory of 1940",
+ "pid": 1556,
+ "procid": 69,
+ "procid_target": 73
+ }, {
+ "description": "PID 1556 wrote to memory of 1940",
+ "pid": 1556,
+ "procid": 69,
+ "procid_target": 73
+ }, {
+ "description": "PID 3812 wrote to memory of 3440",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 76
+ }, {
+ "description": "PID 3812 wrote to memory of 3440",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 76
+ }, {
+ "description": "PID 3812 wrote to memory of 3440",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 76
+ }, {
+ "description": "PID 3812 wrote to memory of 3672",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 77
+ }, {
+ "description": "PID 3812 wrote to memory of 3672",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 77
+ }, {
+ "description": "PID 3812 wrote to memory of 3672",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 77
+ }, {
+ "description": "PID 3812 wrote to memory of 3788",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 78
+ }, {
+ "description": "PID 3812 wrote to memory of 3788",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 78
+ }, {
+ "description": "PID 3812 wrote to memory of 3788",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 78
+ }, {
+ "description": "PID 3812 wrote to memory of 3852",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 79
+ }, {
+ "description": "PID 3812 wrote to memory of 3852",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 79
+ }, {
+ "description": "PID 3812 wrote to memory of 3852",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 79
+ }, {
+ "description": "PID 3812 wrote to memory of 4080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 83
+ }, {
+ "description": "PID 3812 wrote to memory of 4080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 83
+ }, {
+ "description": "PID 3812 wrote to memory of 4080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 83
+ }, {
+ "description": "PID 3812 wrote to memory of 1016",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 85
+ }, {
+ "description": "PID 3812 wrote to memory of 1016",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 85
+ }, {
+ "description": "PID 3812 wrote to memory of 1016",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 85
+ }, {
+ "description": "PID 3812 wrote to memory of 4004",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 88
+ }, {
+ "description": "PID 3812 wrote to memory of 4004",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 88
+ }, {
+ "description": "PID 3812 wrote to memory of 4004",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 88
+ }, {
+ "description": "PID 3812 wrote to memory of 3500",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 89
+ }, {
+ "description": "PID 3812 wrote to memory of 3500",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 89
+ }, {
+ "description": "PID 3812 wrote to memory of 3500",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 89
+ }, {
+ "description": "PID 3812 wrote to memory of 3300",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 90
+ }, {
+ "description": "PID 3812 wrote to memory of 3300",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 90
+ }, {
+ "description": "PID 3812 wrote to memory of 3300",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 90
+ }, {
+ "description": "PID 3812 wrote to memory of 3580",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 91
+ }, {
+ "description": "PID 3812 wrote to memory of 3580",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 91
+ }, {
+ "description": "PID 3812 wrote to memory of 3580",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 91
+ }, {
+ "description": "PID 3812 wrote to memory of 3172",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 93
+ }, {
+ "description": "PID 3812 wrote to memory of 3172",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 93
+ }, {
+ "description": "PID 3812 wrote to memory of 3172",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 93
+ }, {
+ "description": "PID 3812 wrote to memory of 740",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 96
+ }, {
+ "description": "PID 3812 wrote to memory of 740",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 96
+ }, {
+ "description": "PID 3812 wrote to memory of 740",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 96
+ }, {
+ "description": "PID 3812 wrote to memory of 2984",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 98
+ }, {
+ "description": "PID 3812 wrote to memory of 2984",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 98
+ }, {
+ "description": "PID 3812 wrote to memory of 2984",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 98
+ }, {
+ "description": "PID 3812 wrote to memory of 2996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 3812 wrote to memory of 2996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 3812 wrote to memory of 2996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 99
+ }, {
+ "description": "PID 3812 wrote to memory of 3020",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 100
+ }, {
+ "description": "PID 3812 wrote to memory of 3020",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 100
+ }, {
+ "description": "PID 3812 wrote to memory of 3020",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 100
+ }, {
+ "description": "PID 3812 wrote to memory of 3532",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 101
+ }, {
+ "description": "PID 3812 wrote to memory of 3532",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 101
+ }, {
+ "description": "PID 3812 wrote to memory of 3532",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 101
+ }, {
+ "description": "PID 3812 wrote to memory of 1840",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 102
+ }, {
+ "description": "PID 3812 wrote to memory of 1840",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 102
+ }, {
+ "description": "PID 3812 wrote to memory of 1840",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 102
+ }, {
+ "description": "PID 3812 wrote to memory of 3844",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 104
+ }, {
+ "description": "PID 3812 wrote to memory of 3844",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 104
+ }, {
+ "description": "PID 3812 wrote to memory of 3844",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 104
+ }, {
+ "description": "PID 3812 wrote to memory of 3076",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 105
+ }, {
+ "description": "PID 3812 wrote to memory of 3076",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 105
+ }, {
+ "description": "PID 3812 wrote to memory of 3076",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 105
+ }, {
+ "description": "PID 3812 wrote to memory of 2132",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 106
+ }, {
+ "description": "PID 3812 wrote to memory of 2132",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 106
+ }, {
+ "description": "PID 3812 wrote to memory of 2132",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 106
+ }, {
+ "description": "PID 3812 wrote to memory of 3720",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 108
+ }, {
+ "description": "PID 3812 wrote to memory of 3720",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 108
+ }, {
+ "description": "PID 3812 wrote to memory of 3720",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 108
+ }, {
+ "description": "PID 3812 wrote to memory of 2228",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 110
+ }, {
+ "description": "PID 3812 wrote to memory of 2228",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 110
+ }, {
+ "description": "PID 3812 wrote to memory of 2228",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 110
+ }, {
+ "description": "PID 3812 wrote to memory of 3660",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 112
+ }, {
+ "description": "PID 3812 wrote to memory of 3660",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 112
+ }, {
+ "description": "PID 3812 wrote to memory of 3660",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 112
+ }, {
+ "description": "PID 3812 wrote to memory of 2988",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 113
+ }, {
+ "description": "PID 3812 wrote to memory of 2988",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 113
+ }, {
+ "description": "PID 3812 wrote to memory of 2988",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 113
+ }, {
+ "description": "PID 3812 wrote to memory of 3776",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 114
+ }, {
+ "description": "PID 3812 wrote to memory of 3776",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 114
+ }, {
+ "description": "PID 3812 wrote to memory of 3776",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 114
+ }, {
+ "description": "PID 3812 wrote to memory of 3784",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 115
+ }, {
+ "description": "PID 3812 wrote to memory of 3784",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 115
+ }, {
+ "description": "PID 3812 wrote to memory of 3784",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 115
+ }, {
+ "description": "PID 3812 wrote to memory of 3836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 116
+ }, {
+ "description": "PID 3812 wrote to memory of 3836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 116
+ }, {
+ "description": "PID 3812 wrote to memory of 3836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 116
+ }, {
+ "description": "PID 3812 wrote to memory of 1312",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 118
+ }, {
+ "description": "PID 3812 wrote to memory of 1312",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 118
+ }, {
+ "description": "PID 3812 wrote to memory of 1312",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 118
+ }, {
+ "description": "PID 3812 wrote to memory of 1360",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 119
+ }, {
+ "description": "PID 3812 wrote to memory of 1360",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 119
+ }, {
+ "description": "PID 3812 wrote to memory of 1360",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 119
+ }, {
+ "description": "PID 3812 wrote to memory of 1596",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 120
+ }, {
+ "description": "PID 3812 wrote to memory of 1596",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 120
+ }, {
+ "description": "PID 3812 wrote to memory of 1596",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 120
+ }, {
+ "description": "PID 3812 wrote to memory of 2416",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 121
+ }, {
+ "description": "PID 3812 wrote to memory of 2416",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 121
+ }, {
+ "description": "PID 3812 wrote to memory of 2416",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 121
+ }, {
+ "description": "PID 3812 wrote to memory of 2080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 122
+ }, {
+ "description": "PID 3812 wrote to memory of 2080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 122
+ }, {
+ "description": "PID 3812 wrote to memory of 2080",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 122
+ }, {
+ "description": "PID 3812 wrote to memory of 1616",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 123
+ }, {
+ "description": "PID 3812 wrote to memory of 1616",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 123
+ }, {
+ "description": "PID 3812 wrote to memory of 1616",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 123
+ }, {
+ "description": "PID 3812 wrote to memory of 1528",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 125
+ }, {
+ "description": "PID 3812 wrote to memory of 1528",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 125
+ }, {
+ "description": "PID 3812 wrote to memory of 1528",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 125
+ }, {
+ "description": "PID 3812 wrote to memory of 1568",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 127
+ }, {
+ "description": "PID 3812 wrote to memory of 1568",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 127
+ }, {
+ "description": "PID 3812 wrote to memory of 1568",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 127
+ }, {
+ "description": "PID 3812 wrote to memory of 1820",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 128
+ }, {
+ "description": "PID 3812 wrote to memory of 1820",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 128
+ }, {
+ "description": "PID 3812 wrote to memory of 1820",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 128
+ }, {
+ "description": "PID 3812 wrote to memory of 1804",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 131
+ }, {
+ "description": "PID 3812 wrote to memory of 1804",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 131
+ }, {
+ "description": "PID 3812 wrote to memory of 1804",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 131
+ }, {
+ "description": "PID 3812 wrote to memory of 996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 134
+ }, {
+ "description": "PID 3812 wrote to memory of 996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 134
+ }, {
+ "description": "PID 3812 wrote to memory of 996",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 134
+ }, {
+ "description": "PID 1596 wrote to memory of 4856",
+ "pid": 1596,
+ "procid": 120,
+ "procid_target": 152
+ }, {
+ "description": "PID 1596 wrote to memory of 4856",
+ "pid": 1596,
+ "procid": 120,
+ "procid_target": 152
+ }, {
+ "description": "PID 1596 wrote to memory of 4856",
+ "pid": 1596,
+ "procid": 120,
+ "procid_target": 152
+ }, {
+ "description": "PID 996 wrote to memory of 4864",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 153
+ }, {
+ "description": "PID 996 wrote to memory of 4864",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 153
+ }, {
+ "description": "PID 996 wrote to memory of 4864",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 153
+ }, {
+ "description": "PID 3788 wrote to memory of 4872",
+ "pid": 3788,
+ "procid": 78,
+ "procid_target": 154
+ }, {
+ "description": "PID 3788 wrote to memory of 4872",
+ "pid": 3788,
+ "procid": 78,
+ "procid_target": 154
+ }, {
+ "description": "PID 3788 wrote to memory of 4872",
+ "pid": 3788,
+ "procid": 78,
+ "procid_target": 154
+ }, {
+ "description": "PID 1016 wrote to memory of 4880",
+ "pid": 1016,
+ "procid": 85,
+ "procid_target": 155
+ }, {
+ "description": "PID 1016 wrote to memory of 4880",
+ "pid": 1016,
+ "procid": 85,
+ "procid_target": 155
+ }, {
+ "description": "PID 1016 wrote to memory of 4880",
+ "pid": 1016,
+ "procid": 85,
+ "procid_target": 155
+ }, {
+ "description": "PID 4080 wrote to memory of 4888",
+ "pid": 4080,
+ "procid": 83,
+ "procid_target": 156
+ }, {
+ "description": "PID 4080 wrote to memory of 4888",
+ "pid": 4080,
+ "procid": 83,
+ "procid_target": 156
+ }, {
+ "description": "PID 4080 wrote to memory of 4888",
+ "pid": 4080,
+ "procid": 83,
+ "procid_target": 156
+ }, {
+ "description": "PID 3440 wrote to memory of 4896",
+ "pid": 3440,
+ "procid": 76,
+ "procid_target": 157
+ }, {
+ "description": "PID 3440 wrote to memory of 4896",
+ "pid": 3440,
+ "procid": 76,
+ "procid_target": 157
+ }, {
+ "description": "PID 3440 wrote to memory of 4896",
+ "pid": 3440,
+ "procid": 76,
+ "procid_target": 157
+ }, {
+ "description": "PID 3500 wrote to memory of 4904",
+ "pid": 3500,
+ "procid": 89,
+ "procid_target": 158
+ }, {
+ "description": "PID 3500 wrote to memory of 4904",
+ "pid": 3500,
+ "procid": 89,
+ "procid_target": 158
+ }, {
+ "description": "PID 3500 wrote to memory of 4904",
+ "pid": 3500,
+ "procid": 89,
+ "procid_target": 158
+ }, {
+ "description": "PID 4004 wrote to memory of 4912",
+ "pid": 4004,
+ "procid": 88,
+ "procid_target": 159
+ }, {
+ "description": "PID 4004 wrote to memory of 4912",
+ "pid": 4004,
+ "procid": 88,
+ "procid_target": 159
+ }, {
+ "description": "PID 4004 wrote to memory of 4912",
+ "pid": 4004,
+ "procid": 88,
+ "procid_target": 159
+ }, {
+ "description": "PID 3660 wrote to memory of 4920",
+ "pid": 3660,
+ "procid": 112,
+ "procid_target": 160
+ }, {
+ "description": "PID 3660 wrote to memory of 4920",
+ "pid": 3660,
+ "procid": 112,
+ "procid_target": 160
+ }, {
+ "description": "PID 3660 wrote to memory of 4920",
+ "pid": 3660,
+ "procid": 112,
+ "procid_target": 160
+ }, {
+ "description": "PID 3580 wrote to memory of 4928",
+ "pid": 3580,
+ "procid": 91,
+ "procid_target": 161
+ }, {
+ "description": "PID 3580 wrote to memory of 4928",
+ "pid": 3580,
+ "procid": 91,
+ "procid_target": 161
+ }, {
+ "description": "PID 3580 wrote to memory of 4928",
+ "pid": 3580,
+ "procid": 91,
+ "procid_target": 161
+ }, {
+ "description": "PID 3020 wrote to memory of 4936",
+ "pid": 3020,
+ "procid": 100,
+ "procid_target": 162
+ }, {
+ "description": "PID 3020 wrote to memory of 4936",
+ "pid": 3020,
+ "procid": 100,
+ "procid_target": 162
+ }, {
+ "description": "PID 3020 wrote to memory of 4936",
+ "pid": 3020,
+ "procid": 100,
+ "procid_target": 162
+ }, {
+ "description": "PID 3852 wrote to memory of 4944",
+ "pid": 3852,
+ "procid": 79,
+ "procid_target": 163
+ }, {
+ "description": "PID 3852 wrote to memory of 4944",
+ "pid": 3852,
+ "procid": 79,
+ "procid_target": 163
+ }, {
+ "description": "PID 3852 wrote to memory of 4944",
+ "pid": 3852,
+ "procid": 79,
+ "procid_target": 163
+ }, {
+ "description": "PID 3672 wrote to memory of 4952",
+ "pid": 3672,
+ "procid": 77,
+ "procid_target": 164
+ }, {
+ "description": "PID 3672 wrote to memory of 4952",
+ "pid": 3672,
+ "procid": 77,
+ "procid_target": 164
+ }, {
+ "description": "PID 3672 wrote to memory of 4952",
+ "pid": 3672,
+ "procid": 77,
+ "procid_target": 164
+ }, {
+ "description": "PID 2984 wrote to memory of 4968",
+ "pid": 2984,
+ "procid": 98,
+ "procid_target": 165
+ }, {
+ "description": "PID 2984 wrote to memory of 4968",
+ "pid": 2984,
+ "procid": 98,
+ "procid_target": 165
+ }, {
+ "description": "PID 2984 wrote to memory of 4968",
+ "pid": 2984,
+ "procid": 98,
+ "procid_target": 165
+ }, {
+ "description": "PID 3300 wrote to memory of 4976",
+ "pid": 3300,
+ "procid": 90,
+ "procid_target": 166
+ }, {
+ "description": "PID 3300 wrote to memory of 4976",
+ "pid": 3300,
+ "procid": 90,
+ "procid_target": 166
+ }, {
+ "description": "PID 3300 wrote to memory of 4976",
+ "pid": 3300,
+ "procid": 90,
+ "procid_target": 166
+ }, {
+ "description": "PID 2988 wrote to memory of 4996",
+ "pid": 2988,
+ "procid": 113,
+ "procid_target": 167
+ }, {
+ "description": "PID 2988 wrote to memory of 4996",
+ "pid": 2988,
+ "procid": 113,
+ "procid_target": 167
+ }, {
+ "description": "PID 2988 wrote to memory of 4996",
+ "pid": 2988,
+ "procid": 113,
+ "procid_target": 167
+ }, {
+ "description": "PID 2996 wrote to memory of 5012",
+ "pid": 2996,
+ "procid": 99,
+ "procid_target": 168
+ }, {
+ "description": "PID 2996 wrote to memory of 5012",
+ "pid": 2996,
+ "procid": 99,
+ "procid_target": 168
+ }, {
+ "description": "PID 2996 wrote to memory of 5012",
+ "pid": 2996,
+ "procid": 99,
+ "procid_target": 168
+ }, {
+ "description": "PID 3720 wrote to memory of 5032",
+ "pid": 3720,
+ "procid": 108,
+ "procid_target": 169
+ }, {
+ "description": "PID 3720 wrote to memory of 5032",
+ "pid": 3720,
+ "procid": 108,
+ "procid_target": 169
+ }, {
+ "description": "PID 3720 wrote to memory of 5032",
+ "pid": 3720,
+ "procid": 108,
+ "procid_target": 169
+ }, {
+ "description": "PID 3836 wrote to memory of 5048",
+ "pid": 3836,
+ "procid": 116,
+ "procid_target": 170
+ }, {
+ "description": "PID 3836 wrote to memory of 5048",
+ "pid": 3836,
+ "procid": 116,
+ "procid_target": 170
+ }, {
+ "description": "PID 3836 wrote to memory of 5048",
+ "pid": 3836,
+ "procid": 116,
+ "procid_target": 170
+ }, {
+ "description": "PID 3776 wrote to memory of 5072",
+ "pid": 3776,
+ "procid": 114,
+ "procid_target": 171
+ }, {
+ "description": "PID 3776 wrote to memory of 5072",
+ "pid": 3776,
+ "procid": 114,
+ "procid_target": 171
+ }, {
+ "description": "PID 3776 wrote to memory of 5072",
+ "pid": 3776,
+ "procid": 114,
+ "procid_target": 171
+ }, {
+ "description": "PID 3172 wrote to memory of 5084",
+ "pid": 3172,
+ "procid": 93,
+ "procid_target": 172
+ }, {
+ "description": "PID 3172 wrote to memory of 5084",
+ "pid": 3172,
+ "procid": 93,
+ "procid_target": 172
+ }, {
+ "description": "PID 3172 wrote to memory of 5084",
+ "pid": 3172,
+ "procid": 93,
+ "procid_target": 172
+ }, {
+ "description": "PID 740 wrote to memory of 5092",
+ "pid": 740,
+ "procid": 96,
+ "procid_target": 173
+ }, {
+ "description": "PID 740 wrote to memory of 5092",
+ "pid": 740,
+ "procid": 96,
+ "procid_target": 173
+ }, {
+ "description": "PID 740 wrote to memory of 5092",
+ "pid": 740,
+ "procid": 96,
+ "procid_target": 173
+ }, {
+ "description": "PID 2228 wrote to memory of 1556",
+ "pid": 2228,
+ "procid": 110,
+ "procid_target": 174
+ }, {
+ "description": "PID 2228 wrote to memory of 1556",
+ "pid": 2228,
+ "procid": 110,
+ "procid_target": 174
+ }, {
+ "description": "PID 2228 wrote to memory of 1556",
+ "pid": 2228,
+ "procid": 110,
+ "procid_target": 174
+ }, {
+ "description": "PID 1312 wrote to memory of 2196",
+ "pid": 1312,
+ "procid": 118,
+ "procid_target": 175
+ }, {
+ "description": "PID 1312 wrote to memory of 2196",
+ "pid": 1312,
+ "procid": 118,
+ "procid_target": 175
+ }, {
+ "description": "PID 1312 wrote to memory of 2196",
+ "pid": 1312,
+ "procid": 118,
+ "procid_target": 175
+ }, {
+ "description": "PID 4920 wrote to memory of 4144",
+ "pid": 4920,
+ "procid": 160,
+ "procid_target": 176
+ }, {
+ "description": "PID 4920 wrote to memory of 4144",
+ "pid": 4920,
+ "procid": 160,
+ "procid_target": 176
+ }, {
+ "description": "PID 4920 wrote to memory of 4144",
+ "pid": 4920,
+ "procid": 160,
+ "procid_target": 176
+ }, {
+ "description": "PID 4856 wrote to memory of 4632",
+ "pid": 4856,
+ "procid": 152,
+ "procid_target": 177
+ }, {
+ "description": "PID 4856 wrote to memory of 4632",
+ "pid": 4856,
+ "procid": 152,
+ "procid_target": 177
+ }, {
+ "description": "PID 4856 wrote to memory of 4632",
+ "pid": 4856,
+ "procid": 152,
+ "procid_target": 177
+ }, {
+ "description": "PID 1840 wrote to memory of 2256",
+ "pid": 1840,
+ "procid": 102,
+ "procid_target": 178
+ }, {
+ "description": "PID 1840 wrote to memory of 2256",
+ "pid": 1840,
+ "procid": 102,
+ "procid_target": 178
+ }, {
+ "description": "PID 1840 wrote to memory of 2256",
+ "pid": 1840,
+ "procid": 102,
+ "procid_target": 178
+ }, {
+ "description": "PID 4936 wrote to memory of 5136",
+ "pid": 4936,
+ "procid": 162,
+ "procid_target": 179
+ }, {
+ "description": "PID 4936 wrote to memory of 5136",
+ "pid": 4936,
+ "procid": 162,
+ "procid_target": 179
+ }, {
+ "description": "PID 4936 wrote to memory of 5136",
+ "pid": 4936,
+ "procid": 162,
+ "procid_target": 179
+ }, {
+ "description": "PID 3784 wrote to memory of 5156",
+ "pid": 3784,
+ "procid": 115,
+ "procid_target": 180
+ }, {
+ "description": "PID 3784 wrote to memory of 5156",
+ "pid": 3784,
+ "procid": 115,
+ "procid_target": 180
+ }, {
+ "description": "PID 3784 wrote to memory of 5156",
+ "pid": 3784,
+ "procid": 115,
+ "procid_target": 180
+ }, {
+ "description": "PID 1568 wrote to memory of 5164",
+ "pid": 1568,
+ "procid": 127,
+ "procid_target": 181
+ }, {
+ "description": "PID 1568 wrote to memory of 5164",
+ "pid": 1568,
+ "procid": 127,
+ "procid_target": 181
+ }, {
+ "description": "PID 1568 wrote to memory of 5164",
+ "pid": 1568,
+ "procid": 127,
+ "procid_target": 181
+ }, {
+ "description": "PID 1528 wrote to memory of 5176",
+ "pid": 1528,
+ "procid": 125,
+ "procid_target": 182
+ }, {
+ "description": "PID 1528 wrote to memory of 5176",
+ "pid": 1528,
+ "procid": 125,
+ "procid_target": 182
+ }, {
+ "description": "PID 1528 wrote to memory of 5176",
+ "pid": 1528,
+ "procid": 125,
+ "procid_target": 182
+ }, {
+ "description": "PID 4996 wrote to memory of 5192",
+ "pid": 4996,
+ "procid": 167,
+ "procid_target": 183
+ }, {
+ "description": "PID 4996 wrote to memory of 5192",
+ "pid": 4996,
+ "procid": 167,
+ "procid_target": 183
+ }, {
+ "description": "PID 4996 wrote to memory of 5192",
+ "pid": 4996,
+ "procid": 167,
+ "procid_target": 183
+ }, {
+ "description": "PID 2132 wrote to memory of 5200",
+ "pid": 2132,
+ "procid": 106,
+ "procid_target": 184
+ }, {
+ "description": "PID 2132 wrote to memory of 5200",
+ "pid": 2132,
+ "procid": 106,
+ "procid_target": 184
+ }, {
+ "description": "PID 2132 wrote to memory of 5200",
+ "pid": 2132,
+ "procid": 106,
+ "procid_target": 184
+ }, {
+ "description": "PID 3532 wrote to memory of 5208",
+ "pid": 3532,
+ "procid": 101,
+ "procid_target": 185
+ }, {
+ "description": "PID 3532 wrote to memory of 5208",
+ "pid": 3532,
+ "procid": 101,
+ "procid_target": 185
+ }, {
+ "description": "PID 3532 wrote to memory of 5208",
+ "pid": 3532,
+ "procid": 101,
+ "procid_target": 185
+ }, {
+ "description": "PID 3076 wrote to memory of 5228",
+ "pid": 3076,
+ "procid": 105,
+ "procid_target": 186
+ }, {
+ "description": "PID 3076 wrote to memory of 5228",
+ "pid": 3076,
+ "procid": 105,
+ "procid_target": 186
+ }, {
+ "description": "PID 3076 wrote to memory of 5228",
+ "pid": 3076,
+ "procid": 105,
+ "procid_target": 186
+ }, {
+ "description": "PID 1820 wrote to memory of 5232",
+ "pid": 1820,
+ "procid": 128,
+ "procid_target": 187
+ }, {
+ "description": "PID 1820 wrote to memory of 5232",
+ "pid": 1820,
+ "procid": 128,
+ "procid_target": 187
+ }, {
+ "description": "PID 1820 wrote to memory of 5232",
+ "pid": 1820,
+ "procid": 128,
+ "procid_target": 187
+ }, {
+ "description": "PID 2416 wrote to memory of 5244",
+ "pid": 2416,
+ "procid": 121,
+ "procid_target": 188
+ }, {
+ "description": "PID 2416 wrote to memory of 5244",
+ "pid": 2416,
+ "procid": 121,
+ "procid_target": 188
+ }, {
+ "description": "PID 2416 wrote to memory of 5244",
+ "pid": 2416,
+ "procid": 121,
+ "procid_target": 188
+ }, {
+ "description": "PID 1804 wrote to memory of 5260",
+ "pid": 1804,
+ "procid": 131,
+ "procid_target": 189
+ }, {
+ "description": "PID 1804 wrote to memory of 5260",
+ "pid": 1804,
+ "procid": 131,
+ "procid_target": 189
+ }, {
+ "description": "PID 1804 wrote to memory of 5260",
+ "pid": 1804,
+ "procid": 131,
+ "procid_target": 189
+ }, {
+ "description": "PID 5032 wrote to memory of 5268",
+ "pid": 5032,
+ "procid": 169,
+ "procid_target": 190
+ }, {
+ "description": "PID 5032 wrote to memory of 5268",
+ "pid": 5032,
+ "procid": 169,
+ "procid_target": 190
+ }, {
+ "description": "PID 5032 wrote to memory of 5268",
+ "pid": 5032,
+ "procid": 169,
+ "procid_target": 190
+ }, {
+ "description": "PID 1360 wrote to memory of 5288",
+ "pid": 1360,
+ "procid": 119,
+ "procid_target": 191
+ }, {
+ "description": "PID 1360 wrote to memory of 5288",
+ "pid": 1360,
+ "procid": 119,
+ "procid_target": 191
+ }, {
+ "description": "PID 1360 wrote to memory of 5288",
+ "pid": 1360,
+ "procid": 119,
+ "procid_target": 191
+ }, {
+ "description": "PID 2080 wrote to memory of 5292",
+ "pid": 2080,
+ "procid": 122,
+ "procid_target": 192
+ }, {
+ "description": "PID 2080 wrote to memory of 5292",
+ "pid": 2080,
+ "procid": 122,
+ "procid_target": 192
+ }, {
+ "description": "PID 2080 wrote to memory of 5292",
+ "pid": 2080,
+ "procid": 122,
+ "procid_target": 192
+ }, {
+ "description": "PID 5048 wrote to memory of 5304",
+ "pid": 5048,
+ "procid": 170,
+ "procid_target": 193
+ }, {
+ "description": "PID 5048 wrote to memory of 5304",
+ "pid": 5048,
+ "procid": 170,
+ "procid_target": 193
+ }, {
+ "description": "PID 5048 wrote to memory of 5304",
+ "pid": 5048,
+ "procid": 170,
+ "procid_target": 193
+ }, {
+ "description": "PID 1616 wrote to memory of 5328",
+ "pid": 1616,
+ "procid": 123,
+ "procid_target": 194
+ }, {
+ "description": "PID 1616 wrote to memory of 5328",
+ "pid": 1616,
+ "procid": 123,
+ "procid_target": 194
+ }, {
+ "description": "PID 1616 wrote to memory of 5328",
+ "pid": 1616,
+ "procid": 123,
+ "procid_target": 194
+ }, {
+ "description": "PID 3844 wrote to memory of 5336",
+ "pid": 3844,
+ "procid": 104,
+ "procid_target": 195
+ }, {
+ "description": "PID 3844 wrote to memory of 5336",
+ "pid": 3844,
+ "procid": 104,
+ "procid_target": 195
+ }, {
+ "description": "PID 3844 wrote to memory of 5336",
+ "pid": 3844,
+ "procid": 104,
+ "procid_target": 195
+ }, {
+ "description": "PID 1556 wrote to memory of 5344",
+ "pid": 1556,
+ "procid": 174,
+ "procid_target": 196
+ }, {
+ "description": "PID 1556 wrote to memory of 5344",
+ "pid": 1556,
+ "procid": 174,
+ "procid_target": 196
+ }, {
+ "description": "PID 1556 wrote to memory of 5344",
+ "pid": 1556,
+ "procid": 174,
+ "procid_target": 196
+ }, {
+ "description": "PID 5072 wrote to memory of 5364",
+ "pid": 5072,
+ "procid": 171,
+ "procid_target": 197
+ }, {
+ "description": "PID 5072 wrote to memory of 5364",
+ "pid": 5072,
+ "procid": 171,
+ "procid_target": 197
+ }, {
+ "description": "PID 5072 wrote to memory of 5364",
+ "pid": 5072,
+ "procid": 171,
+ "procid_target": 197
+ }, {
+ "description": "PID 5208 wrote to memory of 5404",
+ "pid": 5208,
+ "procid": 185,
+ "procid_target": 198
+ }, {
+ "description": "PID 5208 wrote to memory of 5404",
+ "pid": 5208,
+ "procid": 185,
+ "procid_target": 198
+ }, {
+ "description": "PID 5208 wrote to memory of 5404",
+ "pid": 5208,
+ "procid": 185,
+ "procid_target": 198
+ }, {
+ "description": "PID 2196 wrote to memory of 5424",
+ "pid": 2196,
+ "procid": 175,
+ "procid_target": 199
+ }, {
+ "description": "PID 2196 wrote to memory of 5424",
+ "pid": 2196,
+ "procid": 175,
+ "procid_target": 199
+ }, {
+ "description": "PID 2196 wrote to memory of 5424",
+ "pid": 2196,
+ "procid": 175,
+ "procid_target": 199
+ }, {
+ "description": "PID 5336 wrote to memory of 5468",
+ "pid": 5336,
+ "procid": 195,
+ "procid_target": 200
+ }, {
+ "description": "PID 5336 wrote to memory of 5468",
+ "pid": 5336,
+ "procid": 195,
+ "procid_target": 200
+ }, {
+ "description": "PID 5336 wrote to memory of 5468",
+ "pid": 5336,
+ "procid": 195,
+ "procid_target": 200
+ }, {
+ "description": "PID 5288 wrote to memory of 5480",
+ "pid": 5288,
+ "procid": 191,
+ "procid_target": 201
+ }, {
+ "description": "PID 5288 wrote to memory of 5480",
+ "pid": 5288,
+ "procid": 191,
+ "procid_target": 201
+ }, {
+ "description": "PID 5288 wrote to memory of 5480",
+ "pid": 5288,
+ "procid": 191,
+ "procid_target": 201
+ }, {
+ "description": "PID 2256 wrote to memory of 5492",
+ "pid": 2256,
+ "procid": 178,
+ "procid_target": 202
+ }, {
+ "description": "PID 2256 wrote to memory of 5492",
+ "pid": 2256,
+ "procid": 178,
+ "procid_target": 202
+ }, {
+ "description": "PID 2256 wrote to memory of 5492",
+ "pid": 2256,
+ "procid": 178,
+ "procid_target": 202
+ }, {
+ "description": "PID 5176 wrote to memory of 5508",
+ "pid": 5176,
+ "procid": 182,
+ "procid_target": 203
+ }, {
+ "description": "PID 5176 wrote to memory of 5508",
+ "pid": 5176,
+ "procid": 182,
+ "procid_target": 203
+ }, {
+ "description": "PID 5176 wrote to memory of 5508",
+ "pid": 5176,
+ "procid": 182,
+ "procid_target": 203
+ }, {
+ "description": "PID 5244 wrote to memory of 5548",
+ "pid": 5244,
+ "procid": 188,
+ "procid_target": 204
+ }, {
+ "description": "PID 5244 wrote to memory of 5548",
+ "pid": 5244,
+ "procid": 188,
+ "procid_target": 204
+ }, {
+ "description": "PID 5244 wrote to memory of 5548",
+ "pid": 5244,
+ "procid": 188,
+ "procid_target": 204
+ }, {
+ "description": "PID 5156 wrote to memory of 5576",
+ "pid": 5156,
+ "procid": 180,
+ "procid_target": 205
+ }, {
+ "description": "PID 5156 wrote to memory of 5576",
+ "pid": 5156,
+ "procid": 180,
+ "procid_target": 205
+ }, {
+ "description": "PID 5156 wrote to memory of 5576",
+ "pid": 5156,
+ "procid": 180,
+ "procid_target": 205
+ }, {
+ "description": "PID 5292 wrote to memory of 5588",
+ "pid": 5292,
+ "procid": 192,
+ "procid_target": 206
+ }, {
+ "description": "PID 5292 wrote to memory of 5588",
+ "pid": 5292,
+ "procid": 192,
+ "procid_target": 206
+ }, {
+ "description": "PID 5292 wrote to memory of 5588",
+ "pid": 5292,
+ "procid": 192,
+ "procid_target": 206
+ }, {
+ "description": "PID 5232 wrote to memory of 5600",
+ "pid": 5232,
+ "procid": 187,
+ "procid_target": 207
+ }, {
+ "description": "PID 5232 wrote to memory of 5600",
+ "pid": 5232,
+ "procid": 187,
+ "procid_target": 207
+ }, {
+ "description": "PID 5232 wrote to memory of 5600",
+ "pid": 5232,
+ "procid": 187,
+ "procid_target": 207
+ }, {
+ "description": "PID 5164 wrote to memory of 5628",
+ "pid": 5164,
+ "procid": 181,
+ "procid_target": 208
+ }, {
+ "description": "PID 5164 wrote to memory of 5628",
+ "pid": 5164,
+ "procid": 181,
+ "procid_target": 208
+ }, {
+ "description": "PID 5164 wrote to memory of 5628",
+ "pid": 5164,
+ "procid": 181,
+ "procid_target": 208
+ }, {
+ "description": "PID 5200 wrote to memory of 5636",
+ "pid": 5200,
+ "procid": 184,
+ "procid_target": 209
+ }, {
+ "description": "PID 5200 wrote to memory of 5636",
+ "pid": 5200,
+ "procid": 184,
+ "procid_target": 209
+ }, {
+ "description": "PID 5200 wrote to memory of 5636",
+ "pid": 5200,
+ "procid": 184,
+ "procid_target": 209
+ }, {
+ "description": "PID 5228 wrote to memory of 5648",
+ "pid": 5228,
+ "procid": 186,
+ "procid_target": 210
+ }, {
+ "description": "PID 5228 wrote to memory of 5648",
+ "pid": 5228,
+ "procid": 186,
+ "procid_target": 210
+ }, {
+ "description": "PID 5228 wrote to memory of 5648",
+ "pid": 5228,
+ "procid": 186,
+ "procid_target": 210
+ }, {
+ "description": "PID 5328 wrote to memory of 5696",
+ "pid": 5328,
+ "procid": 194,
+ "procid_target": 211
+ }, {
+ "description": "PID 5328 wrote to memory of 5696",
+ "pid": 5328,
+ "procid": 194,
+ "procid_target": 211
+ }, {
+ "description": "PID 5328 wrote to memory of 5696",
+ "pid": 5328,
+ "procid": 194,
+ "procid_target": 211
+ }, {
+ "description": "PID 996 wrote to memory of 5940",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 212
+ }, {
+ "description": "PID 996 wrote to memory of 5940",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 212
+ }, {
+ "description": "PID 996 wrote to memory of 5940",
+ "pid": 996,
+ "procid": 134,
+ "procid_target": 212
+ }, {
+ "description": "PID 3812 wrote to memory of 2836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 221
+ }, {
+ "description": "PID 3812 wrote to memory of 2836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 221
+ }, {
+ "description": "PID 3812 wrote to memory of 2836",
+ "pid": 3812,
+ "procid": 65,
+ "procid_target": 221
+ }, {
+ "description": "PID 2836 wrote to memory of 5580",
+ "pid": 2836,
+ "procid": 221,
+ "procid_target": 223
+ }, {
+ "description": "PID 2836 wrote to memory of 5580",
+ "pid": 2836,
+ "procid": 221,
+ "procid_target": 223
+ }, {
+ "description": "PID 2836 wrote to memory of 5580",
+ "pid": 2836,
+ "procid": 221,
+ "procid_target": 223
+ }]
+ }, {
+ "name": "Suspicious behavior: EnumeratesProcesses",
+ "indicators": [{
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }, {
+ "pid": 3812,
+ "procid": 65
+ }]
+ }, {
+ "label": "nemty",
+ "name": "Nemty",
+ "score": 10,
+ "tags": ["ransomware", "family:nemty"],
+ "desc": "Ransomware discovered in late 2019 which has been actively developed/updated over time."
+ }, {
+ "label": "net_generic",
+ "name": "Runs net.exe"
+ }, {
+ "label": "deletes_shadows",
+ "name": "Deletes shadow copies",
+ "score": 9,
+ "ttp": ["T1107", "T1490"],
+ "tags": ["ransomware"],
+ "desc": "Ransomware often targets backup files to inhibit system recovery."
+ }, {
+ "label": "taskkill_kill_process",
+ "name": "Kills process with taskkill",
+ "tags": ["evasion"],
+ "indicators": [{
+ "pid": 4928,
+ "procid": 161
+ }, {
+ "pid": 4888,
+ "procid": 156
+ }, {
+ "pid": 4944,
+ "procid": 163
+ }, {
+ "pid": 4952,
+ "procid": 164
+ }, {
+ "pid": 5084,
+ "procid": 172
+ }, {
+ "pid": 4872,
+ "procid": 154
+ }, {
+ "pid": 4904,
+ "procid": 158
+ }, {
+ "pid": 4912,
+ "procid": 159
+ }, {
+ "pid": 4968,
+ "procid": 165
+ }, {
+ "pid": 4976,
+ "procid": 166
+ }, {
+ "pid": 5092,
+ "procid": 173
+ }, {
+ "pid": 4880,
+ "procid": 155
+ }, {
+ "pid": 5012,
+ "procid": 168
+ }, {
+ "pid": 4896,
+ "procid": 157
+ }]
+ }, {
+ "name": "Modifies service",
+ "score": 5,
+ "ttp": ["T1112", "T1031"],
+ "tags": ["persistence"],
+ "indicators": [{
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\ASR Writer",
+ "description": "Key created",
+ "procid": 74
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\Shadow Copy Optimization Writer",
+ "description": "Key created",
+ "procid": 74
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\Registry Writer",
+ "description": "Key created",
+ "procid": 74
+ }, {
+ "ioc": "\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\VSS\\Diag\\COM+ REGDB Writer",
+ "description": "Key created",
+ "procid": 74
+ }]
+ }, {
+ "label": "external_ip_lookup",
+ "name": "Looks up external IP address via web service",
+ "score": 6,
+ "indicators": [{
+ "ioc": "api.db-ip.com",
+ "flow": 10
+ }],
+ "desc": "Uses a legitimate IP lookup service to find the infected system's external IP."
+ }, {
+ "name": "Suspicious use of AdjustPrivilegeToken",
+ "indicators": [{
+ "description": "Token: SeBackupPrivilege",
+ "pid": 2084,
+ "procid": 74
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 2084,
+ "procid": 74
+ }, {
+ "description": "Token: SeAuditPrivilege",
+ "pid": 2084,
+ "procid": 74
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4896,
+ "procid": 157
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4944,
+ "procid": 163
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4904,
+ "procid": 158
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4928,
+ "procid": 161
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4968,
+ "procid": 165
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4880,
+ "procid": 155
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4952,
+ "procid": 164
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4872,
+ "procid": 154
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4912,
+ "procid": 159
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4888,
+ "procid": 156
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 5012,
+ "procid": 168
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 4976,
+ "procid": 166
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 5092,
+ "procid": 173
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 5084,
+ "procid": 172
+ }, {
+ "description": "Token: SeIncreaseQuotaPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSecurityPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeTakeOwnershipPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeLoadDriverPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemProfilePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemtimePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeProfSingleProcessPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeIncBasePriorityPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeCreatePagefilePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeBackupPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeShutdownPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemEnvironmentPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeRemoteShutdownPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeUndockPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeManageVolumePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 33",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 34",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 35",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 36",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeIncreaseQuotaPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSecurityPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeTakeOwnershipPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeLoadDriverPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemProfilePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemtimePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeProfSingleProcessPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeIncBasePriorityPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeCreatePagefilePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeBackupPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeRestorePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeShutdownPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeDebugPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeSystemEnvironmentPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeRemoteShutdownPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeUndockPrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: SeManageVolumePrivilege",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 33",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 34",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 35",
+ "pid": 5940,
+ "procid": 212
+ }, {
+ "description": "Token: 36",
+ "pid": 5940,
+ "procid": 212
+ }]
+ }, {
+ "label": "reg_software_classes",
+ "name": "Modifies registry class",
+ "indicators": [{
+ "ioc": "\\REGISTRY\\USER\\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\\Local Settings",
+ "description": "Key created",
+ "procid": 221
+ }]
+ }, {
+ "label": "vssadmin_shadows_general",
+ "name": "Interacts with shadow copies",
+ "ttp": ["T1107", "T1490"],
+ "tags": ["ransomware"],
+ "indicators": [{
+ "pid": 1604,
+ "procid": 72
+ }, {
+ "pid": 1940,
+ "procid": 73
+ }, {
+ "pid": 4864,
+ "procid": 153
+ }],
+ "desc": "Shadow copies are often targeted by ransomware to inhibit system recovery."
+ }],
+ "network": {
+ "flows": [{
+ "id": 1,
+ "src": "10.10.0.37:51436",
+ "dst": "239.255.255.250:1900",
+ "proto": "udp",
+ "pid": 808,
+ "procid": 67,
+ "first_seen": 25395,
+ "last_seen": 31411,
+ "tx_bytes": 1320,
+ "tx_packets": 8
+ }, {
+ "id": 2,
+ "src": "127.0.0.1:51437",
+ "dst": "239.255.255.250:1900",
+ "proto": "udp",
+ "pid": 808,
+ "procid": 67
+ }, {
+ "id": 3,
+ "src": "127.0.0.1:50372",
+ "dst": "127.0.0.1:47001",
+ "proto": "tcp",
+ "pid": 3912,
+ "procid": 66
+ }, {
+ "id": 4,
+ "src": "10.10.0.37:58454",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 30323,
+ "last_seen": 30329,
+ "rx_bytes": 113,
+ "rx_packets": 1,
+ "tx_bytes": 66,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "www.myexternalip.com"
+ }, {
+ "id": 5,
+ "src": "10.10.0.37:50376",
+ "dst": "216.58.208.115:443",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 30426,
+ "last_seen": 63288,
+ "rx_bytes": 3472,
+ "rx_packets": 8,
+ "tx_bytes": 891,
+ "tx_packets": 11,
+ "protocols": ["tls", "http"],
+ "domain": "www.myexternalip.com",
+ "tls_ja3": "a0e9f5d64349fb13191bc781f81f42e1",
+ "tls_sni": "www.myexternalip.com"
+ }, {
+ "id": 7,
+ "src": "10.10.0.37:50377",
+ "dst": "8.253.208.112:80",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 30667,
+ "last_seen": 63288,
+ "rx_bytes": 7639,
+ "rx_packets": 8,
+ "tx_bytes": 567,
+ "tx_packets": 7,
+ "protocols": ["http"],
+ "domain": "ctldl.windowsupdate.com"
+ }, {
+ "id": 8,
+ "src": "10.10.0.37:56692",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 30752,
+ "last_seen": 30758,
+ "rx_bytes": 110,
+ "rx_packets": 1,
+ "tx_bytes": 59,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "ocsp.pki.goog"
+ }, {
+ "id": 9,
+ "src": "10.10.0.37:50378",
+ "dst": "172.217.17.131:80",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 30759,
+ "last_seen": 63288,
+ "rx_bytes": 1592,
+ "rx_packets": 4,
+ "tx_bytes": 744,
+ "tx_packets": 6,
+ "protocols": ["http"],
+ "domain": "ocsp.pki.goog"
+ }, {
+ "id": 10,
+ "src": "10.10.0.37:58407",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 30980,
+ "last_seen": 30986,
+ "rx_bytes": 107,
+ "rx_packets": 1,
+ "tx_bytes": 59,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "api.db-ip.com"
+ }, {
+ "id": 11,
+ "src": "10.10.0.37:50379",
+ "dst": "104.26.4.15:80",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 30987,
+ "last_seen": 63289,
+ "rx_bytes": 766,
+ "rx_packets": 4,
+ "tx_bytes": 392,
+ "tx_packets": 6,
+ "protocols": ["http"],
+ "domain": "api.db-ip.com"
+ }, {
+ "id": 12,
+ "src": "10.10.0.37:54871",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 32946,
+ "last_seen": 32952,
+ "rx_bytes": 74,
+ "rx_packets": 1,
+ "tx_bytes": 58,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "iplogger.org"
+ }, {
+ "id": 13,
+ "src": "10.10.0.37:50380",
+ "dst": "88.99.66.31:443",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 33041,
+ "last_seen": 63289,
+ "rx_bytes": 4419,
+ "rx_packets": 7,
+ "tx_bytes": 911,
+ "tx_packets": 11,
+ "protocols": ["tls", "http"],
+ "domain": "iplogger.org",
+ "tls_ja3": "a0e9f5d64349fb13191bc781f81f42e1",
+ "tls_sni": "iplogger.org"
+ }, {
+ "id": 14,
+ "src": "10.10.0.37:54603",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 33474,
+ "last_seen": 33479,
+ "rx_bytes": 199,
+ "rx_packets": 1,
+ "tx_bytes": 77,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "isrg.trustid.ocsp.identrust.com"
+ }, {
+ "id": 15,
+ "src": "10.10.0.37:50381",
+ "dst": "95.100.96.193:80",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 33481,
+ "last_seen": 63288,
+ "rx_bytes": 1969,
+ "rx_packets": 4,
+ "tx_bytes": 478,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "isrg.trustid.ocsp.identrust.com"
+ }, {
+ "id": 16,
+ "src": "10.10.0.37:61888",
+ "dst": "8.8.8.8:53",
+ "proto": "udp",
+ "pid": 1560,
+ "procid": 32,
+ "first_seen": 33522,
+ "last_seen": 33540,
+ "rx_bytes": 191,
+ "rx_packets": 1,
+ "tx_bytes": 73,
+ "tx_packets": 1,
+ "protocols": ["dns"],
+ "domain": "ocsp.int-x3.letsencrypt.org"
+ }, {
+ "id": 17,
+ "src": "10.10.0.37:50382",
+ "dst": "95.100.96.171:80",
+ "proto": "tcp",
+ "pid": 3812,
+ "procid": 65,
+ "first_seen": 33573,
+ "last_seen": 63288,
+ "rx_bytes": 1045,
+ "rx_packets": 3,
+ "tx_bytes": 484,
+ "tx_packets": 5,
+ "protocols": ["http"],
+ "domain": "ocsp.int-x3.letsencrypt.org"
+ }, {
+ "id": 18,
+ "src": "10.10.0.37:137",
+ "dst": "10.10.0.255:137",
+ "proto": "udp",
+ "first_seen": 42549,
+ "last_seen": 43215,
+ "tx_bytes": 288,
+ "tx_packets": 3,
+ "protocols": ["netbios-ns"]
+ }, {
+ "id": 19,
+ "src": "10.10.0.37:137",
+ "dst": "10.10.0.22:137",
+ "proto": "udp",
+ "first_seen": 42550,
+ "last_seen": 43215,
+ "rx_bytes": 270,
+ "rx_packets": 3,
+ "protocols": ["netbios-ns"]
+ }],
+ "requests": [{
+ "flow": 4,
+ "index": 1,
+ "dns_request": {
+ "domains": ["www.myexternalip.com"],
+ "questions": [{
+ "name": "www.myexternalip.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 4,
+ "index": 1,
+ "dns_response": {
+ "domains": ["www.myexternalip.com", "ghs.googlehosted.com"],
+ "ip": ["216.58.208.115"],
+ "answers": [{
+ "name": "www.myexternalip.com",
+ "type": "IN CNAME",
+ "value": "ghs.googlehosted.com"
+ }, {
+ "name": "ghs.googlehosted.com",
+ "type": "IN A",
+ "value": "216.58.208.115"
+ }]
+ }
+ }, {
+ "flow": 5,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "https://www.myexternalip.com/raw",
+ "request": "GET /raw HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: www.myexternalip.com", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 5,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Mon, 15 Jun 2020 10:04:36 GMT", "Content-Type: text/html; charset=utf-8", "Content-Length: 12", "Access-Control-Allow-Origin: *", "Via: 1.1 google"]
+ }
+ }, {
+ "flow": 7,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b14bde372b1cb2d4",
+ "request": "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b14bde372b1cb2d4 HTTP/1.1",
+ "headers": ["Cache-Control: no-cache", "Connection: Keep-Alive", "Pragma: no-cache", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/10.0", "Host: ctldl.windowsupdate.com"]
+ }
+ }, {
+ "flow": 7,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Mon, 15 Jun 2020 09:46:05 GMT", "Content-Type: application/vnd.ms-cab-compressed", "Content-Length: 6894", "Connection: keep-alive", "Cache-Control: max-age=3600", "ETag: \"0f77d14f351d51:0\"", "Expires: Mon, 15 Jun 2020 10:46:05 GMT", "Last-Modified: Tue, 13 Aug 2019 16:20:54 GMT", "Server: Microsoft-IIS/10.0", "x-ccc: NL", "x-cid: 3", "X-Powered-By: ASP.NET", "MSRegion: EMEA", "Age: 1111", "Accept-Ranges: bytes"]
+ }
+ }, {
+ "flow": 8,
+ "index": 1,
+ "dns_request": {
+ "domains": ["ocsp.pki.goog"],
+ "questions": [{
+ "name": "ocsp.pki.goog",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 8,
+ "index": 1,
+ "dns_response": {
+ "domains": ["ocsp.pki.goog", "pki-goog.l.google.com"],
+ "ip": ["172.217.17.131"],
+ "answers": [{
+ "name": "ocsp.pki.goog",
+ "type": "IN CNAME",
+ "value": "pki-goog.l.google.com"
+ }, {
+ "name": "pki-goog.l.google.com",
+ "type": "IN A",
+ "value": "172.217.17.131"
+ }]
+ }
+ }, {
+ "flow": 9,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJ13zfQMBhkWtuM%3D",
+ "request": "GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJ13zfQMBhkWtuM%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/10.0", "Host: ocsp.pki.goog"]
+ }
+ }, {
+ "flow": 9,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Content-Type: application/ocsp-response", "Date: Sun, 14 Jun 2020 11:55:27 GMT", "Server: ocsp_responder", "Content-Length: 468", "X-XSS-Protection: 0", "X-Frame-Options: SAMEORIGIN", "Cache-Control: public, max-age=86400", "Age: 79749"]
+ }
+ }, {
+ "flow": 9,
+ "index": 2,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.pki.goog/gts1d2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT4YwNSyUnwC88de5a5l4eUO%2BLQewQUsd0yXei3N3LSzlzOJv5HeeIBCOkCEF0AC6SVi%2FG%2BCgAAAAAwZ%2B8%3D",
+ "request": "GET /gts1d2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT4YwNSyUnwC88de5a5l4eUO%2BLQewQUsd0yXei3N3LSzlzOJv5HeeIBCOkCEF0AC6SVi%2FG%2BCgAAAAAwZ%2B8%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/10.0", "Host: ocsp.pki.goog"]
+ }
+ }, {
+ "flow": 9,
+ "index": 2,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Content-Type: application/ocsp-response", "Date: Mon, 15 Jun 2020 10:04:18 GMT", "Server: ocsp_responder", "Content-Length: 471", "X-XSS-Protection: 0", "X-Frame-Options: SAMEORIGIN", "Cache-Control: public, max-age=86400", "Age: 18"]
+ }
+ }, {
+ "flow": 10,
+ "index": 1,
+ "dns_request": {
+ "domains": ["api.db-ip.com"],
+ "questions": [{
+ "name": "api.db-ip.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 10,
+ "index": 1,
+ "dns_response": {
+ "domains": ["api.db-ip.com", "api.db-ip.com", "api.db-ip.com"],
+ "ip": ["104.26.4.15", "172.67.75.166", "104.26.5.15"],
+ "answers": [{
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "104.26.4.15"
+ }, {
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "172.67.75.166"
+ }, {
+ "name": "api.db-ip.com",
+ "type": "IN A",
+ "value": "104.26.5.15"
+ }]
+ }
+ }, {
+ "flow": 11,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://api.db-ip.com/v2/free/154.61.71.13/countryName",
+ "request": "GET /v2/free/154.61.71.13/countryName HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: api.db-ip.com", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 11,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Date: Mon, 15 Jun 2020 10:04:37 GMT", "Content-Type: text/plain;charset=UTF-8", "Transfer-Encoding: chunked", "Connection: keep-alive", "Set-Cookie: __cfduid=daeb6c9df96161d7fdf1cb6872a1d21771592215477; expires=Wed, 15-Jul-20 10:04:37 GMT; path=/; domain=.db-ip.com; HttpOnly; SameSite=Lax", "Vary: Accept-Encoding", "Access-Control-Allow-Origin: *", "Cache-control: max-age=1800", "X-IPLB-Instance: 37097", "CF-Cache-Status: HIT", "Age: 18", "cf-request-id: 035909332c0000fa9cc3be1200000001", "Server: cloudflare", "CF-RAY: 5a3b77cb7c48fa9c-AMS", "alt-svc: h3-27=\":443\"; ma=86400"]
+ }
+ }, {
+ "flow": 12,
+ "index": 1,
+ "dns_request": {
+ "domains": ["iplogger.org"],
+ "questions": [{
+ "name": "iplogger.org",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 12,
+ "index": 1,
+ "dns_response": {
+ "domains": ["iplogger.org"],
+ "ip": ["88.99.66.31"],
+ "answers": [{
+ "name": "iplogger.org",
+ "type": "IN A",
+ "value": "88.99.66.31"
+ }]
+ }
+ }, {
+ "flow": 13,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "https://iplogger.org/1fRVq7",
+ "request": "GET /1fRVq7 HTTP/1.1",
+ "headers": ["User-Agent: Chrome", "Host: iplogger.org", "Cache-Control: no-cache"]
+ }
+ }, {
+ "flow": 13,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: nginx", "Date: Mon, 15 Jun 2020 10:04:39 GMT", "Content-Type: image/png", "Transfer-Encoding: chunked", "Connection: keep-alive", "Set-Cookie: PHPSESSID=j02tfjb1rkgcqfc10nv4c0vrr6; path=/; HttpOnly", "Pragma: no-cache", "Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/", "Cache-Control: no-cache", "Expires: Thu, 01 Jan 1970 00:00:01 GMT", "Answers: 1", "whoami: 1abf194eae8e9b03cd43be9ab4dedfad5cf6ae513e3c5e5c1333aabd48454073", "Strict-Transport-Security: max-age=31536000; preload", "X-Frame-Options: DENY"]
+ }
+ }, {
+ "flow": 14,
+ "index": 1,
+ "dns_request": {
+ "domains": ["isrg.trustid.ocsp.identrust.com"],
+ "questions": [{
+ "name": "isrg.trustid.ocsp.identrust.com",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 14,
+ "index": 1,
+ "dns_response": {
+ "domains": ["isrg.trustid.ocsp.identrust.com", "isrg.trustid.ocsp.identrust.com.edgesuite.net", "a279.dscq.akamai.net", "a279.dscq.akamai.net"],
+ "ip": ["95.100.96.193", "95.100.96.201"],
+ "answers": [{
+ "name": "isrg.trustid.ocsp.identrust.com",
+ "type": "IN CNAME",
+ "value": "isrg.trustid.ocsp.identrust.com.edgesuite.net"
+ }, {
+ "name": "isrg.trustid.ocsp.identrust.com.edgesuite.net",
+ "type": "IN CNAME",
+ "value": "a279.dscq.akamai.net"
+ }, {
+ "name": "a279.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.193"
+ }, {
+ "name": "a279.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.201"
+ }]
+ }
+ }, {
+ "flow": 15,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D",
+ "request": "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/10.0", "Host: isrg.trustid.ocsp.identrust.com"]
+ }
+ }, {
+ "flow": 15,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: Apache", "Content-transfer-encoding: Binary", "Last-Modified: Sat, 13 Jun 2020 23:51:10 GMT", "ETag: \"f71e2c741c6399bbdfdd29e3294bfca186fed14c\"", "Content-Type: application/ocsp-response", "Content-Length: 1398", "Cache-Control: public, no-transform, must-revalidate, max-age=34581", "Expires: Mon, 15 Jun 2020 19:41:00 GMT", "Date: Mon, 15 Jun 2020 10:04:39 GMT", "Connection: keep-alive"]
+ }
+ }, {
+ "flow": 16,
+ "index": 1,
+ "dns_request": {
+ "domains": ["ocsp.int-x3.letsencrypt.org"],
+ "questions": [{
+ "name": "ocsp.int-x3.letsencrypt.org",
+ "type": "IN A"
+ }]
+ }
+ }, {
+ "flow": 16,
+ "index": 1,
+ "dns_response": {
+ "domains": ["ocsp.int-x3.letsencrypt.org", "ocsp.int-x3.letsencrypt.org.edgesuite.net", "a771.dscq.akamai.net", "a771.dscq.akamai.net"],
+ "ip": ["95.100.96.171", "95.100.96.226"],
+ "answers": [{
+ "name": "ocsp.int-x3.letsencrypt.org",
+ "type": "IN CNAME",
+ "value": "ocsp.int-x3.letsencrypt.org.edgesuite.net"
+ }, {
+ "name": "ocsp.int-x3.letsencrypt.org.edgesuite.net",
+ "type": "IN CNAME",
+ "value": "a771.dscq.akamai.net"
+ }, {
+ "name": "a771.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.171"
+ }, {
+ "name": "a771.dscq.akamai.net",
+ "type": "IN A",
+ "value": "95.100.96.226"
+ }]
+ }
+ }, {
+ "flow": 17,
+ "index": 1,
+ "http_request": {
+ "method": "GET",
+ "url": "http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgQZw6LS9Be0oZi5BYcrjz8A4w%3D%3D",
+ "request": "GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgQZw6LS9Be0oZi5BYcrjz8A4w%3D%3D HTTP/1.1",
+ "headers": ["Connection: Keep-Alive", "Accept: */*", "User-Agent: Microsoft-CryptoAPI/10.0", "Host: ocsp.int-x3.letsencrypt.org"]
+ }
+ }, {
+ "flow": 17,
+ "index": 1,
+ "http_response": {
+ "status": "200",
+ "response": "HTTP/1.1 200 OK",
+ "headers": ["Server: nginx", "Content-Type: application/ocsp-response", "Content-Length: 527", "ETag: \"ADACA9354566434F0931FB5330579C8748ED3D9B7396315A84E3C22FEBA11311\"", "Last-Modified: Sat, 13 Jun 2020 22:00:00 UTC", "Cache-Control: public, no-transform, must-revalidate, max-age=38008", "Expires: Mon, 15 Jun 2020 20:38:07 GMT", "Date: Mon, 15 Jun 2020 10:04:39 GMT", "Connection: keep-alive"]
+ }
+ }]
+ },
+ "dumped": [{
+ "at": 25703,
+ "pid": 3812,
+ "procid": 65,
+ "name": "memory/3812-0-0x000000000084A000-0x000000000084B000-memory.dmp",
+ "kind": "region",
+ "addr": 8691712,
+ "length": 4096
+ }, {
+ "at": 25703,
+ "pid": 3812,
+ "procid": 65,
+ "name": "memory/3812-1-0x00000000022D0000-0x00000000022D1000-memory.dmp",
+ "kind": "region",
+ "addr": 36503552,
+ "length": 4096
+ }, {
+ "at": 61500,
+ "pid": 2836,
+ "procid": 221,
+ "path": "C:\\Users\\Admin\\NEMTY_2ELOZ2T-DECRYPT.txt",
+ "name": "files/0x000100000001ad8e-3.dat",
+ "kind": "martian"
+ }],
+ "extracted": [{
+ "path": "C:\\NEMTY_2ELOZ2T-DECRYPT.txt",
+ "ransom_note": {
+ "emails": ["elzmflqxj@tutanota.de", "helpdesk_nemty@aol.com"],
+ "note": "---\u003e NEMTY REVENGE 2.0 \u003c---\r\n\r\nDon't worry, some of your files have extension .NEMTY_2ELOZ2T and they are encrypted.\r\nBut you can return them!\r\n\r\nIn confirmatiom, that we have private decryption key,\r\nWe can provide test decryption for 1 file (png,jpg,bmp,gif).\r\nIt's a business, if we can't provide full decryption, other people won't trust us.\r\n\r\nThere is no way to decrypt your files without our help.\r\nDon't trust anyone. Even your dog.\r\n\r\nmain mail: elzmflqxj@tutanota.de\r\nif no answer: helpdesk_nemty@aol.com\r\n\r\nDon't change decryption key below!!!\r\n\r\nNEMTY DECRYPTION KEY:\r\n\r\nhy+05QaKKA6zUHwvx6/pVHM2nNbKrLk+40qqfIicZHdxQaZ5yaYOpS0WkZdohhwXMDZZcec/HzK8PR3+ybHy+A/XUUkUBax1smFbUvQa8mToyBXgVEM3zDhzBZBH733yiT4PCmpsLmVNz3TP3DP7fGje5Ot6CqOMaNef+oXSxbsPUKSo/BHRk1oMLUdUzeQWSPognJTRNee6Qzm14BgqrpNERuGvctKjC5xNCUIw+vdWukx6jABSSma0bzPPgB9IXWm4EtMiUsqwMdJjkMe4CjGiAsob5c2lxO3dEiR8Jqi/xYcc/uqR5wQh++JZLmsDVuu71FkSAAWEjFociWMiUizdzAVWqMmp/UuzxcpmFYJY3qIiNLsewkXP1f5UUTKtU6eGPQE0VSLeknkVgBab1kIjiHs5Dc16YcGvkUtcLzslvOyQxx+dW0CJnxJspH64Wox2NSsDTucFyoV4e1U/J/C58hXdTI9Vz4kHQ3VwqbxMmL9JxYDsLSSXEEGiJDq3xTQjg75mMH/SIzDmif6wJs17L30sUOzfS3blblZn2zP0u/wYC95rjpxooVhlIeybyMZLYXunlT6N24u9QoZ5ZULat49ItQNGncXa8JRlD4pM5C/Slj8tCD2R2fFviV1kFZP7IgmUBp3ccPPFxg04JOfxqGA5SIWkX/hsz+u4QjvsghYkP7MbVHzh6GMkgYpNXy95T1rN041gZXlghSgC8FbOCGJgOFnfLF5CPl9Hc3+aVOiYfAR7P0VIfRaGA68Ycow2CMSVnCAEjFGCyGnfx8OXXqGFVImzFB9OkeEokmd+QL1dZxIT/sU9AgVy9AFjwwxmgurEjIe19++EBwhiFC4U1WjVedRtFNs90kGuuODulwuilxYLaBQv8Pr9PbvJD/3TGKHS1r/YZV2IDsu6xcsim6016+S3oI0F6EVA7pWcc5v95OBDhOMUyCXtyQGZ/eyUa3Cdftju7sG92C5UVC/LH4bSrqqfom/+F7qHi4+tKdcrETVMqEeB0SLDV7bq0Q0VaBbX8D6w2CcBt4yloO7kFNL9bxOw1w9ATZjssCdGW1UOAITVsoR2H+7OTRI11c14wFV31tfwc5cV1BXVjKcv3Q/66nI7QSGNEwoIskWC3q6m3+ZTmDNrgVsTrFyamRbGqIWP7+6mUBFkydHNgGuMvMjrEMGPbMP+fWj3fzwDT7Q6gimqYm0INfN2vyK3abfDLbg/1XKGv8HSuRhQ1CqgDEHxehwiQce2qz3uzwUdC5gPrJ2X9pvRzpiwMkW38Y5F5zZD4HZOxvgj3QAyvLZmDlwooQGsVSrNiG72pMCe0baVdEzXNnb+Nt/ayLMXfV6GnUd7WUC8R4TIVoA+GQ==tHssHfka+P62bpb6+ags1ct3ylSrjrpF1bMn8jDyjPD7qIw3bSaN0NySPLqvHWc8ImhIYK1nWZoUwp6iaQjtEvDnFUYFfa4eueUhsWsdIdSrrRhd5lF0VtQ14VLS6tE4ZIZwLXgu1z7vm0jzrEuZf2amwlp1ZsAsdtRuG7q8OeIKdKTni/Qv+0RaIAs2NbKNqIfQn+9e+iMut87RMquHta17DGTt+kkPV/iZAvt2fBwKjAXVT0HXJ86NwEu1gf0OD6lULNIYQEvSqN79GLrQCfNs5tQh5K+iWN2MPk9LbRL9fUJxrkcWzlSHaG0etbgGrIS/qwMRdjDNSg44XItzN4+A2u7M4y6JO2ieTvalD5BJoMsjNFYolFVCvmlQGQbOY73XFqWqBvMuEik7HfTWuRa31BBYDWgiGDvljR893NOFmoYRyxJfMOtNh967O2MpHr4BdLPE6lK3l/y9bWH2/W6IqVFRDSQJixNndy9gjUHU/8w6EZEWgTJXKBSMIOqRSbvO/+V4Z1jpTf+ECCg7fQFHidC4iL4NG30+/7ugkOWJOqOLhH476s8Ladk8N2ikmikUDYRIpcMSveL5GJt2w5zbbhYAbSWh6jfyMG+OztecwKlaem1m6NFIvyv8Rj+JWCT4lP8KUtwyhVABNVvfsj/mqlOMg+T3UBT7bHiGsZGfpaU1nh5ZTpMAfeSP622Ciw4Zg/zaZzE4eiQoKvGIT9liQ4VsOoscqCRDeCVVjoQrC80873pMb4ksQKcfx8T1wngYKIyN7Q+2KTpc1zII7+t0KhIbVkQlAO1j7uLrWqSRsAHzleUQ1jMUoMT/eyMRHwTd4cEF34t+v9+bBosZ4p0wFUMQef5pgl2HICq9+h7l4DkcBtseYY4BnSjpe6yy7DftFcC58jezyiFeOPPU1fYrZ6s/Z5o5ZclJEF5LOl11OUvNjBHOD2+8ZCWQjDMPR4qY4BDZcAm6n6jwQl68p8s2RW5z9UDdR2dGTScmjvy3DF1QbVwz/qenVJInCMwkIBdPCZsRM0AajEwJabTS+breX5NC8s9Uwuk9EoAcx6T3+JpRMIG8k1okBL53+5Kst5QF7dNfKy9ij2zo60QvV7kFra+f1YYCwU4qq1ZVeMjTU8AxTsiwresboW4EsA+/fgN+18wplJ7+gPGSLQORpQwnG+bxeNFpYy5fje9Eu2tuGa6C0x9zJWfO7Prf8lmJqm/ByfBczqbD3N9aHrlqGQsCiwB5iSjKOs6/axrFzbYNFfLSQBQXkmK+u6SY6Ba/Rp8GHQ6nxXCWeFhwn9WiQbBM9hUajNmHfVx5wL1V4pPry7yy/bxLd9JccNiKY9l2/Nsqzfc2D+B1uQLuqTtUSQ=="
+ }
+ }]
+}
\ No newline at end of file
diff --git a/tests/resources/triage_check.json b/tests/resources/triage_check.json
new file mode 100644
index 0000000..10abfed
--- /dev/null
+++ b/tests/resources/triage_check.json
@@ -0,0 +1,4 @@
+{
+ "sample":"200615-8jbndpgg9n",
+ "status":"reported"
+}
diff --git a/tests/resources/triage_report.json b/tests/resources/triage_report.json
new file mode 100644
index 0000000..894301a
--- /dev/null
+++ b/tests/resources/triage_report.json
@@ -0,0 +1,39 @@
+{
+ "sample": "200615-8jbndpgg9n",
+ "status": "reported",
+ "custom": "frontend:b77b1c44-2965-4580-b444-a63f02d3a9d3",
+ "owner": "shark2.ams5.hatching.io",
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "created": "2020-06-15T10:04:02Z",
+ "completed": "2020-06-15T10:06:44Z",
+ "score": 10,
+ "sha256": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5",
+ "tasks": {
+ "200615-8jbndpgg9n-behavioral1": {
+ "kind": "behavioral",
+ "status": "reported",
+ "tags": ["ransomware", "persistence", "family:nemty"],
+ "score": 10,
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "backend": "horse2",
+ "resource": "win7v200430",
+ "platform": "windows7_x64",
+ "queue_id": 1355315
+ },
+ "200615-8jbndpgg9n-behavioral2": {
+ "kind": "behavioral",
+ "status": "reported",
+ "tags": ["ransomware", "family:nemty", "persistence"],
+ "score": 10,
+ "target": "2ebe4c68225206161c70cf3e0da39294e9353ee295db2dc5d4f86ce7901210c5.exe",
+ "backend": "horse2",
+ "resource": "win10v200430",
+ "platform": "windows10_x64",
+ "queue_id": 1355316
+ },
+ "200615-8jbndpgg9n-static1": {
+ "kind": "static",
+ "status": "reported"
+ }
+ }
+}
\ No newline at end of file
diff --git a/tests/test_cuckoo.py b/tests/test_cuckoo.py
new file mode 100644
index 0000000..7de0f98
--- /dev/null
+++ b/tests/test_cuckoo.py
@@ -0,0 +1,98 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import responses
+import sandboxapi.cuckoo
+from . import read_resource
+
+class TestCuckoo(TestCase):
+
+ def setUp(self):
+ self.sandbox = sandboxapi.cuckoo.CuckooAPI('http://cuckoo.mock:8090/')
+
+ @responses.activate
+ def test_analyses(self):
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/list',
+ json=read_resource('cuckoo_tasks_list'))
+ self.assertEqual(len(self.sandbox.analyses()), 2)
+
+ @responses.activate
+ def test_analyze(self):
+ responses.add(responses.POST, 'http://cuckoo.mock:8090/tasks/create/file',
+ json=read_resource('cuckoo_tasks_create_file'))
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '1')
+
+ @responses.activate
+ def test_check(self):
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/view/1',
+ json=read_resource('cuckoo_tasks_view'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/cuckoo/status',
+ json=read_resource('cuckoo_status'))
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_is_available(self):
+ self.assertFalse(self.sandbox.is_available())
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/cuckoo/status',
+ status=500)
+ self.assertFalse(self.sandbox.is_available())
+
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/report/8/json',
+ json=read_resource('cuckoo_tasks_report'))
+ self.assertEqual(self.sandbox.report(8)['info']['id'], 8)
+
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/report/8/json',
+ json=read_resource('cuckoo_tasks_report'))
+ self.assertEqual(self.sandbox.score(self.sandbox.report(8)), 5)
+
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+
+ m_get.return_value.status_code = 200
+ m_post.return_value.status_code = 200
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock',
+ proxies=proxies)
+ api._request('/test')
+
+ m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, params=MOCK_ANY,
+ proxies=proxies, verify=MOCK_ANY)
+
+ api._request('/test', method='POST')
+
+ m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, data=MOCK_ANY,
+ files=None, proxies=proxies,
+ verify=MOCK_ANY)
+
+ @responses.activate
+ def test_cuckoo_old_style_host_port_path(self):
+ sandbox = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock')
+ responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/list',
+ json=read_resource('cuckoo_tasks_list'))
+ self.assertEqual(len(self.sandbox.analyses()), 2)
+
+ sandbox = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock', 9090, '/test')
+ responses.add(responses.GET, 'http://cuckoo.mock:9090/test/tasks/list',
+ json=read_resource('cuckoo_tasks_list'))
+ self.assertEqual(len(self.sandbox.analyses()), 2)
diff --git a/tests/test_falcon.py b/tests/test_falcon.py
new file mode 100644
index 0000000..f042a30
--- /dev/null
+++ b/tests/test_falcon.py
@@ -0,0 +1,81 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import responses
+import sandboxapi.falcon
+
+from . import read_resource
+
+class TestFalcon(TestCase):
+
+ def setUp(self):
+ self.sandbox = sandboxapi.falcon.FalconAPI('key', 'http://falcon.mock/api/v2')
+
+ @responses.activate
+ def test_analyze(self):
+ responses.add(responses.POST, 'http://falcon.mock/api/v2/submit/file',
+ json=read_resource('falcon_submit_file'), status=201)
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '1')
+
+ @responses.activate
+ def test_check(self):
+ responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/state',
+ json=read_resource('falcon_report_state'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.GET, 'http://falcon.mock/api/v2/system/heartbeat',
+ json=read_resource('falcon_system_heartbeat'))
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_is_available(self):
+ self.assertFalse(self.sandbox.is_available())
+ responses.add(responses.GET, 'http://falcon.mock/api/v2/system/heartbeat',
+ status=500)
+ self.assertFalse(self.sandbox.is_available())
+
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/summary',
+ json=read_resource('falcon_report_summary'))
+ self.assertEqual(self.sandbox.report(1)['job_id'], '1')
+
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/summary',
+ json=read_resource('falcon_report_summary'))
+ self.assertEqual(self.sandbox.score(self.sandbox.report(1)), 5)
+
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+
+ m_get.return_value.status_code = 200
+ m_post.return_value.status_code = 200
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.falcon.FalconAPI('key', self.sandbox.api_url,
+ proxies=proxies)
+ api._request('/test')
+
+ m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, params=MOCK_ANY,
+ proxies=proxies, verify=MOCK_ANY)
+
+ api._request('/test', method='POST')
+
+ m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, data=MOCK_ANY,
+ files=None, proxies=proxies,
+ verify=MOCK_ANY)
diff --git a/tests/test_fireeye.py b/tests/test_fireeye.py
new file mode 100644
index 0000000..bbefd94
--- /dev/null
+++ b/tests/test_fireeye.py
@@ -0,0 +1,167 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import responses
+import sandboxapi.fireeye
+from . import read_resource
+
+class TestFireEye(TestCase):
+ sandbox = sandboxapi.fireeye.FireEyeAPI('username', 'password', 'http://fireeye.mock', 'profile')
+
+ @responses.activate
+ def test_analyze(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/submissions',
+ json=read_resource('fireeye_submissions'))
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1)
+
+ @responses.activate
+ def test_check(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
+ json=read_resource('fireeye_submissions_status'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/config',
+ json=read_resource('fireeye_config'))
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_is_available(self):
+ self.assertFalse(self.sandbox.is_available())
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/config',
+ status=500)
+ self.assertFalse(self.sandbox.is_available())
+
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/results/1',
+ json=read_resource('fireeye_submissions_results'))
+ self.assertEqual(self.sandbox.report(1)['msg'], 'concise')
+
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/results/1',
+ json=read_resource('fireeye_submissions_results'))
+ self.assertEqual(self.sandbox.score(self.sandbox.report(1)), 8)
+
+ # Core functionality.
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+
+ m_get.return_value.status_code = 200
+ m_get.return_value.content = b''
+ m_post.return_value.status_code = 200
+ m_post.return_value.content = b''
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.fireeye.FireEyeAPI('username', 'password',
+ self.sandbox.api_url, 'profile',
+ proxies=proxies)
+ api._request('/test')
+
+ m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, params=MOCK_ANY,
+ proxies=proxies, verify=MOCK_ANY)
+
+ api._request('/test', method='POST')
+
+ m_post.assert_called_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, data=MOCK_ANY,
+ files=None, proxies=proxies,
+ verify=MOCK_ANY)
+
+ @responses.activate
+ def test_reauthenticates_if_logged_out_http_401(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
+ status=401)
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
+ json=read_resource('fireeye_submissions_status'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_reauthenticates_if_logged_out_json_401(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
+ json=read_resource('fireeye_unauthorized'))
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
+ json=read_resource('fireeye_submissions_status'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+class TestFireEyeLegacy(TestCase):
+ legacy_sandbox = sandboxapi.fireeye.FireEyeAPI('username', 'password', 'http://fireeye.mock', 'profile', legacy_api=True)
+
+ # Legacy API support
+ @responses.activate
+ def legacy_test_analyze(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/submissions',
+ json=read_resource('fireeye_submissions'))
+ self.assertEqual(self.legacy_sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1)
+
+ @responses.activate
+ def legacy_test_check(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/status/1',
+ json=read_resource('fireeye_submissions_status'))
+ self.assertEqual(self.legacy_sandbox.check('1'), True)
+
+ @responses.activate
+ def legacy_test_is_available(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/config',
+ json=read_resource('fireeye_config'))
+ self.assertTrue(self.legacy_sandbox.is_available())
+
+ @responses.activate
+ def legacy_test_not_is_available(self):
+ self.assertFalse(self.legacy_sandbox.is_available())
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/config',
+ status=500)
+ self.assertFalse(self.legacy_sandbox.is_available())
+
+ @responses.activate
+ def legacy_test_report(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/results/1',
+ json=read_resource('fireeye_submissions_results'))
+ self.assertEqual(self.legacy_sandbox.report(1)['msg'], 'concise')
+
+ @responses.activate
+ def legacy_test_score(self):
+ responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
+ headers={'X-FeApi-Token': 'MOCK'})
+ responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/results/1',
+ json=read_resource('fireeye_submissions_results'))
+ self.assertEqual(self.legacy_sandbox.score(self.legacy_sandbox.report(1)), 8)
\ No newline at end of file
diff --git a/tests/test_joe.py b/tests/test_joe.py
new file mode 100644
index 0000000..97909b8
--- /dev/null
+++ b/tests/test_joe.py
@@ -0,0 +1,78 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch
+except ImportError:
+ from mock import patch
+
+import responses
+import sandboxapi.joe
+import jbxapi
+from . import read_resource
+
+class TestJoe(TestCase):
+
+ def setUp(self):
+ self.sandbox = sandboxapi.joe.JoeAPI('key', 'http://joe.mock/api', True)
+
+ @responses.activate
+ def test_analyze(self):
+ if not jbxapi.__version__.startswith("2"):
+ responses.add(responses.POST, 'http://joe.mock/api/v2/submission/new',
+ json=read_resource('joe_submission_new'))
+ else:
+ responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/submit',
+ json=read_resource('joe_analysis_submit'))
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '100001')
+
+ @responses.activate
+ def test_check(self):
+ if not jbxapi.__version__.startswith("2"):
+ responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/info',
+ json=read_resource('joe_analysis_info'))
+ else:
+ responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/info',
+ json=read_resource('joe_analysis_info'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.POST, 'http://joe.mock/api/v2/server/online',
+ json=read_resource('joe_server_online'))
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_is_available(self):
+ self.assertFalse(self.sandbox.is_available())
+ responses.add(responses.POST, 'http://joe.mock/api/v2/server/online',
+ status=500)
+ self.assertFalse(self.sandbox.is_available())
+
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/download',
+ json=read_resource('joe_analysis_download'))
+ self.assertEqual(self.sandbox.report(8)['analysis']['signaturedetections']['strategy'][1]['score'], 1)
+
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/download',
+ json=read_resource('joe_analysis_download'))
+ self.assertEqual(self.sandbox.score(self.sandbox.report(1)), 1)
+
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+
+ m_get.return_value.status_code = 200
+ m_post.return_value.status_code = 200
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.joe.JoeAPI('key', self.sandbox.jbx.apiurl, True,
+ proxies=proxies)
+ self.assertEqual(api.jbx.session.proxies, proxies)
diff --git a/tests/test_opswat.py b/tests/test_opswat.py
new file mode 100644
index 0000000..3aea325
--- /dev/null
+++ b/tests/test_opswat.py
@@ -0,0 +1,108 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch
+except ImportError:
+ from mock import patch
+
+import responses
+import sandboxapi.opswat
+from . import read_resource
+
+
+URL = "http://filescanio.mock"
+
+
+class TestMetaDefenderSandbox(TestCase):
+ def setUp(self):
+ self.sandbox = sandboxapi.opswat.MetaDefenderSandboxAPI("key", URL, True)
+
+ # analyze
+ @responses.activate
+ def test_analyze(self):
+ sent_file_response = {"flow_id": "1234"}
+
+ responses.add(responses.POST, f"{URL}/api/scan/file", json=sent_file_response)
+ self.assertEqual(
+ self.sandbox.analyze(io.BytesIO("test".encode("ascii")), "filename"), "1234"
+ )
+
+ # check
+ @responses.activate
+ def test_check(self):
+ flow_id = 1
+ finished = [
+ ("opswat_submissions_result_malicious", True),
+ ("opswat_submissions_result_not_finished", False),
+ ]
+ for report in finished:
+ responses.add(
+ responses.GET,
+ f"{URL}/api/scan/{flow_id}/report",
+ json=read_resource(report[0]),
+ )
+ self.assertEqual(self.sandbox.check("1"), report[1])
+
+ # is available
+ @responses.activate
+ def test_is_available(self):
+ response = {
+ "accountId": "1234",
+ }
+ responses.add(responses.GET, f"{URL}/api/users/me", json=response)
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_available(self):
+ response = {
+ "accountId": "1234",
+ }
+ responses.add(responses.GET, f"{URL}/api/users/me", json=response, status=404)
+ self.assertFalse(self.sandbox.is_available())
+
+ # report
+ @responses.activate
+ def test_report(self):
+ id = 1
+ url = f"{URL}/api/scan/{id}/report?filter=general&filter=finalVerdict&filter=allTags&filter=overallState&filter=taskReference&filter=subtaskReferences&filter=allSignalGroups&filter=iocs"
+
+ responses.add(
+ responses.GET,
+ url,
+ json=read_resource("opswat_submissions_result_malicious"),
+ )
+
+ response = self.sandbox.report(id)
+ self.assertEqual(
+ response,
+ read_resource("opswat_submissions_result_malicious"),
+ )
+
+ self.assertEqual(
+ response["reports"]["f7977db1-6a99-46c3-8567-de1c88c93aa4"]["finalVerdict"][
+ "verdict"
+ ],
+ "MALICIOUS",
+ )
+
+ # score
+ @responses.activate
+ def test_score(self):
+ id = 1
+ files_and_score = [
+ ("opswat_submissions_result_malicious", 100),
+ ("opswat_submissions_result_suspicious", 50),
+ ("opswat_submissions_result_benign", 0),
+ ("opswat_submissions_result_likely_malicious", 75),
+ ]
+
+ for file_and_score in files_and_score:
+ responses.add(
+ responses.GET,
+ f"{URL}/api/scan/{id}/report?filter=general&filter=finalVerdict&filter=allTags&filter=overallState&filter=taskReference&filter=subtaskReferences&filter=allSignalGroups&filter=iocs",
+ json=read_resource(file_and_score[0]),
+ )
+ self.assertEqual(
+ self.sandbox.score(self.sandbox.report(id)), file_and_score[1]
+ )
diff --git a/tests/test_sandboxapi.py b/tests/test_sandboxapi.py
new file mode 100644
index 0000000..77e7dbc
--- /dev/null
+++ b/tests/test_sandboxapi.py
@@ -0,0 +1,35 @@
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import sandboxapi
+
+class TestSandboxAPI(TestCase):
+
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+ m_get.return_value.status_code = 200
+ m_post.return_value.status_code = 200
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.SandboxAPI(proxies=proxies)
+ api.api_url = 'http://sandbox.mock'
+ api._request('/test')
+
+ m_get.assert_called_once_with('http://sandbox.mock/test', auth=None,
+ headers=None, params=None, proxies=proxies,
+ verify=True)
+
+ api._request('/test', method='POST')
+
+ m_post.assert_called_once_with('http://sandbox.mock/test', auth=None,
+ headers=None, data=None, files=None,
+ proxies=proxies, verify=True)
diff --git a/tests/test_triage.py b/tests/test_triage.py
new file mode 100644
index 0000000..9b4b55a
--- /dev/null
+++ b/tests/test_triage.py
@@ -0,0 +1,76 @@
+import io
+import unittest
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import responses
+import sandboxapi.triage
+from . import read_resource
+
+class TestTriage(unittest.TestCase):
+ def setUp(self):
+ self.sandbox = sandboxapi.triage.TriageAPI("key", "https://tria.mock")
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_analyze(self):
+ responses.add(responses.POST, "https://tria.mock/api/v0/samples",
+ json=read_resource('triage_analyze'), status=200)
+ triage_id = self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), "testfile")
+ self.assertEqual(triage_id, "200707-pht1cwk3ls")
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_check(self):
+ responses.add(responses.GET,
+ 'https://tria.mock/api/v0/samples/test/status',
+ json=read_resource('triage_check'), status=200)
+ self.assertTrue(self.sandbox.check("test"))
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.GET, 'https://tria.mock/api/v0/samples',
+ json=read_resource('triage_available'), status=200)
+ self.assertTrue(self.sandbox.is_available())
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.GET,
+ 'https://tria.mock/api/v0/samples/test/summary',
+ json=read_resource('triage_report'), status=200)
+ data = self.sandbox.report("test")
+ self.assertEqual(
+ 10, data["tasks"]["200615-8jbndpgg9n-behavioral1"]["score"])
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.GET,
+ 'https://tria.mock/api/v0/samples/test/summary',
+ json=read_resource('triage_report'), status=200)
+ score = self.sandbox.score("test")
+ self.assertEqual(10, score)
+
+ @unittest.skip("Need to update tests JSON response data")
+ @responses.activate
+ def test_full_report(self):
+ responses.add(responses.GET,
+ 'https://tria.mock/v0/api/samples/200615-8jbndpgg9n/summary',
+ json=read_resource('triage_report'), status=200)
+ responses.add(responses.GET,
+ 'https://tria.mock/api/v0/samples/200615-8jbndpgg9n/behavioral1/report_triage.json',
+ json=read_resource('triage_behavioral1'), status=200)
+ responses.add(responses.GET,
+ 'https://tria.mock/api/v0/samples/200615-8jbndpgg9n/behavioral2/report_triage.json',
+ json=read_resource('triage_behavioral2'), status=200)
+
+ full_report = self.sandbox.full_report("200615-8jbndpgg9n")
+ self.assertTrue(full_report["tasks"]["behavioral1"]["sample"]["score"],
+ 10)
+ self.assertTrue(full_report["tasks"]["behavioral2"]["sample"]["score"],
+ 10)
diff --git a/tests/test_vmray.py b/tests/test_vmray.py
new file mode 100644
index 0000000..b0b4501
--- /dev/null
+++ b/tests/test_vmray.py
@@ -0,0 +1,91 @@
+import io
+from unittest import TestCase
+
+try:
+ from unittest.mock import patch, ANY as MOCK_ANY
+except ImportError:
+ from mock import patch, ANY as MOCK_ANY
+
+import responses
+import sandboxapi.vmray
+from . import read_resource
+
+class TestVMRay(TestCase):
+
+ def setUp(self):
+ self.sandbox = sandboxapi.vmray.VMRayAPI('key', 'http://vmray.mock')
+
+ @responses.activate
+ def test_analyze(self):
+ responses.add(responses.POST, 'http://vmray.mock/rest/sample/submit',
+ json=read_resource('vmray_sample_submit'))
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1169850)
+
+ @responses.activate
+ def test_analyze_with_errors(self):
+ responses.add(responses.POST, 'http://vmray.mock/rest/sample/submit',
+ json=read_resource('vmray_sample_submit_errors'))
+ with self.assertRaises(sandboxapi.SandboxError):
+ self.assertEqual(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'))
+
+ @responses.activate
+ def test_check(self):
+ responses.add(responses.GET, 'http://vmray.mock/rest/submission/sample/1',
+ json=read_resource('vmray_submission_sample'))
+ self.assertEqual(self.sandbox.check('1'), True)
+
+ @responses.activate
+ def test_is_available(self):
+ responses.add(responses.GET, 'http://vmray.mock/rest/system_info',
+ json=read_resource('vmray_system_info'))
+ self.assertTrue(self.sandbox.is_available())
+
+ @responses.activate
+ def test_not_is_available(self):
+ self.assertFalse(self.sandbox.is_available())
+ responses.add(responses.GET, 'http://vmray.mock/rest/system_info',
+ status=500)
+ self.assertFalse(self.sandbox.is_available())
+
+ @responses.activate
+ def test_report(self):
+ responses.add(responses.GET, 'http://vmray.mock/rest/analysis/sample/1',
+ json=read_resource('vmray_analysis_sample'))
+ responses.add(responses.GET, 'http://vmray.mock/rest/analysis/1097123/archive/logs/summary.json',
+ json=read_resource('vmray_analysis_archive_logs_summary'))
+ self.assertEqual(self.sandbox.report(1)['version'], 1)
+
+ @responses.activate
+ def test_score(self):
+ responses.add(responses.GET, 'http://vmray.mock/rest/analysis/sample/1',
+ json=read_resource('vmray_analysis_sample'))
+ responses.add(responses.GET, 'http://vmray.mock/rest/analysis/1097123/archive/logs/summary.json',
+ json=read_resource('vmray_analysis_archive_logs_summary'))
+ self.assertEqual(self.sandbox.score(self.sandbox.report(1)), 20)
+
+ @patch('requests.post')
+ @patch('requests.get')
+ def test_proxies_is_passed_to_requests(self, m_get, m_post):
+
+ m_get.return_value.status_code = 200
+ m_post.return_value.status_code = 200
+
+ proxies = {
+ 'http': 'http://10.10.1.10:3128',
+ 'https': 'http://10.10.1.10:1080',
+ }
+
+ api = sandboxapi.vmray.VMRayAPI('key', self.sandbox.api_url,
+ proxies=proxies)
+ api._request('/test')
+
+ m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, params=MOCK_ANY,
+ proxies=proxies, verify=MOCK_ANY)
+
+ api._request('/test', method='POST')
+
+ m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
+ headers=MOCK_ANY, data=MOCK_ANY,
+ files=None, proxies=proxies,
+ verify=MOCK_ANY)
diff --git a/tests/tests.py b/tests/tests.py
deleted file mode 100644
index d4747e9..0000000
--- a/tests/tests.py
+++ /dev/null
@@ -1,506 +0,0 @@
-import io
-import os
-import json
-import unittest
-try:
- from unittest.mock import patch, ANY as MOCK_ANY
-except ImportError:
- from mock import patch, ANY as MOCK_ANY
-
-import responses
-
-import sandboxapi.cuckoo
-import sandboxapi.fireeye
-import sandboxapi.joe
-import sandboxapi.vmray
-import sandboxapi.falcon
-
-def read_resource(resource):
- with open(os.path.join('tests', 'resources', '{r}.json'.format(r=resource)), 'r') as f:
- return json.loads(f.read())
-
-
-class TestCuckoo(unittest.TestCase):
-
- def setUp(self):
- self.sandbox = sandboxapi.cuckoo.CuckooAPI('http://cuckoo.mock:8090/')
-
- @responses.activate
- def test_analyses(self):
- responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/list',
- json=read_resource('cuckoo_tasks_list'))
- self.assertEquals(len(self.sandbox.analyses()), 2)
-
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://cuckoo.mock:8090/tasks/create/file',
- json=read_resource('cuckoo_tasks_create_file'))
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '1')
-
- @responses.activate
- def test_check(self):
- responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/view/1',
- json=read_resource('cuckoo_tasks_view'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.GET, 'http://cuckoo.mock:8090/cuckoo/status',
- json=read_resource('cuckoo_status'))
- self.assertTrue(self.sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.sandbox.is_available())
- responses.add(responses.GET, 'http://cuckoo.mock:8090/cuckoo/status',
- status=500)
- self.assertFalse(self.sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/report/8/json',
- json=read_resource('cuckoo_tasks_report'))
- self.assertEquals(self.sandbox.report(8)['info']['id'], 8)
-
- @responses.activate
- def test_score(self):
- responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/report/8/json',
- json=read_resource('cuckoo_tasks_report'))
- self.assertEquals(self.sandbox.score(self.sandbox.report(8)), 5)
-
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
-
- m_get.return_value.status_code = 200
- m_post.return_value.status_code = 200
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock',
- proxies=proxies)
- api._request('/test')
-
- m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, params=MOCK_ANY,
- proxies=proxies, verify=MOCK_ANY)
-
- api._request('/test', method='POST')
-
- m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, data=MOCK_ANY,
- files=None, proxies=proxies,
- verify=MOCK_ANY)
-
- @responses.activate
- def test_cuckoo_old_style_host_port_path(self):
- sandbox = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock')
- responses.add(responses.GET, 'http://cuckoo.mock:8090/tasks/list',
- json=read_resource('cuckoo_tasks_list'))
- self.assertEquals(len(self.sandbox.analyses()), 2)
-
- sandbox = sandboxapi.cuckoo.CuckooAPI('cuckoo.mock', 9090, '/test')
- responses.add(responses.GET, 'http://cuckoo.mock:9090/test/tasks/list',
- json=read_resource('cuckoo_tasks_list'))
- self.assertEquals(len(self.sandbox.analyses()), 2)
-
-
-
-class TestJoe(unittest.TestCase):
-
- def setUp(self):
- self.sandbox = sandboxapi.joe.JoeAPI('key', 'http://joe.mock/api', True)
-
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/submit',
- json=read_resource('joe_analysis_submit'))
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '100001')
-
- @responses.activate
- def test_check(self):
- responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/info',
- json=read_resource('joe_analysis_info'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.POST, 'http://joe.mock/api/v2/server/online',
- json=read_resource('joe_server_online'))
- self.assertTrue(self.sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.sandbox.is_available())
- responses.add(responses.POST, 'http://joe.mock/api/v2/server/online',
- status=500)
- self.assertFalse(self.sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/download',
- json=read_resource('joe_analysis_download'))
- self.assertEquals(self.sandbox.report(8)['analysis']['signaturedetections']['strategy'][1]['score'], 1)
-
- @responses.activate
- def test_score(self):
- responses.add(responses.POST, 'http://joe.mock/api/v2/analysis/download',
- json=read_resource('joe_analysis_download'))
- self.assertEquals(self.sandbox.score(self.sandbox.report(1)), 1)
-
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
-
- m_get.return_value.status_code = 200
- m_post.return_value.status_code = 200
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.joe.JoeAPI('key', self.sandbox.jbx.apiurl, True,
- proxies=proxies)
- self.assertEquals(api.jbx.session.proxies, proxies)
-
-
-class TestFireEye(unittest.TestCase):
-
- def setUp(self):
- self.sandbox = sandboxapi.fireeye.FireEyeAPI('username', 'password', 'http://fireeye.mock', 'profile')
- self.legacy_sandbox = sandboxapi.fireeye.FireEyeAPI('username', 'password',
- 'http://fireeye.mock', 'profile',
- legacy_api=True)
-
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/submissions',
- json=read_resource('fireeye_submissions'))
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1)
-
- @responses.activate
- def test_check(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
- json=read_resource('fireeye_submissions_status'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/config',
- json=read_resource('fireeye_config'))
- self.assertTrue(self.sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.sandbox.is_available())
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/config',
- status=500)
- self.assertFalse(self.sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/results/1',
- json=read_resource('fireeye_submissions_results'))
- self.assertEquals(self.sandbox.report(1)['msg'], 'concise')
-
- @responses.activate
- def test_score(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/results/1',
- json=read_resource('fireeye_submissions_results'))
- self.assertEquals(self.sandbox.score(self.sandbox.report(1)), 8)
-
- # Legacy API support.
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/submissions',
- json=read_resource('fireeye_submissions'))
- self.assertEquals(self.legacy_sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1)
-
- @responses.activate
- def test_check(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/status/1',
- json=read_resource('fireeye_submissions_status'))
- self.assertEquals(self.legacy_sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/config',
- json=read_resource('fireeye_config'))
- self.assertTrue(self.legacy_sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.legacy_sandbox.is_available())
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/config',
- status=500)
- self.assertFalse(self.legacy_sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/results/1',
- json=read_resource('fireeye_submissions_results'))
- self.assertEquals(self.legacy_sandbox.report(1)['msg'], 'concise')
-
- @responses.activate
- def test_score(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.1.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.1.0/submissions/results/1',
- json=read_resource('fireeye_submissions_results'))
- self.assertEquals(self.legacy_sandbox.score(self.legacy_sandbox.report(1)), 8)
-
- # Core functionality.
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
-
- m_get.return_value.status_code = 200
- m_get.return_value.content = b''
- m_post.return_value.status_code = 200
- m_post.return_value.content = b''
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.fireeye.FireEyeAPI('username', 'password',
- self.sandbox.api_url, 'profile',
- proxies=proxies)
- api._request('/test')
-
- m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, params=MOCK_ANY,
- proxies=proxies, verify=MOCK_ANY)
-
- api._request('/test', method='POST')
-
- m_post.assert_called_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, data=MOCK_ANY,
- files=None, proxies=proxies,
- verify=MOCK_ANY)
-
- @responses.activate
- def test_reauthenticates_if_logged_out_http_401(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
- status=401)
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
- json=read_resource('fireeye_submissions_status'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_reauthenticates_if_logged_out_json_401(self):
- responses.add(responses.POST, 'http://fireeye.mock/wsapis/v1.2.0/auth/login',
- headers={'X-FeApi-Token': 'MOCK'})
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
- json=read_resource('fireeye_unauthorized'))
- responses.add(responses.GET, 'http://fireeye.mock/wsapis/v1.2.0/submissions/status/1',
- json=read_resource('fireeye_submissions_status'))
- self.assertEquals(self.sandbox.check('1'), True)
-
-
-class TestVMRay(unittest.TestCase):
-
- def setUp(self):
- self.sandbox = sandboxapi.vmray.VMRayAPI('key', 'http://vmray.mock')
-
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://vmray.mock/rest/sample/submit',
- json=read_resource('vmray_sample_submit'))
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), 1169850)
-
- @responses.activate
- def test_analyze_with_errors(self):
- responses.add(responses.POST, 'http://vmray.mock/rest/sample/submit',
- json=read_resource('vmray_sample_submit_errors'))
- with self.assertRaises(sandboxapi.SandboxError):
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'))
-
- @responses.activate
- def test_check(self):
- responses.add(responses.GET, 'http://vmray.mock/rest/submission/sample/1',
- json=read_resource('vmray_submission_sample'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.GET, 'http://vmray.mock/rest/system_info',
- json=read_resource('vmray_system_info'))
- self.assertTrue(self.sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.sandbox.is_available())
- responses.add(responses.GET, 'http://vmray.mock/rest/system_info',
- status=500)
- self.assertFalse(self.sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.GET, 'http://vmray.mock/rest/analysis/sample/1',
- json=read_resource('vmray_analysis_sample'))
- responses.add(responses.GET, 'http://vmray.mock/rest/analysis/1097123/archive/logs/summary.json',
- json=read_resource('vmray_analysis_archive_logs_summary'))
- self.assertEquals(self.sandbox.report(1)['version'], 1)
-
- @responses.activate
- def test_score(self):
- responses.add(responses.GET, 'http://vmray.mock/rest/analysis/sample/1',
- json=read_resource('vmray_analysis_sample'))
- responses.add(responses.GET, 'http://vmray.mock/rest/analysis/1097123/archive/logs/summary.json',
- json=read_resource('vmray_analysis_archive_logs_summary'))
- self.assertEquals(self.sandbox.score(self.sandbox.report(1)), 20)
-
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
-
- m_get.return_value.status_code = 200
- m_post.return_value.status_code = 200
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.vmray.VMRayAPI('key', self.sandbox.api_url,
- proxies=proxies)
- api._request('/test')
-
- m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, params=MOCK_ANY,
- proxies=proxies, verify=MOCK_ANY)
-
- api._request('/test', method='POST')
-
- m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, data=MOCK_ANY,
- files=None, proxies=proxies,
- verify=MOCK_ANY)
-
-
-class TestFalcon(unittest.TestCase):
-
- def setUp(self):
- self.sandbox = sandboxapi.falcon.FalconAPI('key', 'http://falcon.mock/api/v2')
-
- @responses.activate
- def test_analyze(self):
- responses.add(responses.POST, 'http://falcon.mock/api/v2/submit/file',
- json=read_resource('falcon_submit_file'), status=201)
- self.assertEquals(self.sandbox.analyze(io.BytesIO('test'.encode('ascii')), 'filename'), '1')
-
- @responses.activate
- def test_check(self):
- responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/state',
- json=read_resource('falcon_report_state'))
- self.assertEquals(self.sandbox.check('1'), True)
-
- @responses.activate
- def test_is_available(self):
- responses.add(responses.GET, 'http://falcon.mock/api/v2/system/heartbeat',
- json=read_resource('falcon_system_heartbeat'))
- self.assertTrue(self.sandbox.is_available())
-
- @responses.activate
- def test_not_is_available(self):
- self.assertFalse(self.sandbox.is_available())
- responses.add(responses.GET, 'http://falcon.mock/api/v2/system/heartbeat',
- status=500)
- self.assertFalse(self.sandbox.is_available())
-
- @responses.activate
- def test_report(self):
- responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/summary',
- json=read_resource('falcon_report_summary'))
- self.assertEquals(self.sandbox.report(1)['job_id'], '1')
-
- @responses.activate
- def test_score(self):
- responses.add(responses.GET, 'http://falcon.mock/api/v2/report/1/summary',
- json=read_resource('falcon_report_summary'))
- self.assertEquals(self.sandbox.score(self.sandbox.report(1)), 5)
-
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
-
- m_get.return_value.status_code = 200
- m_post.return_value.status_code = 200
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.falcon.FalconAPI('key', self.sandbox.api_url,
- proxies=proxies)
- api._request('/test')
-
- m_get.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, params=MOCK_ANY,
- proxies=proxies, verify=MOCK_ANY)
-
- api._request('/test', method='POST')
-
- m_post.assert_called_once_with(api.api_url + '/test', auth=MOCK_ANY,
- headers=MOCK_ANY, data=MOCK_ANY,
- files=None, proxies=proxies,
- verify=MOCK_ANY)
-
-
-class TestSandboxAPI(unittest.TestCase):
-
- @patch('requests.post')
- @patch('requests.get')
- def test_proxies_is_passed_to_requests(self, m_get, m_post):
- m_get.return_value.status_code = 200
- m_post.return_value.status_code = 200
-
- proxies = {
- 'http': 'http://10.10.1.10:3128',
- 'https': 'http://10.10.1.10:1080',
- }
-
- api = sandboxapi.SandboxAPI(proxies=proxies)
- api.api_url = 'http://sandbox.mock'
- api._request('/test')
-
- m_get.assert_called_once_with('http://sandbox.mock/test', auth=None,
- headers=None, params=None, proxies=proxies,
- verify=True)
-
- api._request('/test', method='POST')
-
- m_post.assert_called_once_with('http://sandbox.mock/test', auth=None,
- headers=None, data=None, files=None,
- proxies=proxies, verify=True)